joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140142570
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r12, r9
mov r13, r8
mov r15, rdx
mov rbp, rcx
mov r14, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x110]
mov rax, qword [0x140190028]
xor rax, rsp
mov qword [rsp + 0x90], rax
test rdi, rdi
jne 0x1401425be
call fcn.140129f80
mov rdi, rax
test r14, r14
cmove r14, rdi
mov rcx, rdi
call fcn.14007f250
mov rsi, rax
lea rax, [rax*2 + 2]
cmp rax, r15
ja 0x14014262e
lea rax, [rsi + rsi]
mov rbx, rax
not rbx
lea rcx, [r15 + rbx]
dec rcx
cmp rcx, r12
jb 0x14014260e
lea rcx, [r15 - 1]
or rax, 1
cmp rcx, rax
jae 0x14014268b
mov dword [rsp + 0x20], 0x6d
jmp 0x140142636
mov dword [rsp + 0x20], 0x68
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
jmp 0x14014264c
mov dword [rsp + 0x20], 0x62
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
call fcn.14008dd10
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400a5d70
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call fcn.14004b600
jmp 0x140142651
xor ecx, ecx
jmp 0x14014267a
xor ecx, ecx
xor edi, edi
jmp 0x14014267a
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
mov byte [rbp], 0
lea r8, [rsi + rbp]
inc r8
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x40], r8
xor r9d, r9d
call fcn.14007f260
xor ecx, ecx
mov edi, 0
test eax, eax
je 0x14014267a
mov rdi, qword [rsp + 0x38]
sub rdi, r12
add rbx, rdi
mov rcx, qword [rsp + 0x40]
je 0x1401426fb
mov rax, qword [rsp + 0x40]
lea rcx, [rax + rsi]
xor edx, edx
mov r8, rbx
call fcn.1400a7ec0
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 1]
mov qword [rsp + 0x48], rax
mov rax, rsi
not rax
add rdi, rax
mov byte [rcx + rdi], 1
test r12, r12
mov rbx, rcx
je 0x140142733
add rbp, rsi
add rbp, r15
sub rbp, r12
sub rbp, rsi
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.1400a7810
mov r13, qword [rsp + 0x48]
mov rcx, r13
mov rdx, rsi
call fcn.14007e9e0
test eax, eax
je 0x140142685
mov r15, qword [rsp + 0x38]
sub r15, rsi
mov rcx, r15
call fcn.14004b5a0
xor edi, edi
test rax, rax
je 0x140142681
mov r12, rax
mov qword [rsp + 0x20], r14
mov rcx, rax
mov rdx, r15
mov r8, r13
mov r9, rsi
call fcn.1400820e0
test eax, eax
je 0x140142677
cmp qword [rsp + 0x38], rsi
je 0x1401427aa
cmp r15, 1
mov rax, r15
adc rax, 0
xor ecx, ecx
mov dl, byte [r12 + rcx]
xor byte [rbx + rcx], dl
inc rcx
cmp rax, rcx
jne 0x14014279b
movaps xmm0, xmmword [0x140163e40]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rsp + 0x20], r14
mov rdx, rsi
mov r8, rbx
mov r9, r15
call fcn.1400820e0
test eax, eax
je 0x140142677
mov edi, 1
test rsi, rsi
je 0x140142677
xor eax, eax
mov cl, byte [rsp + rax + 0x50]
xor byte [r13 + rax], cl
inc rax
cmp rsi, rax
jne 0x1401427f0
jmp 0x140142677
Function at 0x140145cd0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140190028]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x140163e40]
lea r14, [rsp + 0xc0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, r14
call fcn.14012a100
and byte [r14], 0xf8
mov al, byte [r14 + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [r14 + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.1400a7ec0
lea r8, [0x14017d710]
mov rcx, r15
mov rdx, r14
call fcn.140095940
mov rcx, rdi
mov rdx, r15
call fcn.140147a20
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.1400a5d70
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140021240
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x140021272
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x1400212d1
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x1400212bd
mov rcx, rbx
mov r8, r14
call fcn.1400c1690
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x14002125b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14002136e
lea rcx, [rbx*8]
call fcn.1400224e0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x140021345
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x140021334
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x14002125b
call fcn.14001dab0
mov r8, qword [rsi + 0x10]
jmp 0x14002125b
call fcn.1400257c0
int3

Function at 0x140021380
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x1400213b2
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x140021411
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x1400213fd
mov rcx, rbx
mov r8, r14
call fcn.1400c1690
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x14002139b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x1400214ae
lea rcx, [rbx*8]
call fcn.1400224e0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x140021485
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x140021474
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x14002139b
call fcn.14001dab0
mov r8, qword [rsi + 0x10]
jmp 0x14002139b
call fcn.1400257c0
int3
Function at 0x1400214c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x1400214f2
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x140021551
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x14002153d
mov rcx, rbx
mov r8, r14
call fcn.1400c1690
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x1400214db
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x1400215ee
lea rcx, [rbx*8]
call fcn.1400224e0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x1400215c5
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x1400215b4
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x1400214db
call fcn.14001dab0
mov r8, qword [rsi + 0x10]
jmp 0x1400214db
call fcn.1400257c0
int3

Function at 0x140021600
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140021631
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140021683
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x140021675
mov rcx, rbx
call fcn.1400c1690
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x14002161b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140021729
lea rcx, [r14*8]
call fcn.1400224e0
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140021700
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x1400216ef
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x14002161b
call fcn.14001dab0
mov rbx, qword [rsi + 8]
jmp 0x14002161b
call fcn.1400257c0
int3
Function at 0x140024160
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140024191
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x1400241e3
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x1400241d5
mov rcx, rbx
call fcn.1400c1690
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x14002417b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140024289
lea rcx, [r14*8]
call fcn.1400224e0
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140024260
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x14002424f
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x14002417b
call fcn.14001dab0
mov rbx, qword [rsi + 8]
jmp 0x14002417b
call fcn.1400257c0
int3
Function at 0x140028df0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1400224e0
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400831e0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140028e48
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400290f0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [0x142231158]
mov rcx, qword [rax]
call fcn.1400225c0
mov rcx, qword [0x142203580]
call fcn.1400291e0
mov rax, rsi
shl rax, 0xf
movabs rcx, 0x7ffffffffff8000
and rcx, rax
mov qword [0x142203578], rcx
mov rcx, rsi
shl rcx, 0x14
call fcn.1400291a0
mov qword [0x142203580], rax
test rax, rax
je 0x140029152
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140028950
mov rdi, qword [str.H__B]
lea rdx, str.Failed_to_allocate
mov rcx, rdi
call fcn.140018f70
mov rcx, rdi
mov rdx, rsi
call fcn.14001dac0
mov rsi, rax
lea rdx, str.MB_for_transposition_table.
mov rcx, rax
call fcn.140018f70
mov rcx, rsi
call fcn.140018b90
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x1400291e0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x1400291fd
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140029204
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdi, qword [str.H__B]
lea rdx, str.Failed_to_free_large_page_memory._Error_code:_0x
mov rcx, rdi
call fcn.140018f70
mov rax, qword [rdi]
mov rax, qword [rax - 0x18]
mov ecx, dword [rdi + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rdi + rax + 8], ecx
mov rcx, rdi
mov edx, esi
call fcn.140043960
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
mov edx, dword [rax + rcx + 8]
and edx, 0xffffffb5
or edx, 2
mov dword [rax + rcx + 8], edx
mov rcx, rax
call fcn.140018b90
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x140031490
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x1400c2048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400314e9
cmp rdi, rax
je 0x1400314e9
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop word [rax + rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400314e9
cmp rdi, rax
jne 0x1400314d0
mov rdi, qword [0x1400c2050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x140031503
mov ecx, 0x1f
call fcn.1400842e0
jmp 0x14003152a
cmp dword [rdi], 0
je 0x140031511
mov byte [0x1400ed478], 1
jmp 0x14003152a
mov dword [rdi], 1
mov rcx, qword [str._X_r_]
mov rdx, qword [str.8X_r_]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x14003154a
mov rcx, qword [0x1400c2058]
mov rdx, qword [0x1400c2060]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rdi], 2
test bl, bl
je 0x140031553
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x1400c2010]
mov rax, qword [rax]
test rax, rax
je 0x140031572
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call qword [0x14225d008]
call fcn.1400835b0
lea rcx, [0x140083b40]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x1400c2040]
mov qword [rcx], rax
lea rcx, [0x1400316c0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.1400835a0
movsxd rdi, dword [0x1400ed464]
lea rcx, [rdi*8 + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rdi, rdi
jle 0x140031602
mov ebx, edi
mov r14, qword [0x1400ed468]
xor r15d, r15d
nop word [rax + rax]
mov rcx, qword [r14 + r15*8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rdi, [rax + 1]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi + r15*8], rax
mov rdx, qword [r14 + r15*8]
mov rcx, rax
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
inc r15
cmp rbx, r15
jne 0x1400315d0
jmp 0x140031604
xor ebx, ebx
mov qword [rsi + rbx*8], 0
mov qword [0x1400ed468], rsi
call fcn.1400833f0
mov rax, qword [0x1400ed470]
mov rcx, qword [0x1400c2018]
mov rcx, qword [rcx]
mov qword [rcx], rax
mov ecx, dword [0x1400ed464]
mov rdx, qword [0x1400ed468]
mov r8, qword [0x1400ed470]
call fcn.1400287e0
mov dword [0x1400ed47c], eax
cmp dword [0x1400ed45c], 0
je 0x140031674
cmp byte [0x1400ed478], 0
jne 0x140031668
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x1400ed47c]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x140031d70
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov r15, qword [0x1400c21a0]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.140033660
mov ecx, dword [0x1400ed010]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140031eb7
call fcn.140033bf0
mov rsi, rax
xor eax, eax
cmp qword [0x1400d5858], 0
je 0x140031eb7
test rsi, rsi
je 0x140031eb7
mov dword [rsi + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x70], eax
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
lea rcx, [rsi + 0x68]
call fcn.140084880
cmp eax, 1
je 0x140031ee5
mov qword [rsi + 0x68], 0xffffffffffffffff
mov dword [rsi + 0xb8], 0
mov rdi, rsi
add rdi, 0x28
mov qword [rsi + 0x28], 0
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call r12
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
mov r8, rax
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140031ee0
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
mov dword [rsi + 0xbc], 0
mov eax, dword [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov dword [rsi + 0x40], eax
mov ecx, dword [0x1400ed010]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, eax
mov rax, rsi
test ecx, ecx
je 0x140031ee0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
mov rdx, qword [r15]
cmp rdx, rcx
jne 0x140031edb
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400848e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
movups xmm0, xmmword [0x1400c218b]
movups xmmword [rsp + 0x9b], xmm0
movaps xmm0, xmmword [0x1400c2180]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x1400c2170]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x1400c2160]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c2150]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c2140]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x67]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140031f73
cmp byte [rsp + rcx + 0x40], 0
jne 0x140031f60
cmp rcx, 0x69
ja 0x140031f80
mov word [rsp + rax + 0x3f], 0xa
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140032ae0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140031d70
mov rdi, rax
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
call fcn.140032800
test byte [rdi + 0x40], 0x30
jne 0x140032b1c
add rdi, 0xd0
mov rcx, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
mov ecx, dword [0x1400ed010]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140032bb7
mov rdi, rax
cmp qword [rax + 0x28], 0
jne 0x140032b5e
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x140032b50
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x30], 0
mov rsi, qword [rdi + 8]
jmp 0x140032ba1
mov rsi, qword [rdi + 8]
mov rcx, qword [rdi + 0x30]
mov dword [rdi + 0xbc], 1
test rcx, rcx
je 0x140032b7b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x30], 0
test byte [rdi + 0x44], 4
je 0x140032bb7
mov dword [rdi], 0xdeadbeef
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x28], 0
mov rcx, rdi
call fcn.140032bc0
mov ecx, dword [0x1400ed010]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
int3

Function at 0x140033660
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [0x1400ed4ac], 1
jne 0x140033676
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400ed018]
call fcn.140084890
mov rcx, qword [0x1400ed4d0]
test rcx, rcx
je 0x1400336b3
lea rax, [0x1400ed4ac]
nop word cs:[rax + rax]
mov rsi, rcx
cmp qword [rcx], rax
je 0x1400336fd
mov rcx, qword [rsi + 0x18]
test rcx, rcx
jne 0x1400336a0
jmp 0x1400336b5
xor esi, esi
mov ecx, 1
mov edx, 0x20
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov rdi, rax
lea rax, [0x1400ed4ac]
mov qword [rdi], rax
mov dword [rdi + 0x10], 1
lea rax, [rsi + 0x18]
test rsi, rsi
lea rcx, [0x1400ed4d0]
cmovne rcx, rax
mov qword [rcx], rdi
lea rcx, [rdi + 8]
xor edx, edx
call fcn.140084660
mov rsi, rdi
jmp 0x140033700
inc dword [rsi + 0x10]
lea rcx, [0x1400ed018]
call fcn.1400848d0
lea rdi, [rsi + 8]
mov rcx, rdi
call fcn.1400843e0
mov eax, dword [0x1400ed4ac]
cmp eax, 1
je 0x14003376c
test eax, eax
jne 0x140033744
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400ed010], eax
cmp eax, 0xffffffff
je 0x140033782
mov dword [0x1400ed4ac], 1
jmp 0x14003376c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [0x1400ed4ac]
lea r8, [0x1400ed4ac]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call fcn.140084f50
mov rcx, rdi
call fcn.140084550
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140032390
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140033ca0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rdi, qword [0x1400c21a0]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x90], rax
test rcx, rcx
je 0x140033cd7
mov rsi, rcx
call fcn.140084880
cmp eax, 1
je 0x140033cf9
mov qword [rsi], 0xffffffffffffffff
mov rax, qword [rsp + 0x90]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x140033cf4
add rsp, 0x98
pop rdi
pop rsi
ret
call fcn.1400848e0
movups xmm0, xmmword [0x1400c218b]
movups xmmword [rsp + 0x7b], xmm0
movaps xmm0, xmmword [0x1400c2180]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400c2170]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x1400c2160]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400c2150]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x1400c2140]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movaps xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov ecx, eax
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x27
nop dword [rax + rax]
mov rcx, rax
inc rax
cmp rcx, 0x69
ja 0x140033d83
cmp byte [rsp + rcx + 0x20], 0
jne 0x140033d70
cmp rcx, 0x69
ja 0x140033d90
mov word [rsp + rax + 0x1f], 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3