joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140140b90
Capabilities:
Compare security identifiers

Disassembly:
push rdi
mov eax, 0x1090
call fcn.140165c40
sub rsp, rax
mov rax, qword [0x14027f238]
xor rax, rsp
mov qword [rsp + 0x1080], rax
mov dword [rsp + 0x74], 0
mov word [rsp + 0x78], 0x500
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140140be7
mov eax, 1
jmp 0x140140cc3
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov r9d, 0x1000
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov qword [rsp + 0x10a0], rbx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140140c67
xor edi, edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x74]
mov dword [rsp + 0x48], edi
mov r9d, 0x220
mov dword [rsp + 0x40], edi
mov dl, 2
mov dword [rsp + 0x38], edi
lea r8d, [rdi + 0x20]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140140c6e
mov eax, 1
jmp 0x140140cbb
mov ebx, edi
cmp dword [rsp + 0x80], edi
jbe 0x140140cae
nop dword [rax]
mov rcx, qword [rsp + 0x68]
mov edx, ebx
add rdx, rdx
mov rdx, qword [rsp + rdx*8 + 0x88]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140140ca9
inc ebx
cmp ebx, dword [rsp + 0x80]
jb 0x140140c80
jmp 0x140140cae
mov edi, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, edi
mov rbx, qword [rsp + 0x10a0]
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.140164ec0
add rsp, 0x1090
pop rdi
ret
Function at 0x140140ce0
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14027f238]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], 0x220
or edi, 0xffffffff
mov dword [rsp + 0x7c], 0x223
xor esi, esi
mov dword [rcx], esi
mov rbx, rcx
mov dword [r11 - 0x18], 0x222
mov dword [r11 - 0x14], 0x221
mov dword [rsp + 0x70], 0
mov word [rsp + 0x74], 0x500
nop
movsxd rax, dword [rbx]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], rcx
mov r8d, 0x20
mov dword [rsp + 0x48], esi
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x40], esi
mov dl, 2
mov r9d, dword [rsp + rax*4 + 0x78]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x140140db7
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, esi
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], esi
jne 0x140140dbe
inc dword [rbx]
cmp dword [rbx], 4
jl 0x140140d40
cmp dword [rbx], esi
je 0x140140dd1
call fcn.140140b90
test eax, eax
je 0x140140dd1
mov dword [rbx], esi
mov eax, esi
jmp 0x140140dd3
mov eax, edi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140164ec0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140140e00
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14027f238]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r9d, 1
lea rdx, [0x140235ddc]
xor r8d, r8d
mov rbx, rcx
call fcn.1400be3d0
cmp rax, 0xffffffffffffffff
je 0x140140e8b
cmp qword [rbx + 0x18], 8
jb 0x140140e45
mov rcx, qword [rbx]
jmp 0x140140e48
mov rcx, rbx
mov r8d, 0x104
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140140e8b
cmp word [rsp + 0x20], 0
jne 0x140140e6a
xor r8d, r8d
jmp 0x140140e7e
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140140e73
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400be520
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140164ec0
add rsp, 0x240
pop rbx
ret
Function at 0x140140eb0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x180
mov rax, qword [0x14027f238]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
mov rdi, rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x28], rax
mov r8d, 0x11c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.1401a85d0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140140f1c
or eax, 0xffffffff
jmp 0x140140f89
lea rcx, str.kernel32.dll
mov qword [rsp + 0x198], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140219e48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140140f5b
mov rcx, rax
call qword [fcn.1400059b0]
lea rcx, [rsp + 0x20]
call rbx
jmp 0x140140f66
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x198]
cmp ax, 9
je 0x140140f84
cmp ax, 6
je 0x140140f84
mov byte [rdi], 0
jmp 0x140140f87
mov byte [rdi], 1
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140164ec0
add rsp, 0x180
pop rdi
ret

Function at 0x140140fb0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x14027f238]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x11c
lea rcx, [rsp + 0x20]
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x1401410da
movzx eax, word [rsp + 0x134]
mov dword [rdi], eax
mov eax, dword [rsp + 0x24]
cmp eax, 4
jne 0x140141028
cmp dword [rsp + 0x28], 0
jne 0x14014101f
cmp dword [rsp + 0x30], 2
jne 0x14014101f
mov dword [rbx], 1
xor eax, eax
jmp 0x1401410df
xor eax, eax
mov dword [rbx], eax
jmp 0x1401410df
cmp eax, 5
jne 0x14014106d
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x140141040
mov dword [rbx], 2
jmp 0x1401410df
cmp eax, 1
jne 0x140141052
mov dword [rbx], 3
xor eax, eax
jmp 0x1401410df
cmp eax, 2
jne 0x1401410d6
xor eax, eax
cmp byte [rsp + 0x13a], 1
setne al
add eax, 3
mov dword [rbx], eax
xor eax, eax
jmp 0x1401410df
cmp eax, 6
jne 0x1401410d0
cmp byte [rsp + 0x13a], 1
jne 0x1401410a8
mov ecx, dword [rsp + 0x28]
lea eax, [rcx - 2]
cmp eax, 1
jbe 0x14014109e
cmp ecx, 1
mov eax, 5
mov edx, 7
cmove eax, edx
mov dword [rbx], eax
xor eax, eax
jmp 0x1401410df
mov dword [rbx], 9
xor eax, eax
jmp 0x1401410df
mov eax, dword [rsp + 0x28]
cmp eax, 1
jne 0x1401410c1
mov dword [rbx], 8
mov dword [rbx], 6
xor eax, eax
jmp 0x1401410df
cmp eax, 2
jne 0x1401410b7
mov dword [rbx], 0xa
xor eax, eax
jmp 0x1401410df
mov dword [rbx], 0xffffffff
xor eax, eax
jmp 0x1401410df
mov eax, 0xffffffe5
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140164ec0
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x140145d50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x14027f238]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.1401a85d0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.1401a85d0
xor edi, edi
mov dword [rsp + 0x38], 0x104
mov dword [rsp + 0x3c], edi
test rbx, rbx
je 0x140145ec7
lea rax, [rsp + 0x30]
xor r8d, r8d
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsSCANNER.EXE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140145ec7
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Path
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140145ec7
lea r8, [rsp + 0x40]
mov edx, 0x104
lea rax, [rsp + 0x250]
mov r9d, edi
sub r8, rax
lea rcx, [rsp + 0x250]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140145e58
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140145e58
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140145e33
jmp 0x140145e5d
test rdx, rdx
jne 0x140145e67
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], di
test r9d, r9d
js 0x140145ebc
lea r8, str.SCANAPI.DLL
lea rcx, [rsp + 0x40]
call fcn.140143370
test eax, eax
js 0x140145ebc
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1401c0f98
test eax, eax
jne 0x140145ebc
lea r8, [rsp + 0x250]
mov edx, 0x104
mov rcx, rbx
call fcn.1401432d0
mov rcx, qword [rsp + 0x30]
test eax, eax
js 0x140145ec1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140145ec9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140164ec0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x1401598d0
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov r13, r9
mov r10d, edx
mov r9, qword [r9 + 0xe0]
mov ebx, r10d
shr ebx, 2
mov r11, rcx
xor ecx, ecx
mov qword [rsp + 0x50], r9
mov rax, qword [r13]
and ebx, 1
mov rsi, qword [r13 + 0xe8]
mov edi, ecx
mov r15, qword [r13 + 0x40]
movzx r8d, cx
mov qword [rbp], rcx
mov r14d, ecx
mov edx, dword [rax + 0x40]
mov eax, r10d
shr eax, 0x13
mov r12d, edx
and eax, 1
mov qword [rbp - 8], rcx
and r12d, 8
mov qword [rsp + 0x60], rcx
mov dword [rbp - 0x18], r12d
mov qword [rsp + 0x70], rsi
mov dword [rbp - 0x5c], ecx
mov dword [rbp - 0x24], ecx
mov dword [rbp - 0x30], edx
mov word [rbp + 0x78], cx
mov dword [rbp - 0x44], ecx
mov dword [rbp - 0x40], ecx
mov dword [rsp + 0x68], ecx
mov dword [rbp - 0x6c], ecx
mov dword [rsp + 0x5c], ecx
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x28], ebx
mov dword [rsp + 0x78], ecx
mov qword [rbp - 0x80], r15
mov qword [rbp + 8], rcx
je 0x14015998e
mov dword [r9], 0x80090000
jmp 0x14015999a
test dl, 4
je 0x1401599ab
mov dword [r9], 0x80180005
mov dword [r9 + 4], 0x801a0000
add r9, 8
mov qword [rsp + 0x50], r9
bt r10d, 0x19
jae 0x140159a8a
cmp r11, r15
jae 0x14015cab2
mov ecx, 0xfc00
mov r10d, 0x10000
nop word [rax + rax]
cmp r9, rsi
jae 0x14015cb3f
movzx edx, word [r11]
mov r8, r11
add r11, 2
test eax, eax
je 0x140159a13
mov eax, edx
and eax, ecx
cmp eax, 0xd800
jne 0x140159a13
movzx ecx, word [r11]
and edx, 0x3ff
mov eax, edx
and ecx, 0x3ff
shl eax, 0xa
mov edx, ecx
or edx, eax
add edx, r10d
add r11, 2
test ebx, ebx
je 0x140159a69
mov rcx, r9
test rdi, rdi
je 0x140159a41
mov rax, r8
sub rax, qword [r13 + 0x38]
sar rax, 1
sub eax, dword [rdi + 4]
mov dword [rdi + 8], eax
lea rax, [r9 - 0x10]
cmp rdi, rax
jne 0x140159a41
cmp dword [rdi + 0xc], 0xff
je 0x140159a5b
mov rdi, r9
mov dword [r9], 0x80060000
lea rcx, [r9 + 0x10]
mov dword [r9 + 8], r14d
mov dword [r9 + 0xc], 0xff
sub r8, qword [r13 + 0x38]
mov r9, rcx
sar r8, 1
mov dword [rdi + 4], r8d
mov eax, dword [rbp - 0x68]
mov ecx, 0xfc00
mov dword [r9], edx
add r9, 4
cmp r11, r15
jb 0x1401599d0
movzx r8d, r14w
jmp 0x14015caaf
mov r8, qword [r13 + 0x50]
xor ebx, ebx
add r8, r8
mov qword [rbp - 0x50], rbx
mov rcx, r8
movabs rax, 0xaaaaaaaaaaaaaaab
mul r8
shr rdx, 3
lea rax, [rdx + rdx*2]
shl rax, 2
sub rcx, rax
mov rax, qword [r13 + 0x28]
sub rax, rcx
mov ecx, r10d
add rax, r8
bts ecx, 7
mov qword [rbp - 0x10], rax
movzx r8d, bx
mov eax, r10d
and eax, 0x1000000
cmove ecx, r10d
mov r10d, 0xfc00
mov dword [rsp + 0x58], ecx
jmp 0x140159b22
Function at 0x14015f010
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
xor eax, eax
lock cmpxchg qword [0x140288620], rdi
jne 0x14015f04f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x140288620], rcx
je 0x14015f04f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140288620]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx - 0x10]
lea rax, [rbx - 0x10]
sub qword [0x140288638], rcx
mov r9, rax
sub r9, qword [rax + 8]
cmp qword [r9], rdi
jne 0x14015f08e
add qword [r9 + 0x20], rcx
lea r8, [r9 + 0x20]
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
jmp 0x14015f0b9
lea r8, [rax + 0x20]
mov r9, rax
mov qword [r8], rcx
mov rcx, qword [0x140288630]
mov qword [rax], rdi
mov qword [rbx], rcx
mov qword [rax + 0x18], rdi
test rcx, rcx
je 0x14015f0b2
mov qword [rcx + 0x18], rax
mov qword [0x140288630], rax
mov rcx, qword [r8]
cmp qword [rcx + r9], rdi
lea rdx, [rcx + r9]
jne 0x14015f104
add rcx, qword [rdx + 0x20]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x14015f0e2
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x14015f0f1
mov qword [rax + 0x10], rcx
jmp 0x14015f0f8
mov qword [0x140288630], rcx
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
lea rdx, [rax + r9]
cmp qword [r9 + 8], rdi
jne 0x14015f170
cmp qword [rdx], 1
jne 0x14015f170
mov rax, qword [0x140288638]
mov rdx, qword [0x140288640]
sub rdx, qword [r8]
lea rcx, [rax + rax*2]
shr rcx, 1
cmp rdx, rcx
jbe 0x14015f170
mov rcx, qword [r9 + 0x10]
mov qword [0x140288640], rdx
test rcx, rcx
je 0x14015f149
mov rax, qword [r9 + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x14015f158
mov qword [rax + 0x10], rcx
jmp 0x14015f15f
mov qword [0x140288630], rcx
xor edx, edx
mov r8d, 0x8000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [0x140288620]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_ReleaseMutex]
Function at 0x14018baec
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14018baff
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14018bce8
lea rdx, [0x14027b5e0]
lea rcx, [rsp + 0x20]
call fcn.1401a94a0
int3

Function at 0x1401964fc
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140289800]
xor edx, edx
jmp fcn.14018baec

Function at 0x140196f14
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140289800]
jmp fcn.14018baec

Function at 0x1401c97d0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1401c94f6
call fcn.1401b01d0
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.1401ab14c
jmp 0x1401c9641
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401c9641
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1401c9641
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1401c9525
lock or dword [rcx + 0x14], 0x10
jmp 0x1401c9641
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1401c9539
call fcn.1401c9454
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1401c9549
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1401c954c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1401c3bd8
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1401cfc08
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1401c962f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1401c95dd
mov rcx, rbx
call fcn.1401c3bd8
cmp eax, 0xffffffff
je 0x1401c95c8
mov rcx, rbx
call fcn.1401c3bd8
cmp eax, 0xfffffffe
je 0x1401c95c8
mov rcx, rbx
call fcn.1401c3bd8
movsxd rdi, eax
lea r14, [0x14028a2d0]
mov rcx, rbx
sar rdi, 6
call fcn.1401c3bd8
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1401c95cf
lea rdx, [0x14027f980]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401c95dd
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1401c9601
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1401c9601
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1401c9601
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1401c961f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1401c962a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1401c9646
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1401c94c0
Function at 0x18009af80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x98
mov rax, qword [0x180323178]
xor rax, rsp
mov qword [rsp + 0x70], rax
test edx, edx
jns 0x18009afc3
lea rcx, [rsp + 0x20]
call fcn.1802a16d0
test al, al
je 0x18009b0bd
nop
int3
mov qword [rsp + 0xb0], rbx
mov ebx, dword [rcx + 0x18]
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x88], rdi
shl ebx, 9
add ebx, dword [rcx + 0x1c]
mov qword [rsp + 0x80], r14
lea r14, [rcx + 0x18]
movsxd rsi, edx
mov edi, ebx
inc rsi
cmp rsi, rdi
jbe 0x18009b09d
xor eax, eax
mov dword [rsp + 0x6c], 0xc
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
xorps xmm1, xmm1
mov qword [rsp + 0x38], rax
mov edx, esi
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, r14
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.18009a190
cmp ebx, esi
jae 0x18009b08d
nop
mov rax, qword [r14 + 8]
mov rcx, rdi
and ecx, 0x1ff
mov edx, ebx
shr rdx, 9
shl rcx, 6
add rcx, qword [rax + rdx*8]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x18009b084
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov r9d, dword [rcx + 0x3c]
test rax, rax
mov r8d, dword [rsp + 0x68]
cmovne rdx, rax
call fcn.1800094e0
inc ebx
inc rdi
cmp ebx, esi
jb 0x18009b040
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18009b09d
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FMemory::Free_void____ptr64_]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18029bbf0
add rsp, 0x98
ret
Function at 0x180231810
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
cmp rcx, 0x100
ja 0x180231955
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x30], r14
mov r14, qword [sym.imp.FactoryServer_Core.dll_class_TLockFreeFixedSizeAllocator_TLSCache_256__64__class_FNoopCounter__0__UE::Tasks::Private::SmallTaskAllocator]
mov ecx, dword [r14]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x18023187e
lea edx, [rax + 0x10]
lea ecx, [rax + 0x18]
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void____ptr64___cdecl_FMemory::Malloc_unsigned_long_long_unsigned___int64___unsigned_int_]
mov rbx, rax
test rax, rax
je 0x18023186f
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x180231872
mov rbx, rdi
mov ecx, dword [r14]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rsi, qword [rbx + 8]
test rsi, rsi
jne 0x1802318e4
mov rsi, qword [rbx]
test rsi, rsi
je 0x180231898
mov qword [rbx + 8], rsi
mov qword [rbx], rdi
jmp 0x1802318dd
lea rcx, [r14 + 0x40]
call fcn.18027b3e0
mov qword [rbx + 8], rax
mov rsi, rax
test rax, rax
jne 0x1802318dd
xor edx, edx
mov ecx, 0x10000
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void____ptr64___cdecl_FMemory::MallocPersistentAuxiliary_unsigned_long_long_unsigned___int64___unsigned_int_]
mov qword [rbx + 8], rax
mov edx, 0xff
lea rcx, [rax + 0x100]
mov qword [rax], rcx
mov rax, rcx
sub rdx, 1
jne 0x1802318c3
mov qword [rcx], rdi
mov rsi, qword [rbx + 8]
mov dword [rbx + 0x10], 0x100
mov ecx, dword [rbx + 0x10]
mov rdx, qword [rsi]
sub ecx, 1
mov r14, qword [rsp + 0x30]
mov dword [rbx + 0x10], ecx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x40]
js 0x180231912
test rdx, rdx
mov eax, edi
setne al
test ecx, ecx
setne dil
cmp edi, eax
je 0x180231943
mov r9, qword [rsp + 0x38]
lea rax, [0x1802aabd8]
mov r8d, 0x58
mov qword [rsp + 0x20], rax
lea rdx, str.C:BuildAgentwork78a794e88763017dUE4EngineSourceRuntimeCorePublicContainersLockFreeFixedSizeAllocator.h
lea rcx, str.TLS.NumPartial___0______TLS.NumPartial______TLS.PartialBundle__
call qword [sym.imp.FactoryServer_Core.dll_public:_static_bool___cdecl_FDebug::CheckVerifyFailedImpl_char_const____ptr64__char_const____ptr64__int__void____ptr64__wchar_t_const____ptr64_]
test al, al
je 0x180231943
nop
int3
mov rdi, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x38
ret
mov rax, qword [sym.imp.FactoryServer_Core.dll_class_FMalloc____ptr64___ptr64_GMalloc]
mov edx, 0xb0
mov rcx, qword [rax]
lea r8d, [rdx - 0x70]
mov rax, qword [rcx]
add rsp, 0x38
jmp qword [rax + 0x28]
Function at 0x18023d490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.1802316c0
test bl, 1
je 0x18023d562
test bl, 4
jne 0x18023d555
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, qword [sym.imp.FactoryServer_Core.dll_class_TLockFreeFixedSizeAllocator_TLSCache_256__64__class_FNoopCounter__0__UE::Tasks::Private::SmallTaskAllocator]
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebp, ebp
mov rbx, rax
test rax, rax
jne 0x18023d507
lea edx, [rax + 0x10]
lea ecx, [rax + 0x18]
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void____ptr64___cdecl_FMemory::Malloc_unsigned_long_long_unsigned___int64___unsigned_int_]
mov rbx, rax
test rax, rax
je 0x18023d4f9
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov dword [rax + 0x10], ebp
jmp 0x18023d4fc
mov rbx, rbp
mov ecx, dword [rsi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x100
jl 0x18023d52f
mov rdx, qword [rbx]
test rdx, rdx
je 0x18023d521
lea rcx, [rsi + 0x40]
call fcn.18027bec0
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rbp
mov dword [rbx + 0x10], ebp
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, rdi
inc dword [rbx + 0x10]
mov qword [rbx + 8], rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edx, 0xb0
mov rcx, rdi
call fcn.180001530
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180001040
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x180001075
xor eax, eax
lea r8, [0x180001010]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
test rax, rax
je 0x180001075
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
add rsp, 0x38
ret