joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400407a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1400407cf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400407d2
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400407f3
test bl, bl
je 0x14004084a
cmp byte [rdi + 8], 0
je 0x14004083c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14004083f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14004080a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14004080d
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140040823
xor edi, edi
jmp 0x1400408c6
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x14004087e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140040881
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x14004085b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14004085e
mov rcx, qword [rdi]
call fcn.14005bec0
mov rcx, qword [0x1401b2798]
mov dil, 1
test rcx, rcx
je 0x1400408c6
mov edx, eax
mov r8d, esi
call fcn.1400593d0
jmp 0x1400408c6
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140040894
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x1400408a5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400408a8
mov rcx, qword [rdi]
call fcn.14005bec0
mov rcx, qword [0x1401b2798]
test rcx, rcx
je 0x1400408c3
mov edx, eax
mov r8d, esi
call fcn.1400593d0
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14012d670
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140040d60
Capabilities:
Create thread

Disassembly:
jmp 0x140040d60
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov rbx, r8
mov rsi, rdx
mov r15, rcx
xor edi, edi
test rcx, rcx
setne dil
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl edi, 0x10
mov ecx, 0x10
call fcn.14012d2c8
mov r14, rax
mov qword [rax], rsi
test rbx, rbx
setne byte [rax + 8]
mov dword [rax + 0xc], ebp
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], 0
lea r8, [0x140041160]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140040dde
test rbx, rbx
je 0x140040e0b
mov qword [rbx], rax
jmp 0x140040e14
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x140040df7
mov ebx, eax
cmp eax, 0x5af
je 0x140040df7
cmp ebx, 0xe
jne 0x140040e33
mov rcx, r15
call fcn.140040330
mov rcx, r14
call fcn.14012d304
xor esi, esi
jmp 0x140040e17
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov sil, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012d670
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [0x1401b21b8]
mov ecx, dword [0x1401b2730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140040eb3
lea rcx, [rsp + 0x38]
mov edx, ebx
call fcn.140035940
movzx eax, byte [rsp + 0x38]
mov rcx, rax
shr rcx, 1
test al, 1
lea rax, [rsp + 0x39]
cmovne rax, qword [rsp + 0x48]
cmovne rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov rcx, qword [0x1401b21b0]
lea rdx, [rsp + 0x50]
call fcn.140065500
test byte [rsp + 0x38], 1
je 0x140040dff
mov rcx, qword [rsp + 0x48]
call fcn.14012d304
jmp 0x140040dff
lea rcx, [0x1401b21b8]
call fcn.14012d420
cmp dword [0x1401b21b8], 0xffffffff
jne 0x140040e54
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400654e0
mov qword [0x1401b21b0], rax
lea rcx, [0x1401b21b8]
call fcn.14012d4b8
jmp 0x140040e54

Function at 0x1400413f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14004146b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14004146b
cmp dword [rsp + 0x38], 4
jne 0x14004146b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14012d670
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140041490
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14012d600
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.140130ac0
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rbx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x3c]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140041579
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x14004152b
mov edi, 0x3f4
cmp eax, 1
jne 0x140041579
lea rdx, [rsp + 0x840]
jmp 0x14004156f
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.140130ac0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x140041579
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140022b94
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14012d670
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400415a0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.14014bef4
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140042ff0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
test rdx, rdx
je 0x140043088
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str..._.._base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x20]
jmp 0x140043048
add rdi, rbx
sub rsi, rbx
je 0x140043088
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140043040
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.140024e50
mov rcx, r12
call fcn.140024ee0
mov rcx, r12
call fcn.140024ef0
jmp 0x140043040
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14012d670
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140043680
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401b2228]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x1400437ef
jp 0x1400437ef
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401b2238]
mov ecx, dword [0x1401b2730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004380e
mov eax, dword [0x1401b2248]
mov ecx, dword [0x1401b2730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140043848
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x1401b2240]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x1401615b0]
subpd xmm1, xmmword [0x1401615c0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x140167038]
ucomisd xmm1, xmm0
ja 0x1400437ef
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401b2230]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x1401615b0]
subpd xmm1, xmmword [0x1401615c0]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401b2228], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14012d670
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1401b2238]
call fcn.14012d420
cmp dword [0x1401b2238], 0xffffffff
jne 0x140043701
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401b2230], rdx
lea rcx, [0x1401b2238]
call fcn.14012d4b8
jmp 0x140043701
lea rcx, [0x1401b2248]
call fcn.14012d420
cmp dword [0x1401b2248], 0xffffffff
jne 0x140043726
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1401b2240], rax
lea rcx, [0x1401b2248]
call fcn.14012d4b8
jmp 0x140043726
Function at 0x140044130
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rcx
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [0x1401681d8]
mov qword [rcx], rax
add rcx, 8
call fcn.14003ad30
lea rcx, [rsi + 0x10]
call fcn.14003ad30
mov byte [rsi + 0x18], 0
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], 0
call fcn.14003ad30
mov byte [rsi + 0x48], 0
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], 0
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov dword [rsi + 0xd0], 0x3f800000
mov dword [rsi + 0xd8], 0
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], 0x3f800000
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], 0x3f800000
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov qword [rsi + 0x150], 0
mov dword [rsi + 0x158], 0x3f800000
movups xmmword [rsi + 0x160], xmm6
movups xmmword [rsi + 0x170], xmm6
mov dword [rsi + 0x180], 0x3f800000
mov qword [rsi + 0x1a0], 0
movups xmmword [rsi + 0x188], xmm6
mov dword [rsi + 0x198], 0
mov eax, dword [0x14016c498]
mov qword [rsi + 0x1a8], rax
lea rcx, [rsi + 0x1b0]
call fcn.14006aa80
movups xmmword [rsi + 0x2e0], xmm6
mov qword [rsi + 0x2f0], 0
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.14005be80
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.14005be80
lea rcx, [rsi + 0x308]
xor edx, edx
call fcn.14005be80
movups xmmword [rsi + 0x310], xmm6
movups xmmword [rsi + 0x320], xmm6
mov dword [rsi + 0x330], 0x3f800000
movups xmmword [rsi + 0x338], xmm6
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
movups xmmword [rsi + 0x361], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
call fcn.1400027b0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x198], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x190], rax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140040630
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140040700
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x130], rax
mov rcx, rdi
call fcn.140040550
mov rcx, rsi
call fcn.1400443d0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
je 0x14004437a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
call fcn.1400689f0
mov qword [rsp + 0x28], 0
lea r8, str.TraceLog
lea r9, [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.140068b60
mov qword [0x1401b2620], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012d670
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x14005ab80
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, r9
mov r15, r8
mov edi, edx
mov rbx, rcx
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
cmp dword [rcx + 8], 0
setne al
mov ebp, edx
sar ebp, 0x1f
lea r12d, [rax + rax]
add r12d, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], r8
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [r14], rax
test rax, rax
jne 0x14005ac14
call fcn.140097db0
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [r14], rax
test rax, rax
jne 0x14005ac14
call fcn.140097db0
mov rsi, qword [r14]
test rsi, rsi
je 0x14005ac7e
mov rdi, qword [rsp + 0xd0]
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rsp + 0x48]
sub rcx, rsi
add rcx, qword [rsp + 0x38]
test rax, rax
cmove rcx, rax
mov qword [rdi], rcx
mov sil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012d670
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14005ac60

Function at 0x14005ade0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x14005ae5c
cmp r8, 1
jne 0x14005adf2
xor ecx, ecx
jmp 0x14005ae3e
mov r9, r8
and r9, 0xfffffffffffffffe
xor ecx, ecx
lea r10, [0x14016b180]
nop word cs:[rax + rax]
nop dword [rax]
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r9, rcx
jne 0x14005ae10
test r8b, 1
je 0x14005ae5c
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x14016b180]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret

Function at 0x14005b8b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401af6b8]
cmp ecx, 0xffffffff
je 0x14005b8d3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
jmp 0x14005b8d5
xor eax, eax
add rsp, 0x28
ret
Function at 0x14005b8e0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, rdx
mov r15, rcx
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, dword [0x1401af6b8]
cmp ecx, 0xffffffff
je 0x14005b915
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14005b91a
call fcn.14005bb30
mov eax, dword [0x1401b3fe8]
mov ecx, dword [0x1401b2730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005bae6
mov rbx, qword [0x1401b3fe0]
mov rcx, rbx
call fcn.140040a20
mov rcx, qword [0x1401b27d0]
add rcx, 1
mov edx, 0x100
lea rax, [0x1401b27e0]
nop word cs:[rax + rax]
nop
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14005b99a
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14005b99a
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x14005b970
jmp 0x14005b9bf
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1401b27d0], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
movabs r14, 0xaaaaaaaaaaaaaaaa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsp + 0x30], r14
mov edi, dword [r15]
cmp edi, 0xffffffff
je 0x14005b9ea
mov qword [rsp + 0x30], 0
jmp 0x14005ba52
mov ecx, 0xffffffff
call fcn.140025040
mov rdi, rax
mov ecx, 0xffffffff
call fcn.140025040
lea rdx, str.slot____kInvalidSlotValue
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rdi
call fcn.1400254a0
cmp qword [rsp + 0x30], 0
je 0x14005ba4f
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rdi, [rsp + 0x28]
lea r9, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x197
call fcn.140024f10
mov rcx, rdi
call fcn.140024ee0
mov rcx, rdi
call fcn.140024ef0
mov edi, dword [r15]
mov qword [rsp + 0x30], r14
cmp edi, 0xff
jg 0x14005ba6a
mov qword [rsp + 0x30], 0
jmp 0x14005bacc
mov ecx, 0x100
call fcn.140025040
mov rsi, rax
mov ecx, edi
call fcn.140025040
lea rdx, str.slot____kThreadLocalStorageSize
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rsi
call fcn.1400254a0
cmp qword [rsp + 0x30], 0
je 0x14005bacc
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x198
call fcn.140024f10
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012d670
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1401b3fe8]
call fcn.14012d420
cmp dword [0x1401b3fe8], 0xffffffff
jne 0x14005b93f
mov ecx, 8
call fcn.14012d2c8
mov rbx, rax
mov rcx, rax
call fcn.14003ad30
mov qword [0x1401b3fe0], rbx
lea rcx, [0x1401b3fe8]
call fcn.14012d4b8
jmp 0x14005b93f
Function at 0x14005bb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14012d600
sub rsp, rax
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1401af6b8]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x14005bc2a
lea rcx, [rsp + 0x2c]
call fcn.140098560
test al, al
jne 0x14005bbab
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea r9, str.PlatformThreadLocalStorage::AllocTLS_key_
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xd1
call fcn.140024e50
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x14005bc08
lea rcx, [rsp + 0x2c]
call fcn.140098560
test al, al
je 0x14005bbc9
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x14005bbfa
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea r9, str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xdb
call fcn.140024e50
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x1401af6b8], ecx
mov ecx, dword [rsp + 0x2c]
je 0x14005bc2a
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401af6b8]
mov dword [rsp + 0x2c], ecx
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
and esi, 3
je 0x14005bca8
xor ecx, ecx
call fcn.140025040
mov rdi, rax
mov ecx, esi
call fcn.140025040
lea rdx, str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rdi
call fcn.1400254a0
cmp qword [rsp + 0x30], 0
je 0x14005bcb1
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x20]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xed
call fcn.140024f10
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
jmp 0x14005bcb1
mov qword [rsp + 0x30], 0
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140130ac0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14012d33c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1401306b0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14012d670
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret

Function at 0x14005bdf0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401af6b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005be20
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14005be20
mov rax, qword [rax + rcx]
jmp 0x14005be22
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14005be30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401af6b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14005be58
test rdi, rdi
je 0x14005be71
call fcn.14005bb30
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140064340
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x1401af6a8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.MapImageToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1b
call fcn.14002c260
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.14003a130
mov rcx, rsi
call fcn.14003f5b0
test al, al
je 0x14006445e
lea rbx, [rsi + 0x40]
mov rcx, rsi
call fcn.14003f5c0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rbx
mov rdx, rax
call fcn.140005bca
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14006445e
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x14006445e
lea rcx, [0x14016bdc8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.14009b6b6
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.14003a270
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14012d670
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret