joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005277
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140077b98
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
mov r14, r8
xor ecx, ecx
mov rdi, rdx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rcx + rdi]
movabs rdx, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rdx
cmp rcx, 4
jb 0x140077bc2
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rsi, edx
mov rcx, qword [rax + rsi*8]
test rcx, rcx
je 0x140077c0a
mov eax, dword [rdi]
cmp dword [rcx + 8], eax
je 0x140077c0c
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140077bfd
xor ecx, ecx
test rcx, rcx
jne 0x140077c59
mov ecx, 0x10
call fcn.140002cca
mov qword [rsp + 0x30], rax
mov r8, rax
test rax, rax
je 0x140077c3b
and qword [rax], 0
mov eax, dword [rdi]
mov dword [r8 + 8], eax
mov eax, dword [r14]
mov dword [r8 + 0xc], eax
jmp 0x140077c3e
xor r8d, r8d
mov rcx, qword [rbx + 8]
mov rax, r8
mov rdx, qword [rcx + rsi*8]
mov qword [r8], rdx
mov rcx, qword [rbx + 8]
mov qword [rcx + rsi*8], r8
inc dword [rbx + 4]
jmp 0x140077c5b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400054d9
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400ce160
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400cddd8

Function at 0x1400054e3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140022eb4
mov r9, rcx
lea r10, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r10 + 4]
xor edx, dword [r10]
btr edx, 0x1f
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x140022ec4
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov edx, dword [r10 + 4]
xor edx, dword [r10]
btr edx, 0x1f
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x140022f09
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], r11d
ret

Function at 0x1400055e2
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14007c110
mov ecx, dword [0x140156850]
xor edx, edx
jmp fcn.140003936

Function at 0x140005691
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14007d688
mov qword [rcx + 0x48], rdx
mov rdx, rcx
mov ecx, dword [0x140156850]
jmp fcn.140003936

Function at 0x14000579a
Capabilities:
Terminate process

Disassembly:
jmp 0x1400ae860
sub rsp, 0x28
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x1400ae879
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.140002905
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x14000580d
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140078a14
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebx, ebx
lea rsi, [rdx + 0x10]
mov r14, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140078a3c
mov esi, ebx
mov ecx, dword [0x140156850]
call fcn.140002f95
cmp rax, rsi
je 0x140078abf
call fcn.140003887
mov ecx, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov eax, dword [r14]
mov edx, 0xfffffff
xor eax, ecx
mov dword [rsp + 0x20], ebx
and eax, edx
mov r9d, 5
xor ecx, eax
mov eax, dword [r14]
xor eax, ecx
mov rcx, rbp
and eax, edx
lea rdx, [rsp + 0x20]
xor eax, dword [r14]
mov dword [rsp + 0x30], eax
mov rax, qword [r14 + 8]
mov qword [rsp + 0x38], rax
mov eax, dword [r14 + 4]
mov dword [rsp + 0x34], eax
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x40], rax
call fcn.140001b81
test al, al
je 0x140078aba
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140003337
mov bl, 1
call fcn.140001a1e
lea r11, [rsp + 0x50]
mov al, bl
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400059a2
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140086804
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rax + 0xb0]
call fcn.140002f95
mov rdi, rax
test rax, rax
je 0x1400868cb
and eax, 3
je 0x14008685c
cmp rax, 1
jne 0x140086866
and rdi, 0xfffffffffffffffe
mov rdi, qword [rdi + 0x20]
add rdi, 0x10
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x14008685c
cmp byte [rax + 0x70], 0
jne 0x1400868cb
mov rcx, rdi
call fcn.14000318e
jmp 0x1400868b9
and rdi, 0xfffffffffffffffd
lea rsi, [rdi + 8]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x20]
mov rcx, rbx
call fcn.140004b51
mov rcx, rsi
call rbx
mov rdi, qword [rdi + 0x40]
mov rax, qword [rdi + 0x50]
add rdi, 0x20
test rax, rax
je 0x14008689d
cmp byte [rax + 0x70], 0
je 0x14008689d
xor edi, edi
jmp 0x1400868a5
mov rcx, rdi
call fcn.14000318e
mov rax, qword [rsi]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call fcn.140004b51
mov rcx, rsi
call rbx
test rdi, rdi
je 0x1400868cb
mov rdx, rdi
mov rcx, rbp
call fcn.140002365
jmp 0x1400868cd
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005add
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x1400894d0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
lea rcx, str.advapi32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140089522
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1400895c9
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400895c9
lea rdx, str.RegisterTraceGuidsW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140002d88
lea rdx, str.UnregisterTraceGuids
mov qword [rdi], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140002d88
lea rdx, str.TraceEvent
mov qword [rdi + 8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140002d88
lea rdx, str.GetTraceLoggerHandle
mov qword [rdi + 0x10], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140002d88
lea rdx, str.GetTraceEnableLevel
mov qword [rdi + 0x18], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140002d88
lea rdx, str.GetTraceEnableFlags
mov qword [rdi + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140002d88
mov qword [rdi + 0x28], rax
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140005b23
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140021184
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 8], 0xfffffffffffffffe
mov r15, rdx
mov rdi, rcx
and dword [rbp - 0x10], 0
mov rcx, rdx
call fcn.140007e69
mov r14, rax
xor ebx, ebx
xor r12d, r12d
mov rcx, rdi
call fcn.140006947
mov dword [rbp - 0x10], 1
test r14d, r14d
je 0x140021349
dec r14d
movsxd rsi, r12d
mov rdx, rsi
mov rcx, r15
call fcn.1400069a1
cmp byte [rax], 0x3d
je 0x1400212a6
mov rdx, rsi
mov rcx, r15
call fcn.1400069a1
mov cl, byte [rax]
call fcn.14000811b
test al, al
je 0x1400212a6
mov rdx, rsi
mov rcx, r15
call fcn.1400069a1
movsxd rcx, ebx
mov al, byte [rax]
mov byte [rbp + rcx + 0x58], al
inc ebx
inc r12d
cmp ebx, 4
jne 0x14002129d
xor ebx, ebx
lea rsi, [rbp + 0x58]
xor r8d, r8d
mov dl, byte [rsi]
lea rcx, [0x140155200]
call fcn.1400081d9
sub al, bl
and al, 0x3f
mov byte [rsi], al
inc ebx
inc rsi
cmp ebx, 4
jl 0x14002122c
mov dl, byte [rbp + 0x59]
mov cl, dl
shr cl, 4
and cl, 3
mov al, byte [rbp + 0x58]
shl al, 2
add cl, al
mov byte [rbp + 0x50], cl
mov cl, byte [rbp + 0x5a]
mov al, cl
shr al, 2
and al, 0xf
shl dl, 4
add al, dl
mov byte [rbp + 0x51], al
shl cl, 6
add cl, byte [rbp + 0x5b]
mov byte [rbp + 0x52], cl
lea rbx, [rbp + 0x50]
mov esi, 3
mov rdx, rbx
mov rcx, rdi
call fcn.140001460
inc rbx
sub rsi, 1
jne 0x140021287
xor ebx, ebx
test r14d, r14d
jne 0x1400211d4
test ebx, ebx
je 0x140021349
cmp ebx, 4
jge 0x1400212cd
movsxd rax, ebx
lea rcx, [rbp + 0x58]
add rcx, rax
mov r8d, 4
sub r8d, ebx
xor edx, edx
call fcn.1400054a7
xor esi, esi
lea r14, [rbp + 0x58]
xor r8d, r8d
mov dl, byte [r14]
lea rcx, [0x140155200]
call fcn.1400081d9
sub al, sil
and al, 0x3f
mov byte [r14], al
inc esi
inc r14
cmp esi, 4
jl 0x1400212d3
mov dl, byte [rbp + 0x59]
mov cl, dl
shr cl, 4
and cl, 3
mov al, byte [rbp + 0x58]
shl al, 2
add cl, al
mov byte [rbp + 0x50], cl
mov cl, byte [rbp + 0x5a]
mov al, cl
shr al, 2
and al, 0xf
shl dl, 4
add al, dl
mov byte [rbp + 0x51], al
shl cl, 6
add cl, byte [rbp + 0x5b]
mov byte [rbp + 0x52], cl
lea eax, [rbx - 1]
test eax, eax
jle 0x140021349
lea rbx, [rbp + 0x50]
mov esi, eax
mov rdx, rbx
mov rcx, rdi
call fcn.140001460
inc rbx
sub rsi, 1
jne 0x140021335
mov rax, rdi
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140005de9
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140080700
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rcx
xor esi, esi
test dword [0x140150328], 0x80000000
je 0x14008073d
mov ecx, dword [0x140156850]
call fcn.140002f95
mov rbx, rax
test rax, rax
jne 0x140080745
call fcn.140009ae3
mov rbx, rax
cmp qword [rbx + 0x40], rsi
jne 0x140080753
mov rcx, rbx
call fcn.140009bab
mov rax, qword [rbx + 0x40]
mov ecx, dword [rax + 0xa0]
cmp rbx, qword [rdi + 0x18]
jne 0x140080770
cmp ecx, dword [rdi + 0xd0]
jne 0x140080770
mov rax, rdi
jmp 0x1400807e6
mov rcx, rbx
call fcn.140002d10
test rax, rax
je 0x140080786
cmp qword [rax + 0xa8], rdi
je 0x1400807e6
mov rdx, rdi
mov rcx, rbx
call fcn.1400020f9
test rax, rax
jne 0x1400807e6
mov ecx, 0xe8
call fcn.140002cca
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400807bb
mov r8b, 1
mov rdx, rdi
mov rcx, rax
call fcn.140001708
mov rsi, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rcx, rbx
call fcn.140002d24
lea rcx, [rbx + 0xd0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call fcn.14000790f
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400060fa
Capabilities:
Terminate process

Disassembly:
jmp 0x140064908
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140006154
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14007ad10
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov bl, dl
mov rdi, rcx
call fcn.140003887
test bl, bl
je 0x14007ad4b
or eax, 0xffffffff
lock xadd dword [rdi + 0x27c], eax
dec eax
and eax, 0x9fffffff
cmp eax, 0x80000000
jne 0x14007ad73
mov rcx, rdi
call fcn.1400011db
jmp 0x14007ad73
mov eax, 1
lock xadd dword [rdi + 0x27c], eax
inc eax
bt eax, 0x1e
jae 0x14007ad73
mov rcx, qword [rdi + 0x260]
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140001a1e

Function at 0x140006226
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140078b80
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 1
mov edi, ecx
lock xadd dword [rbx + 0x268], edi
add edi, ecx
cmp edi, ecx
jne 0x140078be2
mov eax, dword [rbx + 0x274]
test eax, eax
jle 0x140078bdc
mov ecx, dword [0x140156850]
call fcn.140002f95
test rax, rax
je 0x140078bef
cmp byte [rax + 0x88], 0
jne 0x140078bef
mov rcx, rax
call fcn.140003aa8
cmp rax, rbx
jne 0x140078bef
mov rcx, rbx
call fcn.140007905
jmp 0x140078be2
xchg dword [rbx + 0x274], ecx
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.140004110
lea rdx, [0x14014e970]
lea rcx, [rsp + 0x20]
call fcn.140007829
int3
Function at 0x140006299
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14007ff34
mov qword [rsp + 8], rbx
mov r11, rdx
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + rdx]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x14007ff4c
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rcx, edx
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x14007ff97
mov rcx, qword [r11]
cmp qword [rax + 8], rcx
je 0x14007ff99
mov rax, qword [rax]
test rax, rax
jne 0x14007ff89
xor eax, eax
test rax, rax
je 0x14007ffaa
test r8, r8
je 0x14007ffaa
mov rcx, qword [rax + 0x10]
mov qword [r8], rcx
mov rbx, qword [rsp + 8]
ret
Function at 0x1400062fd
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400a3e4c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x14011e3e8]
mov ecx, 4
lea r8, [0x14011e3e0]
lea rdx, str.FlsAlloc
call fcn.1400a3704
mov rbx, rax
test rax, rax
je 0x1400a3e8f
mov rcx, rax
call fcn.140004b51
mov rcx, rdi
call rbx
jmp 0x1400a3e95
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006609
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14001f748
push rbx
sub rsp, 0x20
mov r9d, 0x6c078965
or r8d, 0xffffffff
mov rbx, rcx
call fcn.14000321f
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400069ab
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140083f34
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rdi, rcx
mov rdx, qword [rax + 0x18]
mov ebx, dword [rdx + 0xb0]
mov ecx, ebx
call fcn.140002f95
mov rdx, rdi
mov qword [rdi + 0x38], rax
mov ecx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003936

Function at 0x140006eb5
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400e51ac
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140121c20]
mov ecx, 5
lea r8, [0x140121c18]
lea rdx, str.FlsGetValue
call fcn.1400e49dc
mov rdi, rax
test rax, rax
je 0x1400e51ee
mov rcx, rax
call qword [section..00cfg]
mov ecx, ebx
call rdi
jmp 0x1400e51f6
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006f2d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140060ff0
jmp fcn.14000282e

Function at 0x14000717b
Capabilities:
Create thread

Disassembly:
jmp 0x1400d4b5c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
test r8, r8
jne 0x1400d4b8c
call fcn.140005493
mov dword [rax], 0x16
call fcn.140007cde
xor eax, eax
jmp 0x1400d4c0c
mov rdx, r9
mov rcx, r8
call fcn.1400d48d4
mov rbx, rax
test rax, rax
je 0x1400d4bdc
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400d4630]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1400d4c1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006ff5
xor edi, edi
test rbx, rbx
je 0x1400d4c09
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400d4bf2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400d4c01
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140008e3b
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400d4c2c
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
xor ebx, ebx
jmp 0x1400d4bde
Function at 0x1400074f5
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400e5218
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140121c30]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x140121c28]
call fcn.1400e49dc
mov rsi, rax
test rax, rax
je 0x1400e5265
mov rcx, rax
call qword [section..00cfg]
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1400e5270
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400077f2
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400e50d4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140121c00]
mov ecx, 3
lea r8, [0x140121bf8]
lea rdx, str.FlsAlloc
call fcn.1400e49dc
mov rbx, rax
test rax, rax
je 0x1400e5118
mov rcx, rax
call qword [section..00cfg]
mov rcx, rdi
call rbx
jmp 0x1400e511e
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000790f
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140080108
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
mov r14, r8
xor ecx, ecx
mov rdi, rdx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rcx + rdi]
movabs rdx, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rdx
cmp rcx, 8
jb 0x140080132
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rsi, edx
mov rcx, qword [rax + rsi*8]
test rcx, rcx
je 0x14008017c
mov rax, qword [rdi]
cmp qword [rcx + 8], rax
je 0x14008017e
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14008016e
xor ecx, ecx
test rcx, rcx
jne 0x1400801cc
mov ecx, 0x18
call fcn.140002cca
mov qword [rsp + 0x30], rax
mov r8, rax
test rax, rax
je 0x1400801ae
and qword [rax], 0
mov rax, qword [rdi]
mov qword [r8 + 8], rax
mov rax, qword [r14]
mov qword [r8 + 0x10], rax
jmp 0x1400801b1
xor r8d, r8d
mov rcx, qword [rbx + 8]
mov rax, r8
mov rdx, qword [rcx + rsi*8]
mov qword [r8], rdx
mov rcx, qword [rbx + 8]
mov qword [rcx + rsi*8], r8
inc dword [rbx + 4]
jmp 0x1400801ce
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140007919
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140064dc8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov qword [rcx + 8], 0
lea rsi, [rcx + 0x18]
and qword [rsi], 0
mov edi, edx
mov dword [rcx + 0x10], 1
mov rbx, rcx
mov dword [rcx + 0x20], 0
mov dword [rcx + 0x24], 0
test dword [0x140150328], 0x80000000
je 0x140064e1d
mov ecx, dword [0x140156850]
call fcn.140002f95
test rax, rax
jne 0x140064e22
call fcn.140009ae3
mov qword [rbx], rax
cmp edi, 0xffffffff
je 0x140064e81
call fcn.1400065c3
cmp eax, 3
jl 0x140064e52
xor r9d, r9d
lea rdx, [0x14000596b]
mov r8, rbx
mov ecx, edi
call fcn.1400027d9
mov qword [rsi], rax
test rax, rax
jne 0x140064e81
jmp 0x140064e96
call fcn.1400042c3
mov dword [rsp + 0x30], 0x20
lea r8, [0x140004cb4]
and dword [rsp + 0x28], 0
mov rdx, rax
mov r9, rbx
mov dword [rsp + 0x20], edi
mov rcx, rsi
call fcn.1400089e0
test eax, eax
je 0x140064eb2
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x40]
call fcn.140004ab6
lea rdx, [0x14014e438]
lea rcx, [rsp + 0x40]
call fcn.140007829
int3
lea rcx, [rsp + 0x58]
call fcn.140004ab6
lea rdx, [0x14014e438]
lea rcx, [rsp + 0x58]
call fcn.140007829
int3

Function at 0x140007955
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400951c0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0xe0]
mov rdi, rcx
mov rcx, rbx
call fcn.140004e4e
call fcn.14000860c
mov dword [rdi + 0xa0], eax
mov rcx, rbx
xor eax, eax
mov dword [rdi], eax
mov dword [rdi + 4], eax
mov dword [rdi + 0xb0], eax
mov dword [rdi + 0xb4], eax
mov dword [rdi + 0xcc], eax
mov byte [rdi + 0xc8], al
mov dword [rdi + 0xbc], eax
mov dword [rdi + 0x90], eax
mov qword [rdi + 0xa8], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400058ee
Function at 0x140007e5a
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14006b8a0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test dword [0x140150328], 0x80000000
je 0x14006b8c9
mov ecx, dword [0x140156850]
call fcn.140002f95
mov rdi, rax
test rax, rax
jne 0x14006b8d1
call fcn.140009ae3
mov rdi, rax
mov rax, qword [rdi]
mov rbx, qword [rax + 0x30]
mov rcx, rbx
call fcn.140004b51
mov rcx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax

Function at 0x140008080
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400ce170
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1400cddd8

Function at 0x1400081a2
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140069860
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140069874
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140004381
lea rdx, [0x14014e7f0]
lea rcx, [rsp + 0x20]
call fcn.140007829
int3

Function at 0x1400082fb
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400787e4
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x140156850]
call fcn.140002f95
test rax, rax
je 0x140078821
cmp byte [rax + 0x88], 0
jne 0x140078821
mov rcx, rax
call fcn.140003aa8
cmp rax, rdi
jne 0x140078821
xor sil, sil
jmp 0x14007882d
mov esi, 1
lock add dword [rdi + 0x270], esi
xor edx, edx
mov rcx, rdi
call fcn.140002126
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa8]
mov rcx, rbx
call fcn.140004b51
mov rcx, rdi
call rbx
mov eax, dword [rdi + 0x27c]
mov ecx, eax
mov r8d, eax
btr ecx, 0x1e
bts ecx, 0x1d
lock cmpxchg dword [rdi + 0x27c], ecx
cmp eax, r8d
jne 0x140078854
and eax, 0x1fffffff
jle 0x140078887
mov rcx, qword [rdi + 0x260]
xor r8d, r8d
mov edx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa0]
mov rcx, rbx
call fcn.140004b51
mov rcx, rdi
call rbx
test sil, sil
je 0x1400788bb
or eax, 0xffffffff
lock xadd dword [rdi + 0x270], eax
cmp eax, 1
jne 0x1400788bb
mov rcx, rdi
call fcn.1400033fa
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400084b8
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140075f98
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
mov ecx, dword [0x140156850]
call fcn.140002f95
mov rdi, rax
test rax, rax
je 0x140075fe9
cmp qword [rax + 0x38], rbx
jne 0x140075fe9
cmp byte [rax + 0x88], sil
jne 0x140075fe9
mov rcx, rax
call fcn.140003080
mov rax, qword [rdi + 0xf8]
mov rcx, rdi
mov rsi, qword [rax + 0x78]
call fcn.140005132
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret