joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041dd0
Capabilities:
Create thread

Disassembly:
jmp 0x140041dd0
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.1401321a8
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x1400421d0]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140041e51
test rbp, rbp
je 0x140041e7c
mov qword [rbp], rdi
jmp 0x140041e85
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x140041e6a
mov ebp, eax
cmp eax, 0x5af
je 0x140041e6a
cmp ebp, 0xe
jne 0x140041ea7
mov rcx, r15
call fcn.1400412e0
mov rcx, r14
call fcn.1401321e4
jmp 0x140041e85
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140132550
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [0x1401b71b0]
mov ecx, dword [0x1401b7730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140041f27
lea rcx, [rsp + 0x38]
mov edx, ebp
call fcn.140036350
movzx eax, byte [rsp + 0x38]
mov rcx, rax
shr rcx, 1
test al, 1
lea rax, [rsp + 0x39]
cmovne rax, qword [rsp + 0x48]
cmovne rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov rcx, qword [0x1401b71a8]
lea rdx, [rsp + 0x50]
call fcn.140065eb0
test byte [rsp + 0x38], 1
je 0x140041e72
mov rcx, qword [rsp + 0x48]
call fcn.1401321e4
jmp 0x140041e72
lea rcx, [0x1401b71b0]
call fcn.140132300
cmp dword [0x1401b71b0], 0xffffffff
jne 0x140041ec8
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140065e90
mov qword [0x1401b71a8], rax
lea rcx, [0x1401b71b0]
call fcn.140132398
jmp 0x140041ec8

Function at 0x140042440
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400424bb
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400424bb
cmp dword [rsp + 0x38], 4
jne 0x1400424bb
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400424e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1401324e0
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.140135a50
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rbx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x3c]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400425c9
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x14004257b
mov edi, 0x3f4
cmp eax, 1
jne 0x1400425c9
lea rdx, [rsp + 0x840]
jmp 0x1400425bf
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.140135a50
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x1400425c9
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140023712
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400425f0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.140150e84
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140044020
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
test rdx, rdx
je 0x1400440b8
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str..._.._base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x20]
jmp 0x140044078
add rdi, rbx
sub rsi, rbx
je 0x1400440b8
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140044070
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.140025970
mov rcx, r12
call fcn.140025a00
mov rcx, r12
call fcn.140025a10
jmp 0x140044070
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140132550
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140044780
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401b7220]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x1400448ef
jp 0x1400448ef
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401b7230]
mov ecx, dword [0x1401b7730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004490e
mov eax, dword [0x1401b7240]
mov ecx, dword [0x1401b7730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140044948
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x1401b7238]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x140166460]
subpd xmm1, xmmword [0x140166470]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x14016bfc8]
ucomisd xmm1, xmm0
ja 0x1400448ef
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401b7228]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x140166460]
subpd xmm1, xmmword [0x140166470]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401b7220], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140132550
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1401b7230]
call fcn.140132300
cmp dword [0x1401b7230], 0xffffffff
jne 0x140044801
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401b7228], rdx
lea rcx, [0x1401b7230]
call fcn.140132398
jmp 0x140044801
lea rcx, [0x1401b7240]
call fcn.140132300
cmp dword [0x1401b7240], 0xffffffff
jne 0x140044826
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1401b7238], rax
lea rcx, [0x1401b7240]
call fcn.140132398
jmp 0x140044826
Function at 0x140045240
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [0x14016d1b0]
mov qword [rcx], rax
add rcx, 8
call fcn.14003b6f0
lea rcx, [rsi + 0x10]
call fcn.14003b6f0
mov byte [rsi + 0x18], 0
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], 0
call fcn.14003b6f0
mov byte [rsi + 0x48], 0
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], 0
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov dword [rsi + 0xd0], 0x3f800000
mov dword [rsi + 0xd8], 0
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], 0x3f800000
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], 0x3f800000
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov qword [rsi + 0x150], 0
mov dword [rsi + 0x158], 0x3f800000
movups xmmword [rsi + 0x160], xmm6
movups xmmword [rsi + 0x170], xmm6
mov dword [rsi + 0x180], 0x3f800000
mov qword [rsi + 0x1a0], 0
movups xmmword [rsi + 0x188], xmm6
mov dword [rsi + 0x198], 0
mov eax, dword [0x140171468]
mov qword [rsi + 0x1a8], rax
lea rcx, [rsi + 0x1b0]
call fcn.14006b410
movups xmmword [rsi + 0x2e0], xmm6
mov qword [rsi + 0x2f0], 0
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.14005c690
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.14005c690
lea rcx, [rsi + 0x308]
xor edx, edx
call fcn.14005c690
movups xmmword [rsi + 0x310], xmm6
movups xmmword [rsi + 0x320], xmm6
mov dword [rsi + 0x330], 0x3f800000
movups xmmword [rsi + 0x338], xmm6
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
movups xmmword [rsi + 0x361], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
call fcn.140002830
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x198], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x190], rax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140041650
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140041720
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x130], rax
mov rcx, rdi
call fcn.140041560
mov rcx, rsi
call fcn.1400454e0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
je 0x14004548a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
call fcn.140069370
mov qword [rsp + 0x28], 0
lea r8, str.TraceLog
lea r9, [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.1400694e0
mov qword [0x1401b7618], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140132550
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x14005b680
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, r9
mov r15, r8
mov edi, edx
mov rbx, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
cmp dword [rcx + 8], 0
setne al
mov ebp, edx
sar ebp, 0x1f
lea r12d, [rax + rax]
add r12d, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], r8
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [r14], rax
test rax, rax
jne 0x14005b714
call fcn.140098e90
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [r14], rax
test rax, rax
jne 0x14005b714
call fcn.140098e90
mov rsi, qword [r14]
test rsi, rsi
je 0x14005b77e
mov rdi, qword [rsp + 0xd0]
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rsp + 0x48]
sub rcx, rsi
add rcx, qword [rsp + 0x38]
test rax, rax
cmove rcx, rax
mov qword [rdi], rcx
mov sil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140132550
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14005b760

Function at 0x14005b8e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x14005b95c
cmp r8, 1
jne 0x14005b8f2
xor ecx, ecx
jmp 0x14005b93e
mov r9, r8
and r9, 0xfffffffffffffffe
xor ecx, ecx
lea r10, [0x140170140]
nop word cs:[rax + rax]
nop dword [rax]
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r9, rcx
jne 0x14005b910
test r8b, 1
je 0x14005b95c
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x140170140]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret

Function at 0x14005c0c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401b46b8]
cmp ecx, 0xffffffff
je 0x14005c0e3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
jmp 0x14005c0e5
xor eax, eax
add rsp, 0x28
ret
Function at 0x14005c0f0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, rdx
mov r15, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, dword [0x1401b46b8]
cmp ecx, 0xffffffff
je 0x14005c125
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14005c12a
call fcn.14005c340
mov eax, dword [0x1401b8fd8]
mov ecx, dword [0x1401b7730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005c2f6
mov rbx, qword [0x1401b8fd0]
mov rcx, rbx
call fcn.140041a40
mov rcx, qword [0x1401b77c8]
add rcx, 1
mov edx, 0x100
lea rax, [0x1401b77d0]
nop word cs:[rax + rax]
nop
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14005c1aa
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14005c1aa
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x14005c180
jmp 0x14005c1cf
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1401b77c8], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
movabs r14, 0xaaaaaaaaaaaaaaaa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsp + 0x30], r14
mov edi, dword [r15]
cmp edi, 0xffffffff
je 0x14005c1fa
mov qword [rsp + 0x30], 0
jmp 0x14005c262
mov ecx, 0xffffffff
call fcn.140025b60
mov rdi, rax
mov ecx, 0xffffffff
call fcn.140025b60
lea rdx, [0x140170540]
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rdi
call fcn.140025fc0
cmp qword [rsp + 0x30], 0
je 0x14005c25f
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rdi, [rsp + 0x28]
lea r9, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x197
call fcn.140025a30
mov rcx, rdi
call fcn.140025a00
mov rcx, rdi
call fcn.140025a10
mov edi, dword [r15]
mov qword [rsp + 0x30], r14
cmp edi, 0xff
jg 0x14005c27a
mov qword [rsp + 0x30], 0
jmp 0x14005c2dc
mov ecx, 0x100
call fcn.140025b60
mov rsi, rax
mov ecx, edi
call fcn.140025b60
lea rdx, str.slot____kThreadLocalStorageSize
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rsi
call fcn.140025fc0
cmp qword [rsp + 0x30], 0
je 0x14005c2dc
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x198
call fcn.140025a30
mov rcx, rsi
call fcn.140025a00
mov rcx, rsi
call fcn.140025a10
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140132550
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1401b8fd8]
call fcn.140132300
cmp dword [0x1401b8fd8], 0xffffffff
jne 0x14005c14f
mov ecx, 8
call fcn.1401321a8
mov rbx, rax
mov rcx, rax
call fcn.14003b6f0
mov qword [0x1401b8fd0], rbx
lea rcx, [0x1401b8fd8]
call fcn.140132398
jmp 0x14005c14f
Function at 0x14005c340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1401324e0
sub rsp, rax
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1401b46b8]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x14005c43a
lea rcx, [rsp + 0x2c]
call fcn.140099660
test al, al
jne 0x14005c3bb
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea r9, str.PlatformThreadLocalStorage::AllocTLS_key_
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xd1
call fcn.140025970
mov rcx, rsi
call fcn.140025a00
mov rcx, rsi
call fcn.140025a10
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x14005c418
lea rcx, [rsp + 0x2c]
call fcn.140099660
test al, al
je 0x14005c3d9
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x14005c40a
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea r9, str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xdb
call fcn.140025970
mov rcx, rsi
call fcn.140025a00
mov rcx, rsi
call fcn.140025a10
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x1401b46b8], ecx
mov ecx, dword [rsp + 0x2c]
je 0x14005c43a
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401b46b8]
mov dword [rsp + 0x2c], ecx
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
and esi, 3
je 0x14005c4b8
xor ecx, ecx
call fcn.140025b60
mov rdi, rax
mov ecx, esi
call fcn.140025b60
lea rdx, str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rdi
call fcn.140025fc0
cmp qword [rsp + 0x30], 0
je 0x14005c4c1
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x20]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xed
call fcn.140025a30
mov rcx, rsi
call fcn.140025a00
mov rcx, rsi
call fcn.140025a10
jmp 0x14005c4c1
mov qword [rsp + 0x30], 0
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140135a50
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14013221c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140135640
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140132550
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret

Function at 0x14005c600
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401b46b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005c630
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14005c630
mov rax, qword [rax + rcx]
jmp 0x14005c632
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14005c640
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401b46b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14005c668
test rdi, rdi
je 0x14005c681
call fcn.14005c340
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140064c90
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.MapImageToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1b
call fcn.14002d9e0
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.14003abb0
mov rcx, rsi
call fcn.1400404a0
test al, al
je 0x140064df7
mov rcx, rsi
call fcn.1400404b0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
cmp qword [rsi + 0x40], rax
je 0x140064d9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 0x40]
add rax, 1
cmp rax, 2
jb 0x140064d7a
call fcn.14002da00
mov rcx, qword [rsi + 0x40]
call fcn.140042990
mov qword [rsi + 0x40], 0
mov rax, rbx
add rax, 1
cmp rax, 2
jb 0x140064d90
mov qword [rsi + 0x40], rbx
call fcn.14002da00
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi + 0x40]
lea rax, [rbx + 1]
cmp rax, 2
jae 0x140064daa
xor edi, edi
jmp 0x140064df7
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x140064df7
lea rcx, [0x140170d90]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.14009c8ba
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.14003acf0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret