joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b138
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov rdi, rdx
mov rbp, qword [rdx + 0x10]
mov r15, rcx
mov r8, rdx
jb 0x14001b16b
mov r8, qword [rdx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test rbp, rbp
je 0x14001b19a
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, r9
cmp rcx, rbp
jb 0x14001b17c
mov r12, qword [r15 + 0x30]
mov rax, qword [r15 + 0x18]
and r12, rdx
mov rsi, qword [r15 + 8]
add r12, r12
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rsi
jne 0x14001b1bb
mov rax, rsi
jmp 0x14001b1c3
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14001b237
cmp qword [rdi + 0x18], 0x10
lea r14, [rbx + 0x10]
mov rdx, rdi
jb 0x14001b1d9
mov rdx, qword [rdi]
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
mov r13, qword [r14 + 0x10]
jb 0x14001b1ea
mov rcx, qword [r14]
cmp r13, rbp
jne 0x14001b1fb
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001b204
mov rbx, qword [rbx]
mov rax, qword [r15 + 0x18]
jmp 0x14001b1b0
cmp qword [r14 + 0x18], 0x10
jb 0x14001b20e
mov r14, qword [r14]
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x14001b21b
mov rcx, qword [rdi]
cmp rbp, r13
jne 0x14001b22f
mov r8, rbp
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001b232
mov rbx, rsi
mov rax, rbx
jmp 0x14001b23d
mov rbx, rsi
mov rax, rsi
cmp rax, rsi
jne 0x14001b2b6
mov rbx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.14001b5d0
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14001b28b
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140013bc0
mov rbx, qword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov rbp, qword [r11 + 0x40]
lea rax, [rbx + 0x30]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140020454
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140060010]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor r15d, r15d
mov ecx, dword [0x140061660]
cmp byte [0x140061664], r15b
je 0x1400204ab
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400204b1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400204d0
mov edx, 8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
inc qword [rdx + rcx]
jmp 0x140020633
mov ecx, dword [0x140061670]
cmp byte [0x140061674], r15b
je 0x1400204e7
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400204ed
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov r12d, 7
test rax, rax
jne 0x140020580
lea ecx, [rax + 0x28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14002065b
mov qword [rbp - 0x51], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
lea ecx, [r12 + 9]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x140020542
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
int3
mov qword [rbx], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
movdqu xmmword [rax], xmm0
mov rax, qword [rbx]
mov qword [rax], rbx
mov rdx, rbx
mov ecx, dword [0x140061670]
cmp byte [0x140061674], r15b
je 0x140020571
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140020577
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140020580
mov rcx, r12
int 0x29
lea rdx, [0x14002f37c]
test rsi, rsi
cmovne rdx, rsi
lea rcx, [rbp + 7]
call fcn.140002b0c
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1400205a8
lock inc dword [rdx + 8]
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], rdx
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x19], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r12
mov word [rax], r15w
movsd xmm0, qword [r14]
movsd qword [rbp - 9], xmm0
mov eax, dword [r14 + 8]
mov dword [rbp - 1], eax
lea rdx, [rbp - 0x39]
mov rcx, rbx
call fcn.140020664
lea rcx, [rbp - 0x39]
call fcn.1400207b0
mov rax, qword [rbp + 0x1f]
cmp rax, 8
jb 0x140020633
mov rcx, qword [rbp + 7]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x14002062d
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14002062d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14002a720
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14002a17c
int3
Function at 0x140020d88
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x140061674], 0
mov ecx, dword [0x140061670]
je 0x140020da5
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140020dab
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140020deb
mov rcx, rax
call fcn.140020fe4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [0x140061670]
xor edx, edx
cmp byte [0x140061674], dl
je 0x140020ddc
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140020de2
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140020deb
lea ecx, [rax + 7]
int 0x29
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax]
and qword [rdx + rcx], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140021180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r14
mov rdi, rcx
mov ecx, dword [0x140061668]
cmp byte [0x14006166c], 0
je 0x1400211ba
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400211c0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002124c
mov ecx, dword [0x140061658]
cmp byte [0x14006165c], al
je 0x1400211df
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400211e5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140021261
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov rax, qword [rdi + 8]
lea r8, [rbp - 0x18]
mov rdx, qword [rax]
mov rcx, qword [rdi]
call fcn.140020454
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14002124c
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
add eax, edi
jne 0x14002124c
mov rbx, qword [rbp - 0x10]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14002adfe.0]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x14002124c
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002adfe.0]
nop
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
lea rax, [0x140061658]
mov qword [rbp - 0x28], rax
and dword [rbp - 0x20], 0
mov r14d, 7
lea ebx, [r14 - 6]
mov ecx, dword [0x140061658]
mov edx, ebx
cmp byte [0x14006165c], 0
je 0x140021293
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140021299
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400212a2
mov rcx, r14
int 0x29
lock xadd dword [rbp - 0x20], ebx
mov rcx, qword [rdi + 0x10]
add rcx, 8
mov r8, qword [rdi + 8]
mov r8, qword [r8]
mov rdx, qword [rdi]
call fcn.14001cf50
mov rcx, qword [rdi + 0x10]
call fcn.1400208c0
or edi, 0xffffffff
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x14002124c
mov eax, edi
lock xadd dword [rbp - 0x20], eax
mov rcx, qword [rbp - 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x1400212f1
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x1400212f7
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400212ca
mov rcx, r14
int 0x29
jmp 0x1400212ca
Function at 0x140021314
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x140061668]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x140061668]
mov edx, edi
cmp byte [0x14006166c], 0
je 0x14002135a
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140021360
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021369
lea ecx, [rax + 7]
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
mov rdx, qword [rsi + 8]
call fcn.14001d810
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400213b8
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x1400213a7
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x1400213ad
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021380
lea ecx, [rax + 7]
int 0x29
jmp 0x140021380
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400213c4
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x140061668]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x140061668]
mov edx, edi
cmp byte [0x14006166c], 0
je 0x14002140a
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140021410
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021419
lea ecx, [rax + 7]
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
mov rdx, qword [rsi + 8]
call fcn.14001d4b0
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140021468
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x140021457
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x14002145d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021430
lea ecx, [rax + 7]
int 0x29
jmp 0x140021430
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140021474
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x30
and dword [rsp + 0x28], 0
lea rax, [0x140061668]
cmp byte [0x14006166c], 0
mov ebp, 7
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov ecx, dword [0x140061668]
lea ebx, [rbp - 6]
mov edx, ebx
je 0x1400214b8
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x1400214be
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400214c7
mov rcx, rbp
int 0x29
lock xadd dword [rsp + 0x28], ebx
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
add rcx, 8
call fcn.14001d5b0
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140021518
or eax, 0xffffffff
lock xadd dword [rsp + 0x28], eax
mov rdx, qword [rsp + 0x20]
cmp byte [rdx + 4], 0
mov ecx, dword [rdx]
je 0x140021505
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x14002150d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400214dd
mov rcx, rbp
int 0x29
jmp 0x1400214dd
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140021528
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x140061668]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x140061668]
mov edx, edi
cmp byte [0x14006166c], 0
je 0x14002156e
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140021574
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14002157d
lea ecx, [rax + 7]
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
call fcn.14001d900
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400215c8
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x1400215b7
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x1400215bd
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021590
lea ecx, [rax + 7]
int 0x29
jmp 0x140021590
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400215d4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x30
and dword [rsp + 0x28], 0
lea rax, [0x140061668]
cmp byte [0x14006166c], 0
mov ebp, 7
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov ecx, dword [0x140061668]
lea ebx, [rbp - 6]
mov edx, ebx
je 0x140021618
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x14002161e
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021627
mov rcx, rbp
int 0x29
lock xadd dword [rsp + 0x28], ebx
mov rcx, qword [rdi]
add rcx, 8
call fcn.14001d9a0
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140021674
or eax, 0xffffffff
lock xadd dword [rsp + 0x28], eax
mov rdx, qword [rsp + 0x20]
cmp byte [rdx + 4], 0
mov ecx, dword [rdx]
je 0x140021661
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140021669
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021639
mov rcx, rbp
int 0x29
jmp 0x140021639
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140022b0c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r14, rcx
xor ebx, ebx
mov ecx, dword [0x140061668]
cmp byte [0x14006166c], bl
je 0x140022b40
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140022b46
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140022c16
mov ecx, dword [0x140061658]
cmp byte [0x14006165c], bl
je 0x140022b65
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140022b6b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140022b7a
mov ebx, 1
jmp 0x140022c16
lea rax, [0x140061668]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov esi, 1
mov ecx, dword [0x140061668]
mov edx, esi
cmp byte [0x14006166c], bl
je 0x140022ba7
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140022bad
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140022bb6
lea ecx, [rax + 7]
int 0x29
lock xadd dword [rsp + 0x30], esi
mov rdx, qword [r14]
mov rcx, qword [rdx]
add rcx, 8
mov rax, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
mov r8b, byte [rax]
mov edx, dword [rdx]
call fcn.14001d260
mov sil, al
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140022c13
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], bl
mov ecx, dword [rcx]
je 0x140022c02
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140022c08
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140022bdb
lea ecx, [rax + 7]
int 0x29
jmp 0x140022bdb
mov bl, sil
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret
Function at 0x140022c2c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r14, rcx
xor ebx, ebx
mov ecx, dword [0x140061668]
cmp byte [0x14006166c], bl
je 0x140022c60
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140022c66
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140022d2d
mov ecx, dword [0x140061658]
cmp byte [0x14006165c], bl
je 0x140022c85
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140022c8b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140022c9a
mov ebx, 1
jmp 0x140022d2d
lea rax, [0x140061668]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov esi, 1
mov ecx, dword [0x140061668]
mov edx, esi
cmp byte [0x14006166c], bl
je 0x140022cc7
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140022ccd
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140022cd6
lea ecx, [rax + 7]
int 0x29
lock xadd dword [rsp + 0x30], esi
mov rdx, qword [r14]
mov rcx, qword [rdx]
add rcx, 8
mov rdx, qword [rdx + 8]
call fcn.14001d330
mov sil, al
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140022d2a
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], bl
mov ecx, dword [rcx]
je 0x140022d19
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140022d1f
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140022cf2
lea ecx, [rax + 7]
int 0x29
jmp 0x140022cf2
mov bl, sil
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret
Function at 0x140022d40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r14, rcx
xor ebx, ebx
mov ecx, dword [0x140061668]
cmp byte [0x14006166c], bl
je 0x140022d74
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140022d7a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140022e41
mov ecx, dword [0x140061658]
cmp byte [0x14006165c], bl
je 0x140022d99
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140022d9f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140022dae
mov ebx, 1
jmp 0x140022e41
lea rax, [0x140061668]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov esi, 1
mov ecx, dword [0x140061668]
mov edx, esi
cmp byte [0x14006166c], bl
je 0x140022ddb
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140022de1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140022dea
lea ecx, [rax + 7]
int 0x29
lock xadd dword [rsp + 0x30], esi
mov rdx, qword [r14]
mov rcx, qword [rdx]
add rcx, 8
mov rdx, qword [rdx + 8]
call fcn.14001d3f0
mov sil, al
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140022e3e
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], bl
mov ecx, dword [rcx]
je 0x140022e2d
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140022e33
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140022e06
lea ecx, [rax + 7]
int 0x29
jmp 0x140022e06
mov bl, sil
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret

Function at 0x14002639c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, r8
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x1400263b4
mov r8, qword [rbx + 0x30]
mov r10, qword [rbx + 0x18]
and r8, r9
add r8, r8
mov r9, qword [r10 + r8*8]
mov rcx, r9
cmp r9, qword [rbx + 8]
jne 0x1400263f4
mov rax, qword [rbx + 8]
jmp 0x1400263fc
mov rax, qword [r10 + r8*8 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14002640f
mov rax, qword [r11]
cmp qword [rcx + 0x10], rax
je 0x140026413
mov rcx, qword [rcx]
jmp 0x1400263e8
mov rcx, qword [rbx + 8]
mov qword [rdx], rcx
mov rax, rdx
mov rbx, qword [rsp + 8]
ret
Function at 0x140026420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + r9]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r8
cmp r8, 8
jb 0x14002644f
mov r8, qword [rsi + 0x30]
and r8, rcx
add r8, r8
mov r11, qword [rsi + 0x18]
mov rbx, qword [r11 + r8*8]
mov rdx, qword [rsi + 8]
mov r10, rbx
cmp qword [r11 + r8*8], rdx
jne 0x140026492
mov rax, rdx
jmp 0x14002649a
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400264d8
mov rcx, qword [r9]
cmp qword [rbx + 0x10], rcx
je 0x1400264ad
mov rbx, qword [rbx]
jmp 0x140026484
mov rdi, rbx
cmp qword [r11 + r8*8], rdx
jne 0x1400264bb
mov rax, rdx
jmp 0x1400264c3
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400264d3
cmp rcx, qword [rbx + 0x10]
jne 0x1400264d3
mov rbx, qword [rbx]
jmp 0x1400264b0
cmp r10, rbx
jne 0x1400264de
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
xor ebp, ebp
cmp rdi, rbx
je 0x1400264f6
inc rbp
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, rbx
jne 0x1400264e8
mov rcx, qword [rdx]
cmp rdi, rcx
jne 0x14002654d
cmp rbx, rdx
jne 0x14002654d
mov qword [rdx], rdx
mov rax, qword [rsi + 8]
mov qword [rax + 8], rax
and qword [rsi + 0x10], 0
cmp rcx, qword [rsi + 8]
je 0x14002652b
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
cmp rbx, qword [rsi + 8]
jne 0x140026519
mov edx, 8
mov rcx, rsi
call fcn.1400134a0
jmp 0x140026552
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002656c
cmp rdi, rbx
jne 0x14002653a
mov rax, rbp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14002656c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x140026589
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400265e1
cmp qword [rcx + rdx*8], r8
jne 0x1400265d6
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400265da
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400265ee
cmp qword [rcx + rdx*8], r8
jne 0x1400265ee
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret