joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800563b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x180082080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xd
mov byte [rsp + 0x30], 0x46
mov byte [rsp + 0x31], 0x3d
mov byte [rsp + 0x32], 0x41
mov byte [rsp + 0x33], 0xc5
mov byte [rsp + 0x34], 0x3a
mov byte [rsp + 0x35], 0x15
mov byte [rsp + 0x36], 0x3c
mov byte [rsp + 0x37], 0xf9
mov byte [rsp + 0x38], 0xd
mov byte [rsp + 0x39], 0x20
mov byte [rsp + 0x3a], 0x49
mov byte [rsp + 0x3b], 0xcc
mov byte [rsp + 0x3c], 0x55
mov eax, 0xc84
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1800564af
mov eax, 0xc84
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x180510820]
mov rcx, qword gs:[0x58]
mov edx, 0xc84
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x9a8
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180007d90
lea rcx, [0x180065b90]
call fcn.180017a80
nop
mov eax, 0x9a8
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180017940
add rsp, 0x58
ret
Function at 0x180056bd0
Capabilities:
Open clipboard

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180056bed
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x28
ret
Function at 0x1800576a0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x58], rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1800576f4
mov eax, dword [rsp + 0x30]
jmp 0x180057852
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x180069780]
mov r8d, 1
xor edx, edx
lea rcx, [0x180069790]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x18005772e
mov eax, dword [rsp + 0x30]
jmp 0x180057852
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
lea r8, [rsp + 0x48]
lea rdx, [0x180069760]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x18005775d
mov eax, dword [rsp + 0x30]
jmp 0x180057852
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
lea r8, [rsp + 0x50]
lea rdx, [0x180069770]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x18005778c
mov eax, dword [rsp + 0x30]
jmp 0x180057852
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x60]
call qword [rax + 0x68]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1800577cf
mov eax, dword [rsp + 0x30]
jmp 0x180057852
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x38]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x180057812
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
lea r8, [rsp + 0x34]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x48]
nop
jmp 0x180057818
mov eax, dword [rsp + 0x30]
jmp 0x180057852
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rsp + 0x34]
add rsp, 0x78
ret
Function at 0x180057ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x180082080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], 0x18
mov byte [rsp + 0x30], 0x4b
mov byte [rsp + 0x31], 0x43
mov byte [rsp + 0x32], 0x7d
mov byte [rsp + 0x33], 0x76
mov byte [rsp + 0x34], 0x5b
mov byte [rsp + 0x35], 0x12
mov byte [rsp + 0x36], 0x37
mov byte [rsp + 0x37], 0x36
mov byte [rsp + 0x38], 0x39
mov byte [rsp + 0x39], 0x26
mov byte [rsp + 0x3a], 0x6e
mov byte [rsp + 0x3b], 0x59
mov byte [rsp + 0x3c], 0x42
mov byte [rsp + 0x3d], 0x13
mov byte [rsp + 0x3e], 0x72
mov byte [rsp + 0x3f], 0x14
mov byte [rsp + 0x40], 0x49
mov byte [rsp + 0x41], 0x22
mov byte [rsp + 0x42], 0x45
mov byte [rsp + 0x43], 0x66
mov byte [rsp + 0x44], 0x4a
mov byte [rsp + 0x45], 4
mov byte [rsp + 0x46], 0x37
mov byte [rsp + 0x47], 0x7b
mov eax, 0x4c0
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x180057e16
mov eax, 0x4c0
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x180510820]
mov rcx, qword gs:[0x58]
mov edx, 0x4c0
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xf70
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180009430
lea rcx, [0x180065aa0]
call fcn.180017a80
nop
mov eax, 0xf70
mov eax, eax
mov ecx, dword [0x180510820]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180017940
add rsp, 0x58
ret

Function at 0x180058570
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
add rsp, 0x38
ret
Function at 0x18005a030
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rsp + 0xc8], 0
je 0x18005a130
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x30]
call fcn.18000a330
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x40]
call fcn.18000a330
mov qword [rsp + 0x50], rax
mov r8d, 0x8000000
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.18005a380
nop
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov eax, dword [rsp + 0xc0]
mov edx, eax
mov rcx, qword [rsp + 0xb8]
call fcn.180003540
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0xa8
ret

Function at 0x18005ae60
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.18005c1f0
mov dword [rsp + 0x70], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.18005c1f0
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18005af37
cmp dword [rsp + 0x100], 0
je 0x18005af10
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rsp + 0x50]
add rsp, 0xe8
ret
Function at 0x18005afa0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x180082080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x70]
call fcn.18000a440
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x18005b0c5
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
je 0x18005b0b9
mov eax, dword [rsp + 0x40]
inc eax
mov eax, eax
mov ecx, eax
call fcn.1800179a4
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005b0a4
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x58], eax
jne 0x18005b0a4
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov byte [rcx + rax], 0
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.18000a190
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.180017960
nop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.18000a270
mov eax, dword [rsp + 0x44]
or eax, 1
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x70]
call fcn.18000a1c0
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180017940
add rsp, 0xa8
ret
Function at 0x1400012d7
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1402c5f90]
mov dword [rax], 1
mov rax, qword [0x1402c5fa0]
mov dword [rax], 1
mov rax, qword [0x1402c5fb0]
mov dword [rax], 1
mov rax, qword [0x1402c5f00]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140001328
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001354
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000137a
cmp eax, 0x20b
je 0x1400013a1
jmp 0x1400013d0
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000138d
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x1400013bc
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000a0d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1402a8580]
or eax, dword [0x1402a8584]
add eax, 0x1d420243
or eax, 0x7d113611
mov ecx, 0xd673c033
xor ecx, 0x94281fd7
add eax, ecx
cmp eax, 0x4ee80bee
jae 0x14000a294
mov eax, dword [0x1402a8588]
mov ecx, dword [0x1402a858c]
and eax, ecx
xor eax, 0xd70de4fc
mov ecx, 0x9c42d283
imul rax, rcx
shr rax, 0x3e
add eax, 0xb1eba31e
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.1402a7dd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000eaf8
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov ecx, 0x3e88
sub rsp, 0x20
call fcn.140009000
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x88eafc94
je 0x14000a114
mov al, byte [rbp - 0x19]
test al, 1
jne 0x14000a1af
jmp 0x14000a28f
mov r9, qword [rbp - 8]
mov r10, qword [rbp - 0x40]
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x28]
mov qword [r9], rdx
mov qword [r9 + 0x18], rcx
mov qword [r9 + 0x10], rax
mov dword [r10], 0
xor eax, eax
mov ecx, eax
mov edx, 0x1ff000
lea r8, [0x14000a07e]
xor eax, eax
mov rax, qword [0x1402c5ce8]
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], r10
call qword [rax]
mov rcx, qword [rbp - 8]
add rsp, 0x30
mov qword [rcx + 8], rax
cmp rax, 1
jge 0x14000a28f
mov ecx, 0x40
mov edx, 8
sub rsp, 0x20
call fcn.140025b10
add rsp, 0x20
mov rcx, rax
mov rax, qword [0x1402c5e50]
mov qword [rcx], rax
lea rax, [0x1402ba380]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1402ba3b8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1402ba3c0]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x1402ba380]
lea r8, [0x1402ba397]
lea r9, [0x1402ba3a4]
sub rsp, 0x30
mov qword [rsp + 0x20], 0xc80c5ae
call fcn.140025a43
add rsp, 0x30
mov rsp, rbp
pop rbp
ret
push rcx
mov byte [rsi + rdx - 0x17], dl
ja 0x14000a299
invalid
Function at 0x14000ee80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1402a87a8]
xor eax, 0x67644054
xor edx, edx
div dword [0x1402a87ac]
mov ecx, 0x6891a2b1
xor edx, edx
div ecx
mov edx, 0x3b45d7f7
xor edx, 0x1a6d38a8
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, 0x2128ef5f
add eax, ecx
mov ecx, 0xafd38469
xor ecx, 0x502c7b96
mov edx, eax
xor edx, ecx
and edx, 0xc969259b
mov r8d, 0xffffffff
xor r8d, 0xc969259b
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc969259b
or eax, 0xc969259b
imul eax, edx
add eax, ecx
cmp eax, 0xd23d4d42
jae 0x14000efde
mov eax, dword [0x1402a87b0]
or eax, dword [0x1402a87b4]
mov ecx, 0xffffffff
xor ecx, 0xb04bd8a9
add eax, ecx
add eax, 1
add eax, 0xe295ae8f
xor eax, 0xec4d516e
mov dword [rsp + 0x34], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0x4ecdaca34e2ccb32
movabs rax, 0x4ecdaca34e2ccb72
xor rcx, rax
movabs rdx, 0xe45d495aabc23c47
movabs rax, 0xe45d495aabc23c4f
xor rdx, rax
call fcn.140025b10
mov rcx, rax
mov rax, qword [0x1402c5df8]
mov qword [rcx], rax
lea rax, [0x1402baedf]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x1402baeb0]
mov qword [rcx + 0x20], rax
movabs rax, 0xb033a9b8d525af40
movabs rdx, 0xb033a9b8a2086436
xor rax, rdx
lea rdx, [0x1402baedf]
lea r8, [0x1402baecc]
lea r9, [0x1402baed5]
mov qword [rsp + 0x20], rax
call fcn.140025a43
mov eax, dword [rsp + 0x34]
cmp eax, 0xde0cce5c
jae 0x14000efde
add rsp, 0x38
ret
invalid
Function at 0x140014980
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.140013e80

Function at 0x1400149ad
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.140013e80
Function at 0x14001614d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140025b10
mov rcx, rax
mov rax, qword [0x1402c5d90]
mov qword [rcx], rax
lea rax, [0x1402baec0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x1402baeb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x772dcb76
lea rdx, [0x1402baec0]
lea r8, [0x1402baecc]
lea r9, [0x1402baed5]
call fcn.140025a43
nop
add rsp, 0x28
ret
Function at 0x140018200
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1402a8aa8]
xor edx, edx
div dword [0x1402a8aac]
add eax, 0x5b9daf6d
mov edx, eax
xor edx, 0xffffffff
and edx, 0x9bea1dc3
mov r8d, 0xffffffff
xor r8d, 0x9bea1dc3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x9bea1dc3
or eax, 0x9bea1dc3
imul eax, edx
add eax, ecx
mov ecx, 0x2bc3ef49
xor ecx, 0x8b170611
add eax, ecx
mov ecx, 0x9d0a52f5
xor ecx, 0x996c0fde
cmp eax, ecx
jbe 0x140018312
mov eax, dword [0x1402a8ab0]
mov ecx, dword [0x1402a8ab4]
xor ecx, 0xed570169
sub eax, ecx
mov ecx, 0x4d3b2872
xor ecx, 0xbfcba698
add eax, ecx
mov edx, 0xffffffff
xor edx, 0xd2921c78
mov ecx, eax
and ecx, edx
mov r8d, 0xb39176ec
xor r8d, 0x61036a94
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0x9da16c39
xor ecx, 0xffffffff
or eax, 0x9da16c39
and eax, ecx
mov dword [rsp + 0x2c], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0x68
call fcn.1400180e0
mov rcx, rax
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], rcx
cmp eax, 0xd6b224f9
jae 0x140018273
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
sti
invalid

Function at 0x14001831b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
add rsp, 0x38
jmp fcn.1400180e0
Function at 0x140018352
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x50], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx + 8]
imul rax, rcx, 3
mov qword [rsp + 0x60], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x1402ba650]
mulsd xmm0, xmm1
movsd qword [rsp + 0x68], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x70], xmm1
ucomisd xmm0, xmm1
jne 0x1400183ab
jp 0x1400183ab
jmp 0x1400183fa
movsd xmm1, qword [rsp + 0x68]
movsd xmm0, qword [rsp + 0x70]
subsd xmm0, xmm1
call fcn.1402a7e80
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rsp + 0x48], xmm1
call fcn.1402a7e80
movsd xmm1, qword [rsp + 0x48]
movsd xmm2, qword [0x1402ba658]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x1400183fa
call fcn.14000ee80
jmp 0x140018501
mov rax, qword [rsp + 0x60]
mov ecx, 2
cqo
idiv rcx
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax], rcx
mov rax, rcx
shl rax, 4
mov qword [rsp + 0x30], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x1402ba660]
mulsd xmm0, xmm1
movsd qword [rsp + 0x38], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x40], xmm1
ucomisd xmm0, xmm1
jne 0x140018457
jp 0x140018457
jmp 0x1400184a6
movsd xmm1, qword [rsp + 0x38]
movsd xmm0, qword [rsp + 0x40]
subsd xmm0, xmm1
call fcn.1402a7e80
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x38]
movsd qword [rsp + 0x28], xmm1
call fcn.1402a7e80
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x1402ba658]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x1400184a6
call fcn.14000ee80
jmp 0x140018501
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x1400184c5
mov rcx, r8
mov rdx, r8
call fcn.140018506
jmp 0x140018501
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.1400180e0
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
add rsp, 0x78
ret

Function at 0x140018506
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140025b10
mov rcx, rax
mov rax, qword [0x1402c5d90]
mov qword [rcx], rax
lea rax, [0x1402baec0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x1402baeb0]
mov qword [rcx + 0x20], rax
movabs rdx, 0xaedb7ec26adb418a
movabs rax, 0xaedb7ec21df68afc
xor rdx, rax
mov rax, rsp
mov qword [rax + 0x20], rdx
lea rdx, [0x1402baec0]
lea r8, [0x1402baecc]
lea r9, [0x1402baed5]
call fcn.140025a43
nop
add rsp, 0x28
ret
Function at 0x140019ce5
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x80]
add rax, 0x60
mov qword [rsp + 0x88], rax
Function at 0x14001a7c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402a8b68]
mov r8d, dword [0x1402a8b6c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x40e8a813
xor ecx, 0x7f25cd8e
mov edx, 0xd6db6f0
xor edx, 0xf292490f
xor ecx, edx
add eax, ecx
add eax, 1
and eax, 0x444ce1cf
xor eax, 0x91f56171
cmp eax, 0xd5156397
je 0x14001a8b5
mov ecx, dword [0x1402a8b70]
xor ecx, 0xf8770f7f
imul ecx, dword [0x1402a8b74]
mov eax, ecx
and eax, 0x9d83b634
xor ecx, 0x9d83b634
or eax, ecx
mov ecx, 0xec6511c7
xor ecx, 0x63d658cf
sub eax, ecx
sub eax, 0xfec31a82
add eax, 0x8fb34908
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x7117d174
and ecx, 0x7117d174
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov dword [rsp + 0x2c], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov eax, dword [rsp + 0x2c]
cmp eax, 0xb619a6dc
je 0x14001a8b5
add rsp, 0x38
ret
jmp 0x14001a8be
nop