joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005904
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov r12d, r8d
mov r14, rdx
mov rsi, rcx
and dword [rsp + 0x20], 0
call fcn.140002cfc
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0xc4
lea rcx, [rsp + 0x50]
call fcn.1400b1300
nop
lea rcx, [rsp + 0x50]
call fcn.140005b3c
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140002c74
nop
lea rcx, [rsp + 0x50]
call fcn.140013338
xor ebx, ebx
test r12d, r12d
je 0x140005b09
xor ecx, ecx
lea edi, [rbx + 3]
jmp 0x140005990
mov r14, qword [rbp + 0x78]
dec r12d
mov al, byte [r14]
mov byte [rbp + rcx + 0x80], al
inc ebx
inc rcx
inc r14
mov qword [rbp + 0x78], r14
mov r13b, byte [rbp + 0x82]
mov r14b, byte [rbp + 0x81]
mov r15b, byte [rbp + 0x80]
cmp rcx, rdi
jne 0x140005a33
mov al, r15b
shr al, 2
mov byte [rbp + 0x88], al
mov cl, r15b
and cl, dil
shl cl, 4
mov al, r14b
shr al, 4
add cl, al
mov byte [rbp + 0x89], cl
mov cl, r14b
and cl, 0xf
shl cl, 2
mov al, r13b
shr al, 6
add cl, al
mov byte [rbp + 0x8a], cl
mov al, r13b
and al, 0x3f
mov byte [rbp + 0x8b], al
xor ebx, ebx
movzx edx, byte [rbp + rbx + 0x88]
lea rcx, [rsp + 0x30]
call fcn.14005ee24
mov dl, byte [rax]
mov rcx, rsi
call fcn.140005b2c
inc rbx
cmp rbx, 4
jl 0x140005a0a
xor ebx, ebx
xor ecx, ecx
test r12d, r12d
jne 0x14000598c
test ebx, ebx
je 0x140005b09
cmp ebx, edi
jge 0x140005a78
mov eax, edi
sub eax, ebx
movsxd r8, eax
movsxd rax, ebx
lea rcx, [rbp + 0x80]
add rcx, rax
xor edx, edx
call fcn.1400b1300
mov r13b, byte [rbp + 0x82]
mov r14b, byte [rbp + 0x81]
mov r15b, byte [rbp + 0x80]
mov al, r15b
shr al, 2
mov byte [rbp + 0x88], al
and r15b, dil
shl r15b, 4
mov al, r14b
shr al, 4
add r15b, al
mov byte [rbp + 0x89], r15b
and r14b, 0xf
shl r14b, 2
mov al, r13b
shr al, 6
add r14b, al
mov byte [rbp + 0x8a], r14b
and r13b, 0x3f
mov byte [rbp + 0x8b], r13b
lea eax, [rbx + 1]
test eax, eax
jle 0x140005af0
lea r14, [rbp + 0x88]
mov r15d, eax
movzx edx, byte [r14]
lea rcx, [rsp + 0x30]
call fcn.14005ee24
mov dl, byte [rax]
mov rcx, rsi
call fcn.140005b2c
inc r14
sub r15, 1
jne 0x140005acf
cmp ebx, edi
jge 0x140005b09
sub edi, ebx
movsxd rbx, edi
mov dl, 0x3d
mov rcx, rsi
call fcn.140005b2c
sub rbx, 1
jne 0x140005af9
lea rcx, [rsp + 0x30]
call fcn.140002d38
mov rax, rsi
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000656c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [rcx]
mov r8, rcx
or edx, 0xffffffff
jmp 0x1400065a2
movzx eax, al
mov r9d, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9d, 1
jns 0x140006581
inc r8
mov al, byte [r8]
test al, al
jne 0x140006576
not edx
mov eax, edx
ret
Function at 0x14005e6d8
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov r13d, r8d
mov rsi, rdx
mov r15, rcx
and dword [rsp + 0x20], 0
mov edi, 0x41
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b1300
mov rcx, r15
call fcn.140002cfc
mov dword [rsp + 0x20], 1
xor ebx, ebx
xor edx, edx
mov r8d, 0xc4
lea rcx, [rbp - 0x80]
call fcn.1400b1300
lea rcx, [rbp - 0x80]
call fcn.14005f4ec
mov r8, rax
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1400b384c
lea rcx, [rbp - 0x80]
call fcn.140013338
test r13d, r13d
je 0x14005e8e5
xor ecx, ecx
lea edi, [rbx + 3]
jmp 0x14005e77b
mov rsi, qword [rbp + 0xa8]
dec r13d
mov al, byte [rsi]
mov byte [rbp + rcx + 0xb0], al
inc ebx
inc rcx
inc rsi
mov qword [rbp + 0xa8], rsi
mov r12b, byte [rbp + 0xb2]
mov sil, byte [rbp + 0xb1]
mov r14b, byte [rbp + 0xb0]
cmp rcx, rdi
jne 0x14005e818
mov al, r14b
shr al, 2
mov byte [rbp + 0xb8], al
mov cl, r14b
and cl, dil
shl cl, 4
mov al, sil
shr al, 4
add cl, al
mov byte [rbp + 0xb9], cl
mov cl, sil
and cl, 0xf
shl cl, 2
mov al, r12b
shr al, 6
add cl, al
mov byte [rbp + 0xba], cl
mov al, r12b
and al, 0x3f
mov byte [rbp + 0xbb], al
xor ebx, ebx
movzx eax, byte [rbp + rbx + 0xb8]
mov dl, byte [rsp + rax + 0x30]
mov rcx, r15
call fcn.140005b2c
inc rbx
cmp rbx, 4
jl 0x14005e7f7
xor ebx, ebx
xor ecx, ecx
test r13d, r13d
jne 0x14005e774
test ebx, ebx
je 0x14005e8e5
cmp ebx, edi
jge 0x14005e85d
mov eax, edi
sub eax, ebx
movsxd r8, eax
movsxd rax, ebx
lea rcx, [rbp + 0xb0]
add rcx, rax
xor edx, edx
call fcn.1400b1300
mov r12b, byte [rbp + 0xb2]
mov sil, byte [rbp + 0xb1]
mov r14b, byte [rbp + 0xb0]
mov al, r14b
shr al, 2
mov byte [rbp + 0xb8], al
and r14b, dil
shl r14b, 4
mov al, sil
shr al, 4
add r14b, al
mov byte [rbp + 0xb9], r14b
and sil, 0xf
shl sil, 2
mov al, r12b
shr al, 6
add sil, al
mov byte [rbp + 0xba], sil
and r12b, 0x3f
mov byte [rbp + 0xbb], r12b
lea eax, [rbx + 1]
test eax, eax
jle 0x14005e8cc
lea rsi, [rbp + 0xb8]
mov r14d, eax
movzx eax, byte [rsi]
mov dl, byte [rsp + rax + 0x30]
mov rcx, r15
call fcn.140005b2c
inc rsi
sub r14, 1
jne 0x14005e8b4
cmp ebx, edi
jge 0x14005e8e5
sub edi, ebx
movsxd rbx, edi
mov dl, 0x3d
mov rcx, r15
call fcn.140005b2c
sub rbx, 1
jne 0x14005e8d5
mov rax, r15
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14009dc90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
cmp byte [rcx + 8], r9b
je 0x14009dcc3
cmp dword [rcx + 0x3d0], r9d
jle 0x14009dcbe
sub r8, rdx
mov al, byte [r8 + rdx]
inc r9d
xor byte [rdx], al
inc rdx
cmp r9d, dword [rcx + 0x3d0]
jl 0x14009dca9
add rsp, 0x48
ret
mov rdx, qword [0x1400e4058]
lea rcx, [rsp + 0x20]
call fcn.14009bc10
lea rdx, [0x1400e25f8]
lea rcx, [rsp + 0x20]
call fcn.1400b0a88
int3

Function at 0x14009e0e0
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x1400a3c34
Capabilities:
Check http status code

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov r15, rcx
xor r14d, r14d
call fcn.14000638c
mov dl, al
lea rcx, [rbp + 0x67]
call fcn.14005cd6c
nop
mov rcx, rax
call fcn.14005ce44
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.140002c74
mov rbx, rax
xor ecx, ecx
call fcn.1400a3440
mov r8d, eax
lea r12d, [r14 + 1]
mov r9d, r12d
mov rdx, rbx
mov rcx, r15
call fcn.1400a3354
nop
lea rcx, [rbp + 0x67]
call fcn.1400131e4
cmp byte [r15 + 0x20], r14b
je 0x1400a3d96
xor eax, eax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
mov dword [rbp + 0x77], eax
mov word [rbp + 0x7b], ax
xor edx, edx
lea rcx, [rbp - 1]
call fcn.1400a3460
mov rbx, rax
lea rcx, [rbp - 0x21]
call fcn.1400a6584
mov rsi, rax
lea rcx, [rbp + 0x77]
call fcn.1400a46f4
mov rdi, rax
mov rcx, rbx
call fcn.140004524
mov rdx, rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x4080000
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rdi
mov rcx, qword [r15 + 0x30]
call fcn.14006472c
mov rbx, rax
lea rcx, [rbp - 1]
call fcn.140002d38
nop
lea rcx, [rbp + 0x77]
call fcn.1400132f0
nop
lea rcx, [rbp - 0x21]
call fcn.140002d44
test rbx, rbx
je 0x1400a3d8e
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140064bc0
mov dword [rbp + 0x67], r14d
mov dword [rbp + 0x6f], 4
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
mov edx, 0x20000013
mov rcx, rbx
call fcn.140064a54
movzx r14d, r14b
cmp dword [rbp + 0x67], 0xc8
cmove r14d, r12d
mov rcx, rbx
call fcn.14006490c
mov rcx, r15
call fcn.1400a3408
mov al, r14b
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400abd27
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xb4
mov bl, 0xb2
mov bl, 0xb7
mov esp, 0xb5b3adb0
mov dl, 0xb9

Function at 0x1400ac03d
Capabilities:
Encode data using xor

Disassembly:
int3
sub eax, 0x4e6a3e35
and al, 0x54
xor byte [rcx], ch
xor eax, 0x7b7d512d
jl 0x1400ac034
invalid
in eax, dx

Function at 0x1400ae44d
Capabilities:
Authenticate hmac

Disassembly:
insb byte [edi], dx
outsb dx, byte [rsi]
push rsi
pop rax
pop rdi
push rsp
xor edi, dword [rcx + 0x2a]
xor byte [rsi + 0x74], dh
xor eax, 0x2c6a4f56
xor ah, byte [0xe9833cc9]
invalid
invalid

Function at 0x1400ae455
Capabilities:
Authenticate hmac

Disassembly:
pop rax
push rbx
jno 0x1400ae49d
xor ebx, dword [rax + 0x65]
invalid
adc al, 0x28
or eax, 0x102b0c24
invalid

Function at 0x1400ae4a6
Capabilities:
Authenticate hmac

Disassembly:
sub ecx, dword cs:[rdi + 0x32]
and al, 0x79
pop rsp
invalid

Function at 0x1400ae4bb
Capabilities:
Authenticate hmac

Disassembly:
xchg ecx, eax
push rbp
sahf
pop rdx
xchg ebx, eax
push rbx
popfq
pop rbx
xchg esp, eax
push rbx
cdq
invalid

Function at 0x1400ae4d1
Capabilities:
Authenticate hmac

Disassembly:
cmp byte ss:[rax + rdx*2 + 0x3b], al
je 0x1400ae552
push 0x36
jns 0x1400ae533
invalid
jae 0x1400ae594
Function at 0x1400b4234
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400b4008
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b4008
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b4008
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b4008
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b4008
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b4008
cmp dword [rcx + 0xf8], esi
je 0x1400b4008
mov ecx, r14d
call fcn.1400b4150
mov ecx, 2
call fcn.1400ba358
nop
cmp byte [0x1400e4fc0], 0
jne 0x1400b40d2
mov r15d, 1
mov eax, r15d
xchg dword [0x1400e4fb0], eax
test ebx, ebx
jne 0x1400b407b
mov rdi, qword [0x1400e4090]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400e4fb8]
cmp rcx, rax
je 0x1400b4072
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400b0604]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400e50f8]
jmp 0x1400b4087
cmp ebx, r15d
jne 0x1400b408d
lea rcx, [0x1400e5110]
call fcn.1400b9548
nop
test ebx, ebx
jne 0x1400b40a4
lea rdx, [0x1400c7540]
lea rcx, [0x1400c7520]
call fcn.1400b9810
lea rdx, [0x1400c7550]
lea rcx, [0x1400c7548]
call fcn.1400b9810
movzx eax, byte [0x1400e4fc0]
test esi, esi
cmove eax, r15d
mov byte [0x1400e4fc0], al
jmp 0x1400b40d2
mov ecx, 2
call fcn.1400ba3ac
test esi, esi
jne 0x1400b40e9
mov ecx, r14d
call fcn.1400b4104
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400b3f98
Function at 0x140003650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400360a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000367d
xor eax, eax
jmp 0x1400037c3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400036b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400036b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400037c3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400037b6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400036fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003709
movsx ecx, dil
jmp 0x14000375d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x1400037b6
cmp eax, 1
jle 0x140003777
cmp eax, 3
jne 0x1400037b6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14000a8c0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400037bb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400037a4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14000b6d4
cmp rsi, rax
jne 0x1400037b6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400037bb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140006520
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000a8b4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000a747
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a747
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a747
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a747
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a747
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a747
cmp dword [rcx + 0xf8], 0
je 0x14000a747
mov ecx, ebx
call fcn.14000a7e8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000a5d8
cmp dword [rbp + 0x20], 0
je 0x14000a794
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000a79c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000a6e0

Function at 0x140014ee4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140014f04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000d104
or eax, 0xffffffff
jmp 0x140014f06
xor eax, eax
add rsp, 0x28
ret
Function at 0x100401010
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov qword [rcx + 0x10], rdx
mov rbx, rcx
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], al
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jl 0x1004023f1
test rax, rax
je 0x1004023fd
mov rcx, qword [rax + 0xe8]
test rcx, rcx
je 0x1004023fd
mov rax, qword [rcx + 0xe8]
mov qword [rbx + 8], rax
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1080]
mov qword [rcx + 0xe8], rbx
mov rcx, qword [rax]
mov rax, rbx
xor rcx, rbx
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
jmp 0x100401046
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x100402428
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0xe8]
jmp 0x10040105f

Function at 0x100401090
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, rcx
mov rcx, qword [0x10042d0c0]
add rax, rcx
cmp rcx, 0x1480
jl 0x100402434
test rax, rax
je 0x100402440
mov rdx, qword [rax + 0xe8]
test rdx, rdx
je 0x100402440
mov rcx, qword [rbx + 8]
mov qword [rdx + 0xe8], rcx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
jmp 0x1004010b9
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040246b
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov rcx, qword [rbx + 8]
mov qword [rax + 0xe8], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x1004013c0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10042d0d0]
jne 0x10040235b
rol rcx, 0x10
test cx, 0xffff
jne 0x100402357
repz ret
ror rcx, 0x10
jmp fcn.1004031c0
Function at 0x1004022f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jl 0x1004023ae
test rax, rax
je 0x1004023ba
mov rax, qword [rax + 0xe8]
test rax, rax
je 0x1004023ba
mov rax, qword [rax + 0x398]
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
jmp 0x100402314
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x1004023e5
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
jmp 0x10040232d

Function at 0x100403080
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x1004030a6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1004030b7
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x1004030e9
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x1004030e2
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov rax, qword [rax + 0x398]
mov rax, qword [rax + 0x108]
add rsp, 0x28
ret

Function at 0x100403110
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov ebx, ecx
mov rcx, qword [0x10042d0c0]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040313a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040314b
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x10040317d
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x100403176
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov rax, qword [rax + 0x1f0]
mov edx, 1
mov r9d, ebx
mov rcx, qword [rax + reloc.sqllang.dll_Ordinal_824]
lea r8d, [rdx + 0x10]
add rcx, 0xdc
mov qword [rsp + 0x20], rcx
lea ecx, [rdx + 6]
call qword [sym.imp.sqldk.dll_Ordinal_980]
add rsp, 0x30
pop rbx
ret

Function at 0x1004031c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5a8
mov rax, qword [0x10042d0d0]
xor edx, edx
mov qword [rsp + 0x5b8], rax
mov rax, qword [0x100454258]
lea ecx, [rdx + 1]
mov qword [rsp + 0x5b8], rax
call qword [sym.imp.sqldk.dll_Ordinal_970]
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x94
call sub.MSVCR100.dll_memset
lea rcx, [rsp + 0xd8]
xor edx, edx
mov r8d, 0x4c8
mov qword [rsp + 0xd0], 0
call sub.MSVCR100.dll_memset
mov rax, qword [rsp + 0x5a8]
xor ecx, ecx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xc0000409
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x502
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x5a8
ret
Function at 0x100404cc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [0x10042d0c0]
mov dword [rsp + 0x20], reloc.sqldk.dll_Ordinal_211
mov rax, qword gs:[0x30]
mov esi, edx
add rax, rcx
cmp rcx, 0x1480
jge 0x100404d03
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100404d14
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x100404d46
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x100404d3f
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x100404d59
mov rcx, qword [rax + 0x398]
jmp 0x100404d5b
xor ecx, ecx
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1090]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test byte [rax], 1
je 0x100404def
test rcx, rcx
je 0x100404def
lea rax, [rcx + 0x6d8]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100404def
inc qword [rax + 0x1a68]
mov rcx, qword [rsp + 0x38]
mov edx, reloc.sqldk.dll_Ordinal_211
call qword [sym.imp.sqldk.dll_Ordinal_511_1]
mov rcx, qword [rsp + 0x38]
mov edx, reloc.sqldk.dll_Ordinal_211
mov rbx, rax
call qword [sym.imp.sqldk.dll_Ordinal_387]
mov r11, rax
test rbx, rbx
je 0x100404def
test rax, rax
je 0x100404def
xor edx, edx
mov rax, rbx
mov ecx, 0xfa
div r11
mov ebx, 0x61a8
shr rax, 1
cmp rax, rcx
cmova rcx, rax
cmp rcx, rbx
cmovb rbx, rcx
jmp 0x100404df4
mov ebx, 0xfa
mov ebp, 0x989680
nop dword [rax]
xor ecx, ecx
test rbx, rbx
je 0x100404e17
mov rax, rbx
mov rcx, rbx
nop dword [rax]
pause
dec rax
jne 0x100404e10
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x100404e28
add qword [rax + 0x1a60], rcx
xor eax, eax
lock cmpxchg dword [rdi], esi
je 0x100404e77
mov rcx, qword [rsp + 0x38]
inc dword [rsp + 0x40]
test rcx, rcx
je 0x100404e4b
movsxd rax, dword [rsp + 0x20]
shl rax, 5
inc dword [rax + rcx + 0x18]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.sqldk.dll_Ordinal_208]
test byte [rsp + 0x40], 0x1f
jne 0x100404e67
mov ebx, 0xfa
jmp 0x100404e00
lea rax, [rbx + rbx]
mov rbx, rax
cmp rax, rbp
cmova rbx, rbp
jmp 0x100404e00
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x100404ea0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [0x10042d0c0]
mov dword [rsp + 0x20], Ordinal_245
mov rax, qword gs:[0x30]
mov esi, edx
add rax, rcx
cmp rcx, 0x1480
jge 0x100404ee3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100404ef4
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x100404f26
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x100404f1f
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x100404f39
mov rcx, qword [rax + 0x398]
jmp 0x100404f3b
xor ecx, ecx
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1090]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test byte [rax], 1
je 0x100404fcf
test rcx, rcx
je 0x100404fcf
lea rax, [rcx + 0x6d8]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100404fcf
inc qword [rax + 0x1dc8]
mov rcx, qword [rsp + 0x38]
mov edx, 0xee
call qword [sym.imp.sqldk.dll_Ordinal_511_1]
mov rcx, qword [rsp + 0x38]
mov edx, 0xee
mov rbx, rax
call qword [sym.imp.sqldk.dll_Ordinal_387]
mov r11, rax
test rbx, rbx
je 0x100404fcf
test rax, rax
je 0x100404fcf
xor edx, edx
mov rax, rbx
mov ecx, 0xfa
div r11
mov ebx, 0x61a8
shr rax, 1
cmp rax, rcx
cmova rcx, rax
cmp rcx, rbx
cmovb rbx, rcx
jmp 0x100404fd4
mov ebx, 0xfa
mov ebp, 0x989680
nop dword [rax]
xor ecx, ecx
test rbx, rbx
je 0x100404ff7
mov rax, rbx
mov rcx, rbx
nop dword [rax]
pause
dec rax
jne 0x100404ff0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x100405008
add qword [rax + 0x1dc0], rcx
xor eax, eax
lock cmpxchg dword [rdi], esi
je 0x100405057
mov rcx, qword [rsp + 0x38]
inc dword [rsp + 0x40]
test rcx, rcx
je 0x10040502b
movsxd rax, dword [rsp + 0x20]
shl rax, 5
inc dword [rax + rcx + 0x18]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.sqldk.dll_Ordinal_208]
test byte [rsp + 0x40], 0x1f
jne 0x100405047
mov ebx, 0xfa
jmp 0x100404fe0
lea rax, [rbx + rbx]
mov rbx, rax
cmp rax, rbp
cmova rbx, rbp
jmp 0x100404fe0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret