joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052cd0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov r8d, 8
xor edx, edx
lea rcx, str.DISMAPI.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax], r11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140052d1d
xor eax, eax
jmp 0x140052ee3
lea rdx, str.DismInitialize
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
jne 0x140052d5e
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
xor eax, eax
jmp 0x140052ee3
lea rdx, str.DismOpenSession
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
jne 0x140052d9f
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], 0
xor eax, eax
jmp 0x140052ee3
lea rdx, str.DismGetDrivers
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x18], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x18], 0
jne 0x140052de0
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x18], 0
xor eax, eax
jmp 0x140052ee3
lea rdx, str.DismGetDriverInfo
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x20], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x20], 0
jne 0x140052e21
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x20], 0
xor eax, eax
jmp 0x140052ee3
lea rdx, str.DismDelete
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x28], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x28], 0
jne 0x140052e62
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x28], 0
xor eax, eax
jmp 0x140052ee3
lea rdx, str.DismCloseSession
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x30], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x30], 0
jne 0x140052ea0
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x30], 0
xor eax, eax
jmp 0x140052ee3
lea rdx, str.DismShutdown
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x38], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x38], 0
jne 0x140052ede
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x38], 0
xor eax, eax
jmp 0x140052ee3
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400530a0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x40]
test eax, eax
je 0x1400530e5
mov rcx, qword [rsp + 0x40]
call fcn.140052c30
mov rcx, qword [rsp + 0x40]
add rcx, 0x40
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor r11d, r11d
mov rax, qword [rsp + 0x40]
mov word [rax + 0x40], r11w
mov rcx, qword [rsp + 0x40]
add rcx, 0x450
call fcn.140004b00
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0x450
call fcn.140004bc0
add rsp, 0x38
ret
Function at 0x140054140
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x14005418c
xor ecx, ecx
mov rax, qword [rsp + 0x48]
mov word [rax], cx
mov rax, qword [rsp + 0x20]
jmp 0x1400541e2
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140053d60
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400541dd
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140053e90
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400541dd
xor ecx, ecx
mov rax, qword [rsp + 0x48]
mov word [rax], cx
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400541f0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x40]
add rdx, 0x40
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, qword [rsp + 0x40]
add rcx, 0x248
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rsp + 0x40]
call fcn.140052cd0
test eax, eax
je 0x140054263
mov r9d, dword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140053640
mov dword [rsp + 0x20], eax
jmp 0x14005426b
mov dword [rsp + 0x20], 0xffffffff
mov rcx, qword [rsp + 0x40]
call fcn.140052c30
mov rcx, qword [rsp + 0x40]
add rcx, 0x40
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor r11d, r11d
mov rax, qword [rsp + 0x40]
mov word [rax + 0x40], r11w
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1400542a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov qword [rsp + 0x258], 0xfffffffffffffffe
mov rax, qword [0x140079ca0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x280]
add rcx, 0x450
call fcn.140004aa0
nop
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov qword [rsp + 0x250], 0
mov rax, qword [rsp + 0x280]
mov qword [rax], 0
mov rax, qword [rsp + 0x280]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x280]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x280]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x280]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x280]
mov qword [rax + 0x28], 0
mov rax, qword [rsp + 0x280]
mov qword [rax + 0x30], 0
mov rax, qword [rsp + 0x280]
mov qword [rax + 0x38], 0
xor ecx, ecx
mov rax, qword [rsp + 0x280]
mov word [rax + 0x40], cx
mov rdx, qword [rsp + 0x280]
add rdx, 0x248
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x20], 0x25
lea r9, [0x140065220]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x280]
call fcn.140054140
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0
je 0x1400543fe
mov rcx, qword [rsp + 0x280]
add rcx, 0x248
mov rdx, qword [rsp + 0x250]
call fcn.140004cf0
mov rcx, qword [rsp + 0x280]
add rcx, 0x450
call fcn.140004b00
nop
mov rax, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002f9d0
add rsp, 0x270
pop rdi
ret
Function at 0x14000f880
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000f903
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14000f8ce
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.1400146c0
mov rcx, qword [rsi]
call fcn.140014650
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x14000f8fc
mov qword [rsi], rdi
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140014680
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
invalid
lodsd eax, dword [rsi]
invalid
stc
invalid

Function at 0x140010e90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov r8d, 0x104
mov rdx, rdi
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140010eff
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140010e20
test al, al
jne 0x140010f0d
add rbx, 8
cmp rbx, 0x18
jne 0x140010ecd
xor esi, esi
jmp 0x140010f10
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14002a340
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001e190
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rdx
test ecx, ecx
jle 0x14001e1fd
mov qword [rsp], rbx
lea rbx, [0x140350790]
mov r11d, ecx
nop dword [rax + rax]
movzx r8d, word [r10]
lea r10, [r10 + 2]
lea ecx, [r8 - 0x61]
cmp ecx, 0x1a
sbb cx, cx
and cx, 0x20
sub r8w, cx
mov ecx, eax
shr eax, 8
movzx r9d, r8w
xor rcx, r9
shr r9, 8
movzx edx, cl
mov ecx, dword [rbx + rdx*4]
xor ecx, eax
mov eax, ecx
shr ecx, 8
xor r9, rax
movzx eax, r9b
mov eax, dword [rbx + rax*4]
xor eax, ecx
sub r11, 1
jne 0x14001e1b0
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x14001e390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
test rsi, rsi
je 0x14001e48a
mov eax, 0xffffffff
lock xadd dword [rsi + 0x48], eax
cmp eax, 1
jne 0x14001e48a
mov rcx, qword [rsi + 0x38]
mov qword [rsp + 0x38], rbx
test rcx, rcx
mov qword [rsp + 0x40], rbp
lea rbx, [rsi + 0x18]
mov qword [rsp + 0x48], rdi
cmovne rbx, rcx
mov edi, dword [rsi + 0x40]
test edi, edi
je 0x14001e3f5
nop word [rax + rax]
mov rcx, rbx
call fcn.14001e390
add rbx, 8
sub edi, 1
jne 0x14001e3e0
mov rcx, qword [rsi + 0x38]
mov rbp, qword [rsp + 0x40]
test rcx, rcx
je 0x14001e404
call fcn.14004dcf0
mov ecx, dword [0x140363c68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14001e448
lea ecx, [rax + 0x18]
call fcn.140012750
mov rbx, rax
test rax, rax
je 0x14001e436
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x14001e439
mov rbx, rdi
mov ecx, dword [0x140363c68]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x14001e472
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001e462
lea rcx, [0x140363c70]
call fcn.140021220
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x14001e476
mov rdi, qword [rbx + 8]
mov qword [rsi], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x14001ed80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140363d30]
jmp fcn.1400209e0
Function at 0x14001fa60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov ecx, dword [0x140363d30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001fab1
lea ecx, [rax + 0xc]
call fcn.140012750
mov rbx, rax
test rax, rax
je 0x14001fa9f
mov qword [rax], rsi
mov dword [rax + 8], esi
jmp 0x14001faa2
mov rbx, rsi
mov ecx, dword [0x140363d30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 8], 0x40
jl 0x14001fad2
mov edx, dword [rbx]
test edx, edx
je 0x14001fac9
lea rcx, [0x140363d38]
call fcn.140021140
mov eax, dword [rbx + 4]
mov dword [rbx], eax
mov qword [rbx + 4], rsi
test edi, edi
jne 0x14001fadb
mov rcx, rsi
jmp 0x14001fafe
mov rcx, rdi
lea rdx, [0x140363e48]
mov rax, rdi
shr rax, 0xe
and ecx, 0x3fff
mov rax, qword [rdx + rax*8]
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
and qword [rcx], 0xfffffffffc000000
mov dword [rcx + 0x10], esi
mov eax, dword [rbx + 4]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 8], rax
inc dword [rbx + 8]
mov dword [rbx + 4], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001fd70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
movss xmm0, dword [0x140266870]
jmp fcn.1400dbcf0
Function at 0x140021280
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
mov edi, dword [r14 + 0x40]
lea rbx, [r14 + 0x18]
cmovne rbx, rcx
test edi, edi
je 0x1400212c5
nop
mov rcx, rbx
call fcn.14001e390
add rbx, 8
sub edi, 1
jne 0x1400212b0
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1400212cf
call fcn.14004dcf0
mov ecx, dword [0x140363c68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x140021313
lea ecx, [rax + 0x18]
call fcn.140012750
mov rbx, rax
test rax, rax
je 0x140021301
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x140021304
mov rbx, rdi
mov ecx, dword [0x140363c68]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x14002133d
mov rdx, qword [rbx]
test rdx, rdx
je 0x14002132d
lea rcx, [0x140363c70]
call fcn.140021220
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x140021341
mov rdi, qword [rbx + 8]
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140024820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
sub rsp, 0x50
movsxd rdi, dword [rcx + 8]
mov rbx, rdx
mov r12, rcx
test edi, edi
jne 0x140024846
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov qword [rsp + 0x28], r15
cmp dword [rcx + 8], eax
je 0x140024885
mov rcx, qword [rcx]
test rcx, rcx
je 0x140024885
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x38]
mov rax, qword [rax]
cmp rax, qword [rbx]
mov r15, rdi
setne al
xor esi, esi
mov byte [rsp + 0x70], al
nop dword [rax]
nop dword [rax + rax]
movsxd rbp, r14d
inc rsi
inc r14d
cmp rsi, r15
jge 0x14002490b
mov rdx, qword [rsp + 0x78]
mov rbx, rsi
shl rbx, 4
movzx edi, al
nop dword [rax]
mov rcx, qword [r12]
xor eax, eax
cmp dword [rcx + rbx + 8], eax
je 0x1400248eb
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x1400248eb
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x38]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, qword [rdx]
setne cl
cmp edi, ecx
jne 0x140024906
inc r14d
inc rsi
add rbx, 0x10
cmp rsi, r15
jl 0x1400248c0
movzx eax, byte [rsp + 0x70]
mov edi, r14d
sub edi, ebp
test al, al
je 0x140024945
cmp r13d, ebp
je 0x140024940
mov rdx, rbp
movsxd rcx, r13d
shl rdx, 4
add rdx, qword [r12]
shl rcx, 4
add rcx, qword [r12]
movsxd r8, edi
shl r8, 4
call fcn.140251fd4
movzx eax, byte [rsp + 0x70]
add r13d, edi
jmp 0x1400249bc
mov rbx, rbp
shl rbx, 4
add rbx, qword [r12]
test edi, edi
je 0x1400249bc
mov eax, dword [rbx + 8]
test eax, eax
je 0x140024963
mov rcx, qword [rbx]
mov r8, rcx
jmp 0x140024968
mov r8, qword [rbx]
xor ecx, ecx
test rcx, rcx
je 0x140024972
mov rax, qword [rcx]
jmp 0x140024981
test eax, eax
je 0x1400249a1
test r8, r8
je 0x1400249a1
mov rax, qword [r8]
mov rcx, r8
xor edx, edx
call qword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002499a
xor r8d, r8d
xor edx, edx
call fcn.140058210
mov qword [rbx], rax
mov dword [rbx + 8], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400249ae
call fcn.14004dcf0
add rbx, 0x10
sub edi, 1
jne 0x140024954
movzx eax, byte [rsp + 0x70]
xor al, 1
mov byte [rsp + 0x70], al
cmp rsi, r15
jl 0x1400248a0
mov r14, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x28]
sub eax, r13d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
Function at 0x140025220
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
lea rax, [0x140271d00]
mov rsi, rcx
mov qword [rcx], rax
mov rdi, rdx
add rcx, 8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r13d, r13d
mov qword [rsi + 0x58], rdi
lea rcx, [rsp + 0x20]
mov dword [rsi + 0x30], r13d
mov dword [rsi + 0x40], r13d
mov dword [rsi + 0x50], r13d
call fcn.1400d77f0
mov edx, dword [rax + 0x10]
test edx, edx
mov eax, 0x10000
cmove edx, eax
lea ecx, [rdx + 0x1fffff]
neg edx
mov eax, edx
and rcx, rax
call fcn.1400d26a0
mov rcx, rsi
mov qword [rsi + 0x38], rax
call fcn.1400314d0
mov ecx, eax
call fcn.1400d26a0
mov qword [rsi + 0x48], rax
test rax, rax
je 0x1400252c6
cmp qword [rsi + 0x38], r13
jne 0x1400252d9
lea rcx, str.Memory_pools_allocations_failed__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400db0a0
test byte [rsi + 0x38], 0xf
jne 0x1400252e5
test byte [rsi + 0x48], 0xf
je 0x1400252f8
lea rcx, str.OS_allocations_must_be_aligned_to_a_value_multiple_of_16__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400db0a0
mov r15d, r13d
lea r12, [0x14034e270]
lea rdx, [0x14036c828]
nop dword [rax]
movsxd rax, r15d
mov edi, r13d
imul rbx, rax, 0x4020
mov eax, dword [r12]
add rbx, rdx
add eax, 0x10
mov edx, dword [r12 + 4]
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x4018], edx
test edx, edx
je 0x140025383
mov ebp, dword [rbx + 0x10]
mov rcx, rsi
mov r14d, dword [rsi + 0x50]
add ebp, r14d
call fcn.1400314d0
cmp ebp, eax
ja 0x140025362
mov eax, r14d
mov dword [rsi + 0x50], ebp
add rax, qword [rsi + 0x48]
jmp 0x140025365
mov rax, r13
lea rcx, [rax + 0x10]
mov qword [rax], r13
mov qword [rax + 8], rcx
mov ecx, edi
inc edi
mov qword [rbx + rcx*8 + 0x18], rax
mov edx, dword [rbx + 0x4018]
cmp edi, edx
jb 0x140025340
cmp edx, 0x800
jae 0x1400253af
mov eax, edx
mov r8d, 0x800
sub r8d, edx
add rax, 3
shl r8, 3
xor edx, edx
lea rcx, [rbx + rax*8]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbx + 0x4018]
mov eax, dword [rbx + 0x10]
inc r15d
imul eax, edx
add r12, 8
lea rdx, [0x14036c828]
add eax, 0x4000
mov dword [rbx + 0x401c], eax
cmp r15d, 0xe
jb 0x140025310
lea r11, [rsp + 0xa0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002b4c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14002b4ec
mov ebp, dword [rdx + 0x28]
jmp 0x14002b4ef
mov ebp, r12d
call fcn.14001fb40
mov rdi, rax
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x14002b532
lea ecx, [rax + 0x18]
call fcn.140012750
mov rbx, rax
test rax, rax
je 0x14002b524
mov qword [rax], r12
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
jmp 0x14002b527
mov rbx, r12
mov ecx, dword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x14002b5a4
mov rax, qword [rbx]
test rax, rax
je 0x14002b557
mov edx, 0x20
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], edx
mov rcx, rax
mov qword [rbx], r12
jmp 0x14002b5a7
lea rcx, [rdi + 8]
call fcn.140020990
mov qword [rbx + 8], rax
test rax, rax
jne 0x14002b596
xor edx, edx
mov ecx, 0x2000
call fcn.140056c90
mov qword [rbx + 8], rax
mov edx, 0x1f
nop
lea rcx, [rax + 0x100]
mov qword [rax], rcx
mov rax, rcx
sub rdx, 1
jne 0x14002b580
mov qword [rcx], r12
mov rcx, qword [rbx + 8]
mov edx, 0x20
mov dword [rbx + 0x10], edx
jmp 0x14002b5a7
mov edx, dword [rbx + 0x10]
mov rax, qword [rcx]
mov qword [rbx + 8], rax
lea eax, [rdx - 1]
mov dword [rbx + 0x10], eax
lea rax, [0x140266608]
mov rbx, qword [rsp + 0x58]
mov qword [rcx], rax
lea eax, [rbp + 1]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x50], r12
mov dword [rcx + 8], 0xff
mov dword [rcx + 0xc], eax
lea rax, [0x1402744f8]
mov qword [rcx], rax
mov rax, r14
mov byte [rcx + 0x28], r12b
mov qword [rcx + 0x30], r12
mov qword [r14], rcx
mov qword [r14 + 8], rsi
mov dword [r14 + 0x10], r15d
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400348c0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
lea r14, [rsp + 0x40]
mov ebx, r12d
lea rbp, [r11 + 0x10]
mov rdi, rcx
mov esi, 0x400
call fcn.14001d7d0
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x20], r12
mov r8d, 0x200
mov r15, rax
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
mov ebp, 0xffffffff
cmovs eax, ebp
cmp eax, 0x200
jae 0x140034950
cmp eax, ebp
jne 0x1400349aa
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movsxd rdi, esi
lea rcx, [rdi + rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r14, rax
test rax, rax
je 0x1400349c2
mov r9, qword [rsp + 0x490]
lea rax, [rsp + 0x498]
mov rcx, qword [r15]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
cmovs eax, ebp
cmp eax, esi
cmovge eax, ebp
add esi, esi
cmp eax, ebp
je 0x140034950
cdqe
mov rcx, r14
mov word [r14 + rax*2], r12w
call sub.KERNEL32.dll_OutputDebugStringW
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140250070
add rsp, 0x450
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret