joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003d90
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003dc4
cmp word [rcx], 0x5a4d
jne 0x140003dc4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003dc4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003dc4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003cd0
test eax, eax
jne 0x140003de0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003d40
test rax, rax
je 0x140003dd5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004595
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004490
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004430
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004904
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140561558]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140561554]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004952
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000494a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004a39
inc ebx
add rax, 0x28
jmp 0x14000492a
mov rcx, r12
call fcn.140005131
mov rbp, rax
test rax, rax
jne 0x140004971
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400048a0
movsxd rbx, ebx
mov rax, qword [0x140561558]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.1400051df
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140561558]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400049d3
mov rax, qword [0x140561558]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400048a0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004a33
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004a33
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140561558]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004a33
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400048a0
inc dword [0x140561554]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004e60
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1405615c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1405615a0]
test rbx, rbx
je 0x140004eac
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004ea6
test eax, eax
jne 0x140004ea6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004e7e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140005060
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140005083
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140005083
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140005084
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x1400050be
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x1400050b5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400050c0
inc r8d
add rax, 0x28
jmp 0x14000509c
xor eax, eax
ret

Function at 0x140005131
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055d650]
mov r8, rcx
mov rcx, r9
call fcn.140005060
test eax, eax
je 0x14000515d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140005084
xor eax, eax
add rsp, 0x28
ret
Function at 0x140002f20
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rdx
mov r13, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rcx], 1
mov qword [rcx + 8], 0
mov byte [rcx + 0x10], 0
mov eax, dword [0x14016e328]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400030d1
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140003054
movsxd rcx, dword [0x14016e320]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14016e324]
jne 0x140003054
mov rdi, qword [rax + rcx]
test rdi, rdi
je 0x140003054
movabs r12, 0x6000000000000000
movabs r15, 0xffffffffffffff
mov rax, qword [rdi]
mov rbx, rax
and rbx, r15
and rax, r12
movabs rcx, 0x4000000000000000
cmp rax, rcx
jne 0x14000301a
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140003007
mov rsi, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov byte [r13 + 0x10], 1
movabs rsi, 0x8000000000000001
mov qword [r13 + 8], rbx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [fcn.14004bab0]
mov rax, qword [rbx]
lea rcx, [r14 + rsi]
cmp rcx, 2
jae 0x14000305b
add rsi, rax
cmp rsi, 1
ja 0x14000307d
cmp rax, r14
je 0x14000307d
int3
mov byte [r13], 0
jmp 0x1400030b1
xor ecx, ecx
mov rdx, rax
add rdx, r14
setns cl
movabs rdx, 0x7fffffffffffffff
add rdx, rcx
add rax, r14
cmovo rax, rdx
mov r14, rax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000309f
mov rsi, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
mov rax, qword [rdi]
and rax, r12
and r14, r15
or r14, rax
mov qword [rdi], r14
inc dword [rdi + 0x14]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007ed30
mov rax, r13
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14016e328]
int3

Function at 0x140003f30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14016c578]
cmp rsi, 1
jbe 0x140003f75
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140003fc7
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140003fc7
mov rax, qword [rax + rcx]
test rax, rax
je 0x140003fc7
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14016c578]
int3
int3
Function at 0x1400058a0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov ebx, dword [0x140171950]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test edi, edi
jne 0x140005985
cmp rbx, 1
je 0x1400058e3
mov eax, dword [rsi + 0x1518]
test eax, eax
je 0x1400058ea
xor eax, eax
jmp 0x14000597a
mov eax, 1
lock xadd dword [rsi + 0x1518], eax
cmp eax, 0x7fffffff
je 0x1400059d1
mov rcx, rsi
int3
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400058d3
int3

Function at 0x140005e00
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140005ebc
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140005e89
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140005e64
mov qword [rsi], rdi
call fcn.140042800
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x140005ec0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140042800
mov r14, qword [rsi]
mov rcx, qword [0x140170360]
test rcx, rcx
je 0x140005eae
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140005e52
int3
mov byte [rsi + 8], 1
int3

Function at 0x1400067c0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140006809
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140006827
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140006801
mov qword [rsi], rdi
call fcn.140042800
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov word [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14000685a
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140042800
mov r14, qword [rsi]
mov rcx, qword [0x140170360]
test rcx, rcx
je 0x14000684c
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400067ef
int3
int3
Function at 0x14000b100
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14000b12f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14000b132
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000b180
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14000b155
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14000b158
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b18f
xor esi, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007ed30
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x14000b1d4
cmp byte [rdi + 8], 0
jne 0x14000b1c0
mov rcx, qword [rdi]
jmp 0x14000b1c9
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
jne 0x14000b1a2
mov rcx, qword [rdi]
jmp 0x14000b1ab
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000b1d4
mov esi, dword [rsp + 0x24]
jmp 0x14000b1d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
int3
Function at 0x140034360
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x14016c490], 0
jne 0x140034594
mov rcx, qword [0x14016c488]
test rcx, rcx
je 0x14003445f
test byte [0x140167e98], 1
je 0x140034594
cmp byte [rcx + 0x17], 0
jns 0x1400343b7
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14016c490], rax
inc rax
cmp rax, 1
ja 0x140034594
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140081440
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140034592
cmp eax, 0x104
ja 0x140034592
mov rcx, qword [0x14016c488]
lea rdx, [rsp + 0x40]
int3
movabs r14, 0x7fffffffffffffef
mov ecx, 0x18
int3
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14007ed30
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140037540
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, r8
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov r13b, byte [0x1401688c0]
test r13b, 0x19
jne 0x14003773f
xor r14d, r14d
mov r15, r12
cmp qword [rsi + 0x38], 0
jne 0x140037686
mov eax, dword [0x14016c560]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400376b9
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400375f9
movsxd rcx, dword [0x14016c558]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14016c55c]
jne 0x1400375f9
mov rax, qword [rax + rcx]
test rax, rax
je 0x1400375f9
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x60], rcx
mov eax, dword [rax + 8]
mov dword [rsi + 0x58], eax
mov eax, dword [0x14016c550]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400376fc
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140037686
movsxd rcx, dword [0x14016c548]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14016c54c]
jne 0x140037686
mov rax, qword [rax + rcx]
test rax, rax
je 0x140037686
cmp dword [rax + 0x68], 0xf00dbaad
je 0x140037811
mov rcx, qword [rax + 0x20]
mov qword [rsi + 0x38], rcx
movups xmm0, xmmword [rax + 0x38]
mov rcx, qword [rax + 0x48]
mov qword [rsi + 0x50], rcx
movups xmmword [rsi + 0x40], xmm0
cmp byte [rax + 0x6c], 0
jne 0x1400376b5
cmp qword [rax + 0x50], 0
setne al
mov byte [rsi + 0x6c], al
test r13b, 0x19
jne 0x1400377f4
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14007ed30
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 1
jmp 0x140037683
lea rcx, [0x14016c560]
int3
lea rcx, [0x14016c550]
int3
mov rbx, r9
mov rdi, rdx
mov eax, dword [rsi + 0x68]
shl rax, 0x20
mov r14d, ecx
or r14, rax
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rsp + 0x54], eax
lea r15, [rsp + 0x58]
mov qword [r15], r12
mov rcx, r15
int3
cmp byte [r14], 0
je 0x140037690
mov rcx, r14
mov rdx, r12
mov r8, r15
call fcn.1400761e0
jmp 0x140037690
cmp qword [rax + 8], 0
je 0x140037823
cmp qword [rax + 0x10], 0
jne 0x14003765d
cmp qword [rax + 0x20], 0
jne 0x14003765d
jmp 0x140037686
Function at 0x140038380
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movapd xmmword [rsp + 0x120], xmm10
movapd xmmword [rsp + 0x110], xmm9
movaps xmmword [rsp + 0x100], xmm8
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
test byte [0x140167f80], 0x19
jne 0x140038b6c
mov rcx, qword [rsi + 0x60]
test rcx, rcx
jne 0x140038ff6
mov rcx, qword [rsi + 0x48]
mov rdx, rsi
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140167ee0]
lea r14, [0x1400347e0]
cmp rax, r14
jne 0x140038f01
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x140038cb1
imul rax, rax, 0xf4240
cqo
idiv qword [0x14016c648]
jmp 0x140038cd3
mov rcx, qword [0x14016c648]
cqo
idiv rcx
imul rbp, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbp
mov qword [rsp + 0x90], rax
lea rbp, [rsp + 0x90]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x40], 0
lea rdx, [0x140167f80]
lea r8, str.WorkerThread_born
mov cl, 0x49
xor r9d, r9d
call fcn.14003b8f0
test byte [0x140167f80], 0x19
je 0x1400383ec
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140167ee0]
cmp rax, r14
jne 0x140038f10
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x140038d86
imul rax, rax, 0xf4240
cqo
idiv qword [0x14016c648]
jmp 0x140038da8
mov rcx, qword [0x14016c648]
cqo
idiv rcx
imul rbx, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x140167f80]
lea r8, str.WorkerThread_active
mov cl, 0x42
xor r9d, r9d
call fcn.14003b8f0
jmp 0x1400383ec
lea rcx, [rsp + 0x90]
call rax
jmp 0x140038cdb
lea rcx, [rsp + 0x90]
call rax
jmp 0x140038db0
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400383f9
Function at 0x140043380
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14016c568]
cmp rdi, 1
jbe 0x1400433dd
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400433c6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400433d5
lock sub dword [rcx + 8], 1
je 0x140043432
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c568]
int3
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140043280

Function at 0x1400436d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x1400436e6
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov rdi, qword [0x14016c568]
cmp rdi, 1
jbe 0x140043775
lea rbx, [rsi + 8]
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14004380b
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rbx
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [0x14016c578]
cmp rdi, 1
jbe 0x1400437c2
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14004381e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c568]
int3
lea rcx, [0x14016c578]
int3
test rbx, rbx
je 0x14004372a
call fcn.140006690
jmp 0x140043711
test rsi, rsi
je 0x14004376a
call fcn.140006690
jmp 0x140043751

Function at 0x140044450
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1401719f0]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400444b2
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400444ee
movsxd rcx, dword [0x1401719e8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1401719ec]
jne 0x1400444ee
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401719f0]
int3
xor eax, eax
jmp 0x1400444a6
Function at 0x140054a80
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x18], 0
je 0x140054b41
mov eax, dword [0x1401720d8]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054ba5
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [0x1401720d8]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054be8
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140054b35
movsxd rcx, dword [0x1401720d0]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x1401720d4]
movsxd rdx, dword [0x1401720d0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
jne 0x140054b5f
cmp qword [rsi], 0
jne 0x140054b93
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007ed30
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r14, [rsp + 0x28]
mov r9, qword [rbx + 0x30]
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rbx + 0x28], 0
mov rax, qword [rcx]
lea rdx, [rbx + 8]
mov r8, r14
call qword [rax]
add rbx, 0x38
cmp rbx, rdi
je 0x140054b41
jmp 0x140054b64
mov rcx, rsi
int3
lea rcx, [0x1401720d8]
int3
lea rcx, [0x1401720d8]
int3

Function at 0x1400571c0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.140058020
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x1400573e5
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x28], rbx
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x14005741b
lea rdx, [0x14011dcca]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005742e
mov rbx, rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call rax
mov r12, rax
movsxd rbp, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test rbp, rbp
je 0x140057436
test ebp, ebp
js 0x14005743d
shl rbp, 3
lea rsi, [rbp*2]
add rsi, rbp
mov rcx, rsi
int3
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
int3
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14007ed30
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140057278
xor r12d, r12d
jmp 0x14005727b
xor ebx, ebx
jmp 0x14005737c
lea rcx, [rsp + 0x30]
int3