joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077a7f
Capabilities:
Get session information

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x140077b44
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rcx, [rsp + 0x44]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140077b44
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x38]
mov qword [r14], rax
mov rdi, qword [rsp + 0x48]
mov ecx, 0x30
call fcn.140112048
mov rbx, rax
lea rdx, [0x140078d60]
lea r8, [0x140059040]
mov rcx, rax
call fcn.1400cb810
lea rax, [sub.WTSAPI32.dll_WTSFreeMemory]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rbx
mov rcx, r14
call fcn.1400b02e0
cmp dword [rsp + 0x44], 0xd7
ja 0x140077b4d
mov qword [rsi], 0
jmp 0x140077b8a
mov qword [rsi], 0
jmp 0x140077b94
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rdx + 0xc8]
mov eax, dword [rdx + 0xcc]
cmp qword [rdx + 0xc8], 0
jne 0x140077b79
cmp dword [rdx], 1
jne 0x140077b79
mov ecx, dword [rdx + 0xb0]
mov eax, dword [rdx + 0xb4]
shl rax, 0x20
mov edx, ecx
or rdx, rax
mov rcx, rsi
call fcn.1401632e0
lea rcx, [rsp + 0x38]
call fcn.1400bc050
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140115e50
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400940d0
Capabilities:
Acquire debug privileges

Disassembly:
push rsi
push rbx
sub rsp, 0x198
mov ebx, ecx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rsi, [rsp + 0x178]
mov qword [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400941cf
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14009421f
lea r8, [rsp + 0x180]
mov dword [r8], 1
mov rax, qword [rsp + 0x30]
mov qword [r8 + 4], rax
movzx eax, bl
add eax, eax
mov dword [r8 + 0xc], eax
mov rcx, qword [rsp + 0x178]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140094276
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140094276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_process_terminator_work_item.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x77
mov r9d, 1
call fcn.14019f9e0
lea rcx, [rsp + 0x48]
lea rdx, str._System::AdjustPrivilege___failed_to_AdjustTokenPrivileges
jmp 0x140094263
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140094276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_process_terminator_work_item.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x66
mov r9d, 1
call fcn.14019f9e0
lea rcx, [rsp + 0x48]
lea rdx, str._System::AdjustPrivilege___failed_to_OpenProcessToken_
mov r8d, 0x36
jmp 0x140094269
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140094276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_process_terminator_work_item.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x6c
mov r9d, 1
call fcn.14019f9e0
lea rcx, [rsp + 0x48]
lea rdx, str._System::AdjustPrivilege___failed_to_LookupPrivilegeValue_
mov r8d, 0x3a
call fcn.1400ff874
mov rcx, rsi
call fcn.140183e60
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140115e50
nop
add rsp, 0x198
pop rbx
pop rsi
ret
Function at 0x140098274
Capabilities:
Delete service

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x190
mov rbx, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x14009837b
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
jne 0x14009835e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140098353
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x48]
mov r8d, 0x283
mov r9d, 1
call fcn.14019f9e0
lea rcx, [rsp + 0x58]
lea rdx, str.DeleteService_failed
mov r8d, 0x15
call fcn.1400ff874
mov rdi, rax
lea rbp, [rsp + 0x30]
mov rcx, rbx
mov rdx, rbp
call fcn.140098062
cmp byte [rbp + 0x17], 0
jns 0x14009832d
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
mov rdx, rbp
call fcn.1401c8da0
cmp byte [rsp + 0x47], 0
jns 0x140098349
mov rcx, qword [rsp + 0x30]
call fcn.140112038
lea rcx, [rsp + 0x48]
call fcn.140183e60
cmp r14d, 0x430
sete dil
cmp qword [rsi], 0
je 0x14009837d
call fcn.1400bb620
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsi], 0
jmp 0x14009837d
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
add rsp, 0x190
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140098b16
Capabilities:
Create service
Modify service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rdx + 0x28]
xor r14d, r14d
cmp rax, qword [rdx + 0x30]
cmovne r14, rax
cmp byte [rdx + 0x27], 0
jns 0x140098b59
mov r15, qword [rdx + 0x10]
jmp 0x140098b5d
lea r15, [rdx + 0x10]
mov r13d, dword [rdx + 0xc]
mov r12d, dword [rdx + 4]
mov ebp, dword [rdx + 8]
lea rbx, [rsp + 0x70]
mov rcx, rsi
mov rdx, rbx
call fcn.140098062
cmp byte [rbx + 0x17], 0
jns 0x140098b83
mov rbx, qword [rsp + 0x70]
lea r8, [rsi + 0x20]
cmp byte [rsi + 0x37], 0
jns 0x140098b90
mov r8, qword [r8]
lea rdx, str._ls___ls_
lea rdi, [rsp + 0x1b0]
mov rcx, rdi
mov r9, rbx
call fcn.14000acc0
cmp byte [rsp + 0x87], 0
jns 0x140098bbe
mov rcx, qword [rsp + 0x70]
call fcn.140112038
cmp byte [rsp + 0x1c7], 0
jns 0x140098bd0
mov rdi, qword [rsp + 0x1b0]
lea rbx, [rsp + 0x70]
mov rcx, rsi
mov rdx, rbx
call fcn.140098062
cmp byte [rbx + 0x17], 0
jns 0x140098beb
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsi + 0xe0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], r14
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov r8, rdi
mov r9d, 0x10003
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rcx, [rsp + 0x1c8]
mov qword [rcx], 0
mov rdx, rax
call fcn.140097dee
cmp byte [rsp + 0x87], 0
jns 0x140098c54
mov rcx, qword [rsp + 0x70]
call fcn.140112038
cmp byte [rsp + 0x1c7], 0
jns 0x140098c6b
mov rcx, qword [rsp + 0x1b0]
call fcn.140112038
mov rdi, qword [rsp + 0x1c8]
test rdi, rdi
je 0x140098c8b
cmp byte [rsi + 0x4f], 0
jns 0x140098d30
mov rax, qword [rsi + 0x38]
jmp 0x140098d34
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140098d61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x70]
mov r8d, 0x25f
mov r9d, 1
call fcn.14019f9e0
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_create_service
mov r8d, 0x19
call fcn.1400ff874
mov r14, rax
lea rbx, [rsp + 0x1b0]
mov rcx, rsi
mov rdx, rbx
call fcn.140098062
cmp byte [rbx + 0x17], 0
jns 0x140098d02
mov rbx, qword [rsp + 0x1b0]
mov rcx, r14
mov rdx, rbx
call fcn.1401c8da0
cmp byte [rsp + 0x1c7], 0
jns 0x140098d24
mov rcx, qword [rsp + 0x1b0]
call fcn.140112038
lea rcx, [rsp + 0x70]
call fcn.140183e60
jmp 0x140098d61
lea rax, [rsi + 0x38]
lea r8, [rsp + 0x70]
mov qword [r8], rax
mov rcx, rdi
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
add rsi, 0xe8
call fcn.1400bb620
mov rcx, rsi
mov rdx, rdi
call fcn.140097dee
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140098d8e
Capabilities:
Modify service

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b8
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x28]
xor ebx, ebx
cmp rax, qword [rdx + 0x30]
cmovne rbx, rax
cmp byte [rdx + 0x27], 0
jns 0x140098dc9
mov rdi, qword [rdx + 0x10]
jmp 0x140098dcd
lea rdi, [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov eax, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [rsi + 0xe8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rbx
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x50], 0
mov edx, eax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x140098ea8
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140098ea8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x70]
mov r8d, 0x275
mov r9d, 1
call fcn.14019f9e0
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_change_service_config
mov r8d, 0x20
call fcn.1400ff874
mov r14, rax
lea rbx, [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
call fcn.140098062
cmp byte [rbx + 0x17], 0
jns 0x140098e82
mov rbx, qword [rsp + 0x58]
mov rcx, r14
mov rdx, rbx
call fcn.1401c8da0
cmp byte [rsp + 0x6f], 0
jns 0x140098e9e
mov rcx, qword [rsp + 0x58]
call fcn.140112038
lea rcx, [rsp + 0x70]
call fcn.140183e60
test edi, edi
setne bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14009dc28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r15, rdx
mov rdi, rcx
mov eax, dword [0x14031de6c]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009dcf3
lea rcx, [rdi + 4]
mov eax, 0xffffffff
cmp rcx, r15
jae 0x14009dcc0
mov esi, 0xffffffff
mov ecx, 0xff
lea rbx, [0x14031ce6c]
xor esi, dword [rdi]
mov edx, esi
and edx, ecx
mov eax, esi
shr eax, 8
and eax, ecx
mov eax, dword [rbx + rax*4 + 0x800]
xor eax, dword [rbx + rdx*4 + 0xc00]
mov edx, esi
shr edx, 0x10
and edx, ecx
xor eax, dword [rbx + rdx*4 + 0x400]
shr esi, 0x18
xor eax, dword [rbx + rsi*4]
lea rdx, [rdi + 4]
add rdi, 8
mov esi, eax
cmp rdi, r15
mov rdi, rdx
jb 0x14009dc7d
jmp 0x14009dcc3
mov rdx, rdi
cmp rdx, r15
je 0x14009dce5
lea rcx, [0x14031ce6c]
movzx ebx, byte [rdx]
movzx edi, al
xor edi, ebx
shr eax, 8
xor eax, dword [rcx + rdi*4]
inc rdx
cmp r15, rdx
jne 0x14009dccf
not eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x14031de6c]
call fcn.1401120e4
cmp dword [0x14031de6c], 0xffffffff
jne 0x14009dc5e
lea r14, [0x14031ce6c]
xor ebx, ebx
mov r8d, 0x1000
mov rcx, r14
xor edx, edx
call fcn.140117f60
mov eax, 8
mov ecx, ebx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
dec eax
jne 0x14009dd2c
mov dword [r14 + rbx*4], ecx
inc rbx
cmp rbx, 0x100
jne 0x14009dd25
mov rax, 0xfffffffffffffc00
mov ecx, 0xff
mov edx, dword [rax + r14 + 0x400]
movzx ebx, dl
shr edx, 8
xor edx, dword [r14 + rbx*4]
mov dword [rax + r14 + 0x800], edx
mov ebx, edx
shr ebx, 8
and edx, ecx
xor ebx, dword [r14 + rdx*4]
mov dword [rax + r14 + 0xc00], ebx
mov edx, ebx
shr edx, 8
and ebx, ecx
xor edx, dword [r14 + rbx*4]
mov dword [rax + r14 + 0x1000], edx
add rax, 4
jne 0x14009dd5d
lea rcx, [0x14031de6c]
call fcn.140112084
jmp 0x14009dc5e

Function at 0x14009f420
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x14031deb8], 0
jne 0x14009f45d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14009f450
mov dword [rdi], eax
mov dword [0x14031dec0], eax
mov qword [0x14031deb8], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x1400ba9f0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140314ea8]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400baa47
jnp 0x1400baaac
ucomisd xmm0, xmm6
jne 0x1400baa53
jnp 0x1400babe6
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1402a8570]
subpd xmm1, xmmword [0x1402a8580]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1402bc3b0]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140115e50
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140314eb8]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400babed
mov eax, dword [0x140314ec8]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400bac27
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x140314ec0]
movq xmm0, rbp
punpckldq xmm0, xmmword [0x1402a8570]
subpd xmm0, xmmword [0x1402a8580]
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1402bd748]
ucomisd xmm2, xmm1
ja 0x1400baa47
shl r15, 0x20
or r14, r15
sub r14, qword [0x140314eb0]
movq xmm2, r14
punpckldq xmm2, xmmword [0x1402a8570]
subpd xmm2, xmmword [0x1402a8580]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x140314ea8], xmm0
jmp 0x1400baa47
xor eax, eax
jmp 0x1400baa85
lea rcx, [0x140314eb8]
call fcn.1401120e4
cmp dword [0x140314eb8], 0xffffffff
jne 0x1400baaf6
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140314eb0], rdx
lea rcx, [0x140314eb8]
call fcn.140112084
jmp 0x1400baaf6
lea rcx, [0x140314ec8]
call fcn.1401120e4
cmp dword [0x140314ec8], 0xffffffff
jne 0x1400bab1b
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x140314ec0], rax
lea rcx, [0x140314ec8]
call fcn.140112084
jmp 0x1400bab1b
Function at 0x1400bc1a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140314cf8]
cmp rdi, 1
jbe 0x1400bc1fd
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bc1e6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400bc1f5
lock sub dword [rcx + 8], 1
je 0x1400bc252
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140314cf8]
call fcn.1400c4120
test al, al
je 0x1400bc246
mov qword [0x140314d00], 0
lea rbx, [0x140314cf8]
lea rdi, [0x140314d00]
mov rcx, rdi
xor edx, edx
call fcn.1400bc270
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400c4100
jmp 0x1400bc1b7
mov rdi, qword [0x140314cf8]
jmp 0x1400bc1b7
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400bc0a0
Function at 0x1400bc270
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1040
call fcn.140115de0
sub rsp, rax
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x1038], rax
mov eax, 0xffffffff
mov qword [rcx], rax
mov ecx, dword [0x140310d60]
cmp ecx, 0xffffffff
je 0x1400bc2b9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400bc334
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140310d60]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400bc421
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400bc4e3
lea rbx, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call fcn.140117f60
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
mov rsi, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rsi
mov ecx, 0x1000
call fcn.140112618
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rbx
call fcn.1401178b0
mov ecx, dword [rsp + 0x2c]
or rdi, 3
mov rdx, rdi
call rsi
mov eax, dword [0x1403196f8]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400bc48a
mov rbx, qword [0x1403196f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400bc4d0
mov rcx, qword [0x140317ee0]
inc rcx
mov edx, 0x100
lea rax, [0x140317ef0]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x1400bc3ba
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x1400bc3ba
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x1400bc390
jmp 0x1400bc3df
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x140317ee0], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x1400bc4dd
cmp eax, 0x100
jge 0x1400bc4e0
mov rcx, qword [rsp + 0x1038]
xor rcx, rsp
call fcn.140115e50
mov rax, r15
add rsp, 0x1040
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [rsp + 0x2c]
call fcn.140146450
test al, al
je 0x1400bc4e6
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x1400bc464
mov eax, 0xffffffff
lock cmpxchg dword [0x140310d60], ecx
je 0x1400bc2d4
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x140310d60]
mov dword [rsp + 0x2c], ecx
jmp 0x1400bc2d4
lea rcx, [rsp + 0x2c]
call fcn.140146450
test al, al
je 0x1400bc4e9
cmp dword [rsp + 0x2c], 0xffffffff
je 0x1400bc4e9
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rsp + 0x2c]
jmp 0x1400bc43c
lea rcx, [0x1403196f8]
call fcn.1401120e4
cmp dword [0x1403196f8], 0xffffffff
jne 0x1400bc359
mov ecx, 8
call fcn.140112048
mov rdi, rax
mov rcx, rax
call fcn.1400d7cd0
mov qword [0x1403196f0], rdi
lea rcx, [0x1403196f8]
call fcn.140112084
jmp 0x1400bc359
mov rcx, rbx
call fcn.1400bb6f0
jmp 0x1400bc371
int3
int3
int3
int3
int3
Function at 0x1400bc4f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x1400bc506
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov rdi, qword [0x140314cf8]
cmp rdi, 1
jbe 0x1400bc595
lea rbx, [rsi + 8]
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bc62b
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rbx
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [0x140314d08]
cmp rdi, 1
jbe 0x1400bc5e2
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bc63e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140314cf8]
call fcn.1400c4120
test al, al
je 0x1400bc651
mov qword [0x140314d00], 0
lea rbx, [0x140314cf8]
lea rdi, [0x140314d00]
mov rcx, rdi
xor edx, edx
call fcn.1400bc270
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400c4100
jmp 0x1400bc517
lea rcx, [0x140314d08]
call fcn.1400c4120
test al, al
je 0x1400bc65d
mov qword [0x140314d10], 0
lea rbx, [0x140314d08]
lea rdi, [0x140314d10]
mov rcx, rdi
xor edx, edx
call fcn.1400bc270
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400c4100
jmp 0x1400bc55b
test rbx, rbx
je 0x1400bc54a
call fcn.1400086f0
jmp 0x1400bc531
test rsi, rsi
je 0x1400bc58a
call fcn.1400086f0
jmp 0x1400bc571
mov rdi, qword [0x140314cf8]
jmp 0x1400bc517
mov rdi, qword [0x140314d08]
jmp 0x1400bc55b

Function at 0x1400bd250
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14031c750]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400bd2b2
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bd2ee
movsxd rcx, dword [0x14031c748]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14031c74c]
jne 0x1400bd2ee
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14031c750]
call fcn.1401120e4
cmp dword [0x14031c750], 0xffffffff
jne 0x1400bd279
mov qword [0x14031c748], 0
lea rcx, [0x14031c748]
xor edx, edx
call fcn.1400bc270
lea rcx, [0x14031c750]
call fcn.140112084
jmp 0x1400bd279
xor eax, eax
jmp 0x1400bd2a6
Function at 0x1400be1e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140319768]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400be2bc
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400be2ff
movsxd rcx, dword [0x140319760]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140319764]
jne 0x1400be2ff
mov rdi, qword [rax + rcx]
cmp byte [rsi], 0
jne 0x1400be251
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rdi]
test rax, rax
js 0x1400be306
cmp dword [rdi + 0x14], 1
jne 0x1400be310
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x1400be34f
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov rsi, qword [rsi + 8]
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x1400be36d
mov rax, qword [rdi]
movabs rcx, 0x6000000000000000
and rcx, rax
movabs rax, 0xffffffffffffff
and rsi, rax
or rsi, rcx
mov qword [rdi], rsi
add dword [rdi + 0x14], 0xffffffff
jmp 0x1400be249
lea rcx, [0x140319768]
call fcn.1401120e4
cmp dword [0x140319768], 0xffffffff
jne 0x1400be20f
mov qword [0x140319760], 0
lea rcx, [0x140319760]
xor edx, edx
call fcn.1400bc270
lea rcx, [0x140319768]
call fcn.140112084
jmp 0x1400be20f
xor edi, edi
jmp 0x1400be244
call fcn.140205350
jmp 0x1400be25d
cmp byte [rsi + 0x10], 0
je 0x1400be282
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400be33c
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0x4000000000000000
lock or qword [rdi], rax
jmp 0x1400be282
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x1400be274
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x1400be293