joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c860
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c818
test byte [rbx + 0x40], 0xc
jne 0x14001c7cf
mov eax, dword [0x140efd658]
test eax, eax
jne 0x14001c7e0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14001a720
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14001c803
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14001c803
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001c82c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001aa10
call fcn.14001b550
test rax, rax
mov rbx, rax
jne 0x14001c7bf
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001c84a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14001aa10
call fcn.14001c6c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001c8d0
call fcn.14001d9b0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x14001c908
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c960
test esi, esi
je 0x14001c8e6
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c940
mov edx, edi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c950
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x14001c8a5
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c8be
call fcn.14001b550
jmp 0x14001c8e6
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a1

Function at 0x14001c970
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c9e0
test esi, esi
je 0x14001c9c0
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c9f0
mov edx, esi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001b550
mov rbx, rax
jmp 0x14001c991
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c9aa
Function at 0x1800012b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov rbx, rdx
mov rsi, qword [rdx + 0x10]
jb 0x1800012d0
mov rbx, qword [rdx]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x180001352
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x18000134c
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
xor al, al
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180001370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [rcx]
xor r9d, r9d
mov rbx, r8
mov qword [rsp + 0x30], 0
mov rsi, rdx
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800013e9
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov bl, 1
jmp 0x1800013eb
xor bl, bl
test rdi, rdi
je 0x1800013f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x60]
movzx eax, bl
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180003dd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r9, [r8 + 0x10]
mov r10, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov r11, rcx
jb 0x180003e01
mov r9, qword [r8 + 0x10]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x180003e34
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r10
jb 0x180003e20
mov rdx, qword [r11 + 0x30]
mov rcx, qword [r11 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rbx
jne 0x180003e74
cmp rax, rbx
jne 0x180003e6a
mov rax, qword [r11 + 8]
mov qword [rcx], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x180003e7f
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
jmp 0x180003e7f
cmp rax, rbx
jne 0x180003e7f
mov rax, qword [rbx]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
mov rdx, qword [rbx + 0x28]
cmp rdx, 0x10
jb 0x180003ecf
mov rcx, qword [rbx + 0x10]
inc rdx
cmp rdx, 0x1000
jb 0x180003eca
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003f0c
mov rcx, r8
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbx + 0x20], 0
mov edx, 0x38
mov qword [rbx + 0x28], 0xf
mov rcx, rbx
mov byte [rbx + 0x10], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
call fcn.18002b620
int3
Function at 0x180005fc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x180006047
movsxd rax, dword [0x18000003c]
lea rdx, [0x180000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x180006047
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180006047
sub r8, rdx
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rdx, [rcx + rcx*4]
lea r9, [rax + rdx*8]
mov qword [rsp], rax
cmp rax, r9
je 0x180006043
mov edx, dword [rax + 0xc]
cmp r8, rdx
jb 0x18000603d
mov ecx, dword [rax + 8]
add ecx, edx
cmp r8, rcx
jae 0x18000603d
cmp dword [rax + 0x24], 0
jge 0x180006039
xor al, al
jmp 0x18000604d
mov al, 1
jmp 0x18000604d
add rax, 0x28
jmp 0x180006014
xor al, al
jmp 0x18000604d
xor al, al
jmp 0x18000604d
add rsp, 0x18
ret

Function at 0x180006850
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
mov edi, edx
mov qword [rcx + 8], rbp
mov rbx, rcx
mov dword [rcx + 0x10], 1
mov qword [rcx + 0x18], rbp
mov dword [rcx + 0x20], ebp
mov dword [rcx + 0x24], ebp
test dword [0x18003f038], 0x80000000
je 0x18000689c
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1800068a1
call fcn.180010090
mov qword [rbx], rax
cmp edi, 0xffffffff
je 0x180006901
call fcn.18000b120
cmp eax, 3
jl 0x1800068d2
xor r9d, r9d
lea rdx, [0x180006bd0]
mov r8, rbx
mov ecx, edi
call fcn.180008170
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18000691a
jmp 0x180006901
call fcn.1800143c0
mov dword [rsp + 0x30], 0x20
lea r8, [0x180006c40]
mov rdx, rax
mov dword [rsp + 0x28], ebp
mov r9, rbx
mov dword [rsp + 0x20], edi
lea rcx, [rbx + 0x18]
call sub.KERNEL32.dll_CreateTimerQueueTimer
test eax, eax
je 0x180006936
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x40]
call fcn.180004bf0
lea rdx, [0x18003c800]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
lea rcx, [rsp + 0x58]
call fcn.180004bf0
lea rdx, [0x18003c800]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1800069f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov qword [rcx], rdx
xor eax, eax
mov qword [rcx + 0x10], rax
mov rdi, rcx
mov dword [rcx + 0x18], 1
mov qword [rcx + 0x20], rax
mov dword [rcx + 0x28], eax
mov dword [rcx + 0x2c], eax
test dword [0x18003f038], 0x80000000
je 0x180006a33
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x180006a38
call fcn.180010090
mov qword [rdi + 8], rax
lea rdx, [rdi + 8]
mov rcx, qword [rdi]
mov r8b, 1
call fcn.180006f20
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180006a90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov ebx, edx
mov rdi, rcx
call fcn.18000adf0
mov r8d, dword [rdi + 0x10]
mov ecx, eax
shr r8d, 2
test r8b, 1
jne 0x180006bb9
mov r8d, dword [rdi + 0x10]
shr r8d, 1
test r8b, 1
je 0x180006ad2
mov eax, dword [rdi + 0x10]
shr eax, 3
shr ebx, 3
sub eax, ebx
jmp 0x180006ad7
mov eax, 1
lea r8d, [rcx + 2]
cmp eax, r8d
ja 0x180006bb9
dec eax
mov qword [rsp + 0x50], rsi
imul eax, dword [0x18003f024]
lea rcx, [0x1800084a0]
xor edx, edx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
div r8d
add eax, dword [0x18003f024]
jne 0x180006b17
mov dword [rsp + 0x28], 4
jmp 0x180006b27
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x28], 1
mov esi, 3
nop dword [rax]
mov eax, dword [rdi + 0x10]
test al, 1
je 0x180006bb4
mov ecx, dword [rsp + 0x28]
mov eax, ecx
test ecx, ecx
je 0x180006b74
sub eax, 1
je 0x180006b5b
sub eax, 1
jne 0x180006ba8
add dword [rsp + 0x24], 0xffffffff
cmove ecx, esi
mov dword [rsp + 0x28], ecx
pause
jmp 0x180006b30
pause
add dword [rsp + 0x20], 0xffffffff
jne 0x180006b30
mov eax, dword [rsp + 0x24]
neg eax
sbb ecx, ecx
add ecx, esi
mov dword [rsp + 0x28], ecx
jmp 0x180006b30
mov eax, dword [0x18003f024]
test eax, eax
jne 0x180006b88
mov dword [rsp + 0x28], 4
jmp 0x180006b98
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x20]
call fcn.180007210
test al, al
jne 0x180006b30
jmp 0x180006bb4
sub eax, 1
je 0x180006bb4
cmp eax, 1
jne 0x180006bb4
pause
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.180008770

Function at 0x180007060
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [rcx + 0x30]
mov rbx, rcx
test rax, rax
je 0x1800070de
xor eax, eax
test dword [0x18003f038], 0x80000000
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
je 0x1800070aa
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1800070af
call fcn.180010090
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180006f20
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800072b0
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp fcn.1800075b0
add rsp, 0x50
pop rbx
ret

Function at 0x1800073e0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
xor eax, eax
mov rbx, rcx
test dword [0x18003f038], 0x80000000
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
je 0x180007421
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x180007426
call fcn.180010090
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180006f20
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800072b0
add rsp, 0x50
pop rbx
ret
Function at 0x180007e90
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x180007ea4
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180007eb6
movzx eax, ax
or eax, 0x80070000
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1800086e0
lea rdx, [0x18003caf8]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x180007f00
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180007f13
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180007f25
movzx eax, ax
or eax, 0x80070000
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1800086e0
lea rdx, [0x18003caf8]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x180008070
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call sub.KERNEL32.dll_CreateThread
mov rbx, rax
test rax, rax
je 0x1800080b8
mov ecx, 1
lock xadd dword [0x1800e23e8], ecx
inc ecx
cmp ecx, 1
jne 0x1800080b8
call fcn.1800080c0
lock inc dword [0x18003f038]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1800087b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
test dword [0x18003f038], 0x80000000
je 0x1800087d0
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1800087d9
add rsp, 0x28
jmp fcn.180010090
add rsp, 0x28
ret
Function at 0x18000dd60
Capabilities:
Check os version

Disassembly:
sub rsp, 0x178
mov rax, qword [0x18003f018]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18000dea2
mov eax, dword [rsp + 0x44]
sub eax, 5
je 0x18000dde9
cmp eax, 1
jne 0x18000dddd
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x18000ddbb
cmp eax, 1
jne 0x18000dddd
mov dword [0x1800e2448], 4
jmp 0x18000de08
mov dword [0x1800e2448], 3
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18002d530
add rsp, 0x178
ret
mov dword [0x1800e2448], 6
jmp 0x18000de08
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x18000de7c
sub eax, 1
je 0x18000de5a
cmp eax, 1
je 0x18000de38
cmp dword [0x1800e2448], 4
jl 0x18000ddc5
call fcn.180007800
call fcn.18001c0f0
cmp dword [0x1800e2448], 6
jl 0x18000ddc5
call fcn.18001c7e0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18002d530
add rsp, 0x178
ret
mov dword [0x1800e2448], 2
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18002d530
add rsp, 0x178
ret
mov dword [0x1800e2448], 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18002d530
add rsp, 0x178
ret
lea rcx, [rsp + 0x20]
mov dword [0x1800e2448], 0
call fcn.180008740
lea rdx, [0x18003cb58]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3
lea rcx, [rsp + 0x20]
call fcn.180008740
lea rdx, [0x18003cb58]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x18000f7d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x18000f7f1
mov rcx, rax
call fcn.180016870
cmp rax, rbx
je 0x18000f81c
mov dl, 1
mov rcx, rbx
call fcn.18000f840
mov r9d, dword [rbx + 0x258]
mov r8b, 4
mov edx, 7
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.180013a60
lea rcx, [rsp + 0x20]
call fcn.180008560
lea rdx, [0x18003cc78]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x18000f840
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x68], rsi
movzx ebp, dl
mov rsi, rcx
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x18000f89b
cmp qword [rax + 0x38], rsi
je 0x18000f921
cmp byte [rax + 0x88], 0
jne 0x18000f893
lea rcx, [rax - 0x10]
call fcn.180020f80
mov rcx, rdi
call fcn.180016390
lock inc dword [rsi + 0x26c]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x20]
lea rcx, [rsi + 0x300]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
je 0x18000f8d4
lea rbx, [rax - 0x10]
test rbx, rbx
je 0x18000f8d4
movzx edx, bpl
mov rcx, rbx
call fcn.1800257c0
jmp 0x18000f8fe
mov ecx, 0x120
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x60], rax
test rax, rax
je 0x18000f8fc
movzx r8d, bpl
mov rdx, rsi
mov rcx, rax
call fcn.180025330
mov rbx, rax
jmp 0x18000f8fe
xor ebx, ebx
mov rdx, rdi
mov rcx, rbx
call fcn.180016bc0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x28]
call fcn.180008560
lea rdx, [0x18003cc78]
lea rcx, [rsp + 0x28]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x18000f940
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov eax, 0x80000000
mov ecx, 0xc0000000
lock cmpxchg dword [rbx + 0x27c], ecx
jne 0x18000fa16
mov ecx, dword [0x1800e2468]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov sil, 1
test rax, rax
je 0x18000f995
cmp byte [rax + 0x88], 0
jne 0x18000f995
xor sil, sil
mov rcx, rax
call fcn.1800065d0
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x90]
test eax, eax
jne 0x18000f9af
mov rcx, rbx
call fcn.180012500
jmp 0x18000f9ff
cmp eax, 2
jne 0x18000f9c9
mov eax, dword [rbx + 0x280]
test eax, eax
jne 0x18000f9c9
mov eax, 1
xchg dword [rbx + 0x280], eax
mov eax, dword [rbx + 0x27c]
nop
mov ecx, eax
mov r8d, eax
btr ecx, 0x1e
lock cmpxchg dword [rbx + 0x27c], ecx
cmp eax, r8d
jne 0x18000f9d0
and eax, 0x1fffffff
jbe 0x18000f9ff
mov rcx, qword [rbx + 0x260]
xor r8d, r8d
mov edx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test sil, sil
mov rsi, qword [rsp + 0x38]
jne 0x18000fa11
mov rcx, rdi
call fcn.1800065d0
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret

Function at 0x180010600
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x180010658
cmp qword [rax + 0x38], rbx
jne 0x180010658
cmp byte [rax + 0x88], 0
jne 0x180010658
mov rcx, rax
call fcn.1800065d0
mov rax, qword [rdi + 0xf8]
mov rcx, rdi
mov rbx, qword [rax + 0x78]
call fcn.1800065d0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180010670
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r15d, r9d
xor r13d, r13d
mov r9d, dword [r8]
mov rsi, r8
mov r10d, r9d
mov r12, rdx
and r10d, 0xfffffff
mov rbx, rcx
cmp r10d, 1
je 0x1800107bc
lea eax, [r10 - 2]
cmp eax, 1
ja 0x18001083d
mov ecx, r10d
sub ecx, 2
je 0x180010760
cmp ecx, 1
jne 0x18001083d
mov r11d, dword [r8 + 8]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx r8d, r11b
xor r8, rax
mov eax, r11d
shr eax, 8
movzx ecx, al
mov eax, r11d
shr eax, 0x10
imul r8, rdx
movzx eax, al
xor r8, rcx
mov ecx, r11d
imul r8, rdx
shr rcx, 0x18
xor rax, r8
imul rax, rdx
xor rax, rcx
movsxd rcx, dword [rbx + 0x238]
imul rax, rdx
xor edx, edx
div rcx
mov rax, qword [rbx + 0x240]
movsxd rcx, edx
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x18001083d
cmp dword [rdx + 8], r11d
je 0x18001075b
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180010748
jmp 0x18001083d
mov ecx, dword [rdx + 0xc]
jmp 0x180010764
mov ecx, dword [r8 + 8]
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + rcx*8]
test rcx, rcx
je 0x18001083d
mov rax, qword [rsi + 8]
lea r8, [rsp + 0x20]
and r9d, 0xf0000000
mov qword [rsp + 0x28], rax
mov eax, dword [rsi + 4]
or r9d, r10d
mov dword [rsp + 0x24], eax
mov rdx, r12
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x20], r9d
mov r9d, r15d
mov qword [rsp + 0x30], rax
call fcn.18001f6d0
test al, al
je 0x18001083d
mov al, 1
jmp 0x180010897
mov r14d, dword [r8 + 8]
mov edi, r13d
shl r14, 5
add r14, qword [rcx + 0x28]
cmp dword [rcx + 0x44], r13d
jle 0x18001083d
mov rbp, r13
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r14 + 8]
mov edx, edi
mov ecx, edi
and edx, 0x1f
shr rcx, 5
mov ecx, dword [rax + rcx*4]
bt ecx, edx
jae 0x180010832
mov eax, dword [rsi]
lea r8, [rsp + 0x38]
mov rcx, qword [rbx + 0x30]
mov r9d, r15d
mov dword [rsp + 0x38], eax
mov rdx, r12
mov rax, qword [rsi + 8]
mov qword [rsp + 0x40], rax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx + rbp]
call fcn.18001f6d0
test al, al
jne 0x1800107b5
inc edi
add rbp, 8
cmp edi, dword [rbx + 0x44]
jl 0x1800107e0
mov edi, r13d
cmp dword [rbx + 0x44], r13d
jle 0x180010895
mov rsi, r13
nop dword [rax]
mov rax, qword [rbx + 0x30]
mov rcx, qword [rsi + rax]
test rcx, rcx
je 0x18001088a
mov eax, dword [rcx + 0x30]
test eax, eax
jle 0x18001088a
xorps xmm0, xmm0
mov qword [rsp + 0x50], r13
mov r9d, r15d
lea r8, [rsp + 0x50]
mov rdx, r12
movdqu xmmword [rsp + 0x58], xmm0
call fcn.18001f6d0
test al, al
jne 0x1800107b5
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x44]
jl 0x180010850
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret