joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031a30
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x120
mov rax, qword [0x14028a040]
xor rax, rsp
mov qword [rsp + 0x110], rax
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140031b6d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x88]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x90]
mov edx, 0x1a
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140031aaa
mov ebx, 1
jmp 0x140031ab0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140031b73
cmp dword [rsp + 0x90], edi
jne 0x140031b73
lea rcx, [rsp + 0x68]
call fcn.1400316b0
test eax, eax
jne 0x140031b73
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x50], rcx
mov r8, rax
lea rcx, [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140031b5a
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140031b73
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140001bb0
cmp byte [0x1402a71dc], dil
jne 0x140031c00
mov qword [rsp + 0x130], rsi
movabs rbx, 0x7fffffffc46535ff
mov esi, 0xff
movabs rdi, 0x7fffffffffffffff
lea rcx, [rsp + 0x60]
call fcn.140001570
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x88], rax
cmp rax, rbx
je 0x140031bda
mov ecx, 1
cmovl ecx, esi
test cl, cl
jns 0x140031bda
add rax, 0x3b9aca00
mov qword [rsp + 0x88], rax
jmp 0x140031be2
mov qword [rsp + 0x88], rdi
lea rcx, [rsp + 0x88]
call fcn.140004210
cmp byte [0x1402a71dc], 0
je 0x140031ba2
mov rsi, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400813e0
mov rbx, qword [rsp + 0x138]
add rsp, 0x120
pop rdi
ret
Function at 0x1400340a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400340fd
lea rbx, [0x140088e60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400340e4
cmp r10, 2
jb 0x1400340e4
cmp byte [r9], r8b
jne 0x1400340e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400340c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14003413f
lea rbx, [0x140088e60]
cmp r8b, 0x23
jne 0x140034123
cmp byte [r9], r8b
jne 0x140034123
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140034110
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140034240
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x14003425e
mov qword [r8], r14
lea rdx, [0x14027b8a8]
call fcn.140034150
mov rbx, rax
test rax, rax
jne 0x140034283
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400343af
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400343af
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400343af
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400343af
cmp rdi, 0xffffffffffffffff
je 0x1400343af
mov rcx, rdi
call fcn.140038650
mov rbp, rax
test rax, rax
je 0x1400343af
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14003439c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1402a8398]
test r8, r8
je 0x140034391
movsx rdx, word [r8 + 0x6078]
lea rcx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140034386
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [r8 + 0x607c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400343b8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400343aa
mov qword [rsi], rdi
mov rax, rbp
jmp 0x1400343ba
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14004b670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5fc0], 0
lea rbx, [rcx + 0x5fc8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14004b717
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14004b6ca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14004df70
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140034c70
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5fc0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5fd0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1402a8321]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14004b71f
mov rcx, rbx
call fcn.140034c70
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14004b980
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1402a8398]
xor ebp, ebp
cmp byte [rbx + 0x5f18], bpl
jne 0x14004ba5f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14004ba58
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140034240
mov rsi, rax
test rax, rax
je 0x14004ba58
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14004b9e4
mov rcx, rax
call fcn.14004bbb0
mov r8, qword [0x1402a8398]
test r8, r8
je 0x14004ba4f
movsx rdx, word [r8 + 0x6078]
lea rcx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14004ba44
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [r8 + 0x607c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f18], 1
movss xmm0, dword [rbx + 0x5f1c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14004baee
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f1c], xmm0
jb 0x14004baee
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14004bae1
mov rax, qword [0x1402a8398]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f1c], ebp
call fcn.14004be10
lea rdx, [0x14027b8b0]
mov rcx, rdi
mov rsi, rax
call fcn.140034150
mov rdi, rax
test rax, rax
je 0x14004bae8
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14004bae8
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f1c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14004bb10
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1402a8398]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14004bb73
mov qword [rsp], rbx
lea rbx, [0x140088e60]
nop dword [rax]
cmp r9b, 0x23
jne 0x14004bb53
cmp byte [r8], r9b
jne 0x14004bb53
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14004bb40
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f30]
not eax
mov r8, qword [r10 + 0x5f38]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14004bb9f
cmp dword [r8 + 8], eax
je 0x14004bba6
add r8, 0x48
cmp r8, rcx
jne 0x14004bb90
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x1400635c0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x14028a040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1402a8398]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400637de
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400637de
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1402a8398]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140063694
movsx rdx, word [r8 + 0x6078]
lea rax, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x140063689
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rax, [rax*8 + 0x607c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6070]
test rdi, rdi
je 0x1400636b1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x1400636b4
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x1400636f7
mov rsi, qword [r8 + 0x90]
jmp 0x1400636fa
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140063725
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1402a8398]
mov rcx, qword [rax + 0x4b00]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, [0x14027bf80]
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14006379e
inc rbx
cmp rbx, 5
jl 0x140063780
jmp 0x1400637ca
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x1400637e0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400813e0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14007e500
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.14007f1f0
mov qword [0x1402a8410], rax
test rax, rax
je 0x14007e6bc
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007e5b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007e5b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6d5da46d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14007e5b2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14007e590
cmp r8d, 0xc3b5a5fe
je 0x14007e5bc
test r9d, r9d
jne 0x14007e570
mov rax, qword [rax]
jmp 0x14007e540
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [0x1402a8420]
mov rcx, qword [0x1402a8410]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007e677
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007e677
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe85a9477
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007e672
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007e650
cmp r8d, 0x14368cc4
je 0x14007e67c
test r9d, r9d
jne 0x14007e630
mov rax, qword [rax]
jmp 0x14007e600
mov ecx, dword [rbx + 0x24]
lea r8, [0x1402a8420]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 2
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [0x1402a8410]
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x1402a8322], 1
add rsp, 0x28
ret
Function at 0x14007f1f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14028a040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov dword [rsp + 0x40], ecx
movabs rdx, 0xf2c87d21f0bbc015
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rcx, 0x4939d3bc19a1e656
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14007f2a0
lea rcx, [rsp + 0x48]
cmp rdx, 7
ja 0x14007f2d2
mov qword [rsp + 0x58], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x48], di
jmp 0x14007f2dc
lea r9, [rsp + 0x30]
call fcn.140080090
mov qword [rsp + 0x68], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007f376
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007f376
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x599f5482
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14007f371
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14007f350
cmp r8d, 0xea4d5c28
je 0x14007f37b
test r9d, r9d
jne 0x14007f330
mov rax, qword [rax]
jmp 0x14007f300
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x40]
lea rcx, [0x14007ee80]
call r8
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14007f3ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f3e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007f3e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140081684
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400813e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x7ff826691f60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [section..data]
mov rdi, rcx
lea rcx, [0x7ff82669ef10]
mov rsi, r9
mov ebp, r8d
mov r14, rdx
cmp rax, rcx
jne 0x7ff82669212c
cmp qword [0x7ff8266e2828], 0
je 0x7ff82669212c
mov ecx, dword [0x7ff8266e2068]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x7ff826692125
mov dword [rsp + 0x50], 0
mov rdx, qword [0x7ff8266e2838]
mov rcx, rdi
shr rcx, 2
mov r8d, 2
mov eax, dword [rdx]
and rcx, rax
lea rax, [rcx + rcx*8]
mov ecx, r8d
lea r9, [rdx + rax*8]
lock xadd dword [r9 + 0x10], ecx
mov rbx, qword [r9 + 8]
and ecx, 1
test rbx, rbx
je 0x7ff8266a61aa
mov r10d, dword [rbx]
cmp r10, 0x1f
jne 0x7ff82669214e
movabs rax, 0x842108421084211
mul rdi
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
mov rdx, rdi
shr rax, 4
imul rax, rax, 0x1f
sub rdx, rax
mov rbx, qword [rbx + rdx*8 + 8]
test rbx, rbx
je 0x7ff8266a61aa
cmp qword [rbx + 8], rdi
jne 0x7ff8266a61aa
lock inc dword [rbx]
lock xadd dword [r9 + rcx*4 + 0x14], r8d
cmp r8d, ecx
je 0x7ff8266a61b1
test rbx, rbx
je 0x7ff8266a61ca
mov rcx, qword [rbx + 0x18]
mov r9, rsi
mov rax, qword [rsp + 0x58]
mov r8d, ebp
add rax, 0x10
mov rdx, r14
mov r10, qword [rcx + 0xc8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov rax, r10
call qword [case.0x7ff8266a4768.0]
mov edi, eax
mov eax, 0xffffffff
lock xadd dword [rbx], eax
cmp eax, 1
je 0x7ff8266a61e5
test edi, edi
je 0x7ff82669214a
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x7ff8266a61f3
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov eax, 0xffffffff
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [section..data]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call qword [case.0x7ff8266a4768.0]
mov dword [rsp + 0x50], eax
test eax, eax
je 0x7ff826691fd3
jmp 0x7ff8266920f6
xor eax, eax
jmp 0x7ff826692109
xor edx, edx
mov rax, rdi
div r10
jmp 0x7ff826692041
xor ebx, ebx
jmp 0x7ff82669205c
mov rcx, qword [0x7ff8266e26f0]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_PulseEvent]
nop dword [rax + rax]
nop
jmp 0x7ff82669206c
mov rcx, rdi
call fcn.7ff8266b4b10
mov rbx, rax
test rax, rax
jne 0x7ff826692075
mov eax, 0x2736
jmp 0x7ff8266a61f8
mov rcx, rbx
call fcn.7ff8266b49d8
nop
jmp 0x7ff8266920e6
mov eax, 0x277b
mov dword [rsp + 0x50], eax
jmp 0x7ff8266920f6
Function at 0x7ff826692320
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
mov rdi, rcx
lea rcx, [0x7ff82669ef10]
xor r15d, r15d
mov esi, r9d
mov ebp, r8d
mov r14, rdx
cmp rax, rcx
jne 0x7ff8266924c9
cmp qword [0x7ff8266e2828], r15
je 0x7ff8266924c9
mov ecx, dword [0x7ff8266e2068]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x7ff8266a6246
mov dword [rsp + 0x50], r15d
mov rdx, qword [0x7ff8266e2838]
mov rcx, rdi
shr rcx, 2
mov r8d, 2
mov eax, dword [rdx]
and rcx, rax
lea rax, [rcx + rcx*8]
mov ecx, r8d
lea r10, [rdx + rax*8]
lock xadd dword [r10 + 0x10], ecx
mov rbx, qword [r10 + 8]
and ecx, 1
test rbx, rbx
je 0x7ff8266a6252
mov r9d, dword [rbx]
cmp r9, 0x1f
jne 0x7ff8266924ea
movabs rax, 0x842108421084211
mul rdi
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
mov rdx, rdi
shr rax, 4
imul rax, rax, 0x1f
sub rdx, rax
mov rbx, qword [rbx + rdx*8 + 8]
test rbx, rbx
je 0x7ff8266a6252
cmp qword [rbx + 8], rdi
jne 0x7ff8266a6252
lock inc dword [rbx]
lock xadd dword [r10 + rcx*4 + 0x14], r8d
cmp r8d, ecx
je 0x7ff8266a625a
test rbx, rbx
je 0x7ff8266a6273
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x54]
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x68]
add rax, 0x10
mov dword [rsp + 0x68], ebp
mov qword [rsp + 0x70], r14
mov r8d, 1
mov r10, qword [rcx + 0xc8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov rax, r10
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], esi
call qword [case.0x7ff8266a4768.0]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx], ecx
cmp ecx, 1
je 0x7ff8266a628e
test edi, edi
jne 0x7ff8266a629c
mov eax, dword [rsp + 0x54]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call qword [case.0x7ff8266a4768.0]
mov dword [rsp + 0x50], eax
test eax, eax
je 0x7ff826692393
jmp 0x7ff8266a62ad
xor edx, edx
mov rax, rdi
div r9
jmp 0x7ff826692401
mov rax, qword [section..data]
jmp 0x7ff8266924c9
mov rbx, r15
jmp 0x7ff82669241c
mov rcx, qword [0x7ff8266e26f0]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_PulseEvent]
nop dword [rax + rax]
nop
jmp 0x7ff82669242c
mov rcx, rdi
call fcn.7ff8266b4b10
mov rbx, rax
test rax, rax
jne 0x7ff826692435
mov eax, 0x2736
jmp 0x7ff8266a62a9
mov rcx, rbx
call fcn.7ff8266b49d8
nop
jmp 0x7ff82669249f
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x7ff8266a62ad
mov eax, 0x277b
mov dword [rsp + 0x50], eax
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov eax, 0xffffffff
jmp 0x7ff8266924ab