joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e2e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov edi, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [0x140141df0]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x88
call fcn.140006710
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140019a90
test edi, edi
js 0x14009e414
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rcx, qword [0x140169430]
test rcx, rcx
jne 0x14009e3ee
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0xaaaaaaaa
mov rcx, qword [rsi]
mov qword [rsp + 0x20], 0
mov rdx, r15
mov r8d, edi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rbx]
cmp qword [rsp + 0x40], 0
jne 0x14009e41b
test byte [0x140164f10], 0x19
jne 0x14009e439
lea rcx, [rsp + 0x60]
call fcn.140018d20
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140107cc0
mov eax, esi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x14009e383
mov r9d, edi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.14009b110
jmp 0x14009e383
mov esi, 0xffffffff
jmp 0x14009e3ba
mov rcx, qword [0x140169430]
test rcx, rcx
je 0x14009e3ba
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x14009e3ba
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 0
lea rdx, [0x140164f10]
lea r8, [0x14014948f]
mov cl, 0x45
xor r9d, r9d
call fcn.14009e020
jmp 0x14009e3c3
Function at 0x14009e470
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rdi, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x140141df0]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r9d, 0x9c
call fcn.140006710
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
call fcn.140019a90
mov qword [rsi + 8], r14
mov qword [rsi], 0
mov rcx, qword [0x140169430]
test rcx, rcx
jne 0x14009e55f
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, qword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, eax
mov rbx, qword [rbx]
cmp qword [rsp + 0x40], 0
jne 0x14009e585
test byte [0x140164f10], 0x19
jne 0x14009e5a6
xor esi, esi
cmp edi, 1
sbb rsi, rsi
or rsi, rbx
lea rcx, [rsp + 0x60]
call fcn.140018d20
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140107cc0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x14009e500
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x40]
mov r8, rdi
xor r9d, r9d
call fcn.14009b110
jmp 0x14009e500
mov rcx, qword [0x140169430]
test rcx, rcx
je 0x14009e521
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x14009e521
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0
lea rdx, [0x140164f10]
lea r8, [0x14014948f]
mov cl, 0x45
xor r9d, r9d
call fcn.14009e020
jmp 0x14009e52a

Function at 0x1400a39a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140166310]
cmp ecx, 0xffffffff
je 0x1400a39c5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400a39c0
Function at 0x1400af7c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [0x14016bab0]
cmp rdi, 1
jbe 0x1400af808
mov ecx, dword [0x140166310]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400af83e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14016bab0]
call fcn.14000c730
test al, al
je 0x1400af84a
mov eax, 0xffffffff
mov qword [0x14016bab8], rax
lea rdi, [0x14016bab8]
mov rcx, rdi
xor edx, edx
call fcn.14002ec50
mov qword [0x14016bab0], rdi
jmp 0x1400af7d6
test rsi, rsi
je 0x1400af801
call fcn.140021dc0
jmp 0x1400af7e8
mov rdi, qword [0x14016bab0]
jmp 0x1400af7d6

Function at 0x1400afc20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
mov r9, qword [rcx]
mov rdx, qword [rcx + 8]
mov r8, rdx
sub r8, r9
je 0x1400afc48
mov rax, r8
shr rax, 2
mov rsi, r9
not rsi
add rsi, rdx
jne 0x1400afc4c
xor edx, edx
jmp 0x1400afc90
xor eax, eax
jmp 0x1400afcad
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
mov r11d, 0xff
lea rsi, [0x1401551e0]
mov edi, eax
and edi, r11d
movzx ebx, byte [r9 + rdx]
xor ebx, edi
shr eax, 8
xor eax, dword [rsi + rbx*4]
mov edi, eax
and edi, r11d
movzx ebx, byte [r9 + rdx + 1]
xor ebx, edi
shr eax, 8
xor eax, dword [rsi + rbx*4]
add rdx, 2
cmp r10, rdx
jne 0x1400afc62
test r8b, 1
je 0x1400afcad
movzx ebx, al
movzx edx, byte [r9 + rdx]
xor edx, ebx
lea rbx, [0x1401551e0]
shr eax, 8
xor eax, dword [rbx + rdx*4]
cmp eax, dword [rcx + 0x18]
sete al
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400c0d50
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
movsxd r10, dword [rcx + 8]
movsxd r9, dword [rdx + 8]
cmp r10d, r9d
jge 0x1400c0d8d
mov rax, qword [rdx]
mov r11d, r9d
sub r11d, r10d
mov rdi, r10
not rdi
add rdi, r9
and r11d, 7
cmp rdi, 7
jae 0x1400c0e9a
xor r8d, r8d
mov rsi, r10
jmp 0x1400c0ede
xor r8d, r8d
cmp r9d, r10d
jge 0x1400c0df2
mov r11, qword [rcx]
mov edi, r10d
sub edi, r9d
mov rsi, r9
not rsi
add rsi, r10
mov rax, r9
and rdi, 7
je 0x1400c0dbc
or r8, qword [r11 + rax*8]
inc rax
dec rdi
jne 0x1400c0db0
cmp rsi, 7
jb 0x1400c0df2
or r8, qword [r11 + rax*8]
or r8, qword [r11 + rax*8 + 8]
or r8, qword [r11 + rax*8 + 0x10]
or r8, qword [r11 + rax*8 + 0x18]
or r8, qword [r11 + rax*8 + 0x20]
or r8, qword [r11 + rax*8 + 0x28]
or r8, qword [r11 + rax*8 + 0x30]
or r8, qword [r11 + rax*8 + 0x38]
add rax, 8
cmp r10, rax
jne 0x1400c0dc2
cmp r10d, r9d
cmovl r9d, r10d
test r9d, r9d
jle 0x1400c0e83
mov r10, qword [rcx]
mov r11, qword [rdx]
mov r14d, r9d
lea rax, [r14 - 1]
mov r9d, r14d
and r9d, 3
cmp rax, 3
jae 0x1400c0e20
xor eax, eax
jmp 0x1400c0e61
and r14d, 0xfffffffc
xor eax, eax
mov rdi, qword [r11 + rax*8]
mov rbx, qword [r11 + rax*8 + 8]
xor rdi, qword [r10 + rax*8]
xor rbx, qword [r10 + rax*8 + 8]
or rdi, r8
mov rsi, qword [r11 + rax*8 + 0x10]
xor rsi, qword [r10 + rax*8 + 0x10]
or rsi, rbx
mov r8, qword [r11 + rax*8 + 0x18]
xor r8, qword [r10 + rax*8 + 0x18]
or rsi, rdi
or r8, rsi
add rax, 4
cmp r14, rax
jne 0x1400c0e26
test r9, r9
je 0x1400c0e83
lea r11, [r11 + rax*8]
lea rax, [r10 + rax*8]
xor esi, esi
mov rdi, qword [r11 + rsi*8]
xor rdi, qword [rax + rsi*8]
or r8, rdi
inc rsi
cmp r9, rsi
jne 0x1400c0e70
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdi, r9
sub rdi, r10
and rdi, 0xfffffffffffffff8
neg rdi
xor r8d, r8d
mov rsi, r10
or r8, qword [rax + rsi*8]
or r8, qword [rax + rsi*8 + 8]
or r8, qword [rax + rsi*8 + 0x10]
or r8, qword [rax + rsi*8 + 0x18]
or r8, qword [rax + rsi*8 + 0x20]
or r8, qword [rax + rsi*8 + 0x28]
or r8, qword [rax + rsi*8 + 0x30]
or r8, qword [rax + rsi*8 + 0x38]
add rsi, 8
add rdi, 8
jne 0x1400c0ead
test r11, r11
je 0x1400c0d90
lea rax, [rax + rsi*8]
xor esi, esi
or r8, qword [rax + rsi*8]
inc rsi
cmp r11, rsi
jne 0x1400c0eed
jmp 0x1400c0d90
Function at 0x1400c3390
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x140141df0]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0xc0], xmm0
movaps xmmword [rdi + 0xb0], xmm0
movaps xmmword [rdi + 0xa0], xmm0
movaps xmmword [rdi + 0x90], xmm0
movaps xmmword [rdi + 0x80], xmm0
movaps xmmword [rdi + 0x70], xmm0
movaps xmmword [rdi + 0x60], xmm0
movaps xmmword [rdi + 0x50], xmm0
movaps xmm0, xmmword [0x14014d6a0]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x14014d6b0]
movaps xmmword [rdi + 0x10], xmm0
movaps xmm0, xmmword [0x14014d6c0]
movaps xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x14014d6d0]
movaps xmmword [rdi + 0x30], xmm0
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movaps xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.14005c520
mov rcx, rsi
mov rdx, rdi
call fcn.14005c870
mov r8d, 0xd8
mov rcx, rdi
xor edx, edx
call fcn.14010a410
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140107cc0
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret

Function at 0x1400c6b10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140102e80]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14016c088]
lea rdx, [0x140102e70]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400c6bf1
cmp dword [0x14016c090], 0
jne 0x1400c6bb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [0x14016c094]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1400c6bb6
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400c6bb6
mov eax, dword [rsi + 0x200]
xor edi, edi
cmp dword [rsi + 0x204], eax
je 0x1400c6ba0
shl rax, 5
mov edi, dword [rsi + rax + 0x10]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140107cc0
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 0x210
call fcn.14004bd80
test rax, rax
je 0x1400c6bf6
mov rsi, rax
xor edi, edi
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.14010a410
lea r8, [0x140102940]
xor ecx, ecx
mov rdx, rsi
call fcn.14002a830
test eax, eax
jne 0x1400c6b88
jmp 0x1400c6ba0
call fcn.140106230
xor edi, edi
jmp 0x1400c6ba0
Function at 0x1400c7660
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov r15, r8
mov r12, rdx
mov r14, rcx
mov eax, dword [rsp + 0xe0]
mov rcx, qword [0x140163028]
xor rcx, rsp
mov qword [rsp + 0x78], rcx
movsxd r8, dword [r14 + 0x18]
lea ecx, [rax + 4]
mov esi, ecx
shr esi, 6
xor edx, edx
mov ebx, 0
cmp rsi, r8
jae 0x1400c76b6
mov rbx, qword [r9 + rsi*8]
shr rbx, cl
shl ebx, 5
and ebx, 0x20
lea ecx, [rax + 3]
mov edi, ecx
shr edi, 6
cmp rdi, r8
jae 0x1400c76d0
mov rdx, qword [r9 + rdi*8]
shr rdx, cl
shl edx, 4
and edx, 0x10
or edx, ebx
lea ecx, [rax + 2]
mov edi, ecx
shr edi, 6
xor ebx, ebx
mov esi, 0
cmp rdi, r8
jae 0x1400c76f3
mov rsi, qword [r9 + rdi*8]
shr rsi, cl
shl esi, 3
and esi, 8
or edx, esi
lea ecx, [rax + 1]
mov edi, ecx
shr edi, 6
cmp rdi, r8
jae 0x1400c770f
mov rbx, qword [r9 + rdi*8]
shr rbx, cl
shl ebx, 2
and ebx, 4
or edx, ebx
mov ecx, eax
shr ecx, 6
xor ebx, ebx
cmp rcx, r8
jae 0x1400c772b
mov rbx, qword [r9 + rcx*8]
mov ecx, eax
shr rbx, cl
add ebx, ebx
and ebx, 2
or edx, ebx
test eax, eax
je 0x1400c774d
dec eax
mov ecx, eax
shr ecx, 6
xor ebx, ebx
cmp rcx, r8
jae 0x1400c774b
mov rbx, qword [r9 + rcx*8]
mov ecx, eax
shr rbx, cl
and ebx, 1
or edx, ebx
mov edi, edx
shr rdi, 5
lea eax, [rdi - 1]
neg rdi
and eax, edx
xor edx, 0x3f
mov ebx, edi
and ebx, edx
or ebx, eax
mov rax, rbx
shr rax, 1
and ebx, 1
add rbx, rax
xor esi, esi
mov r8d, 0xd8
mov rcx, r12
xor edx, edx
call fcn.14010a410
mov r13, rbx
not r13
mov r8, rsi
xor r8, rbx
dec r8
and r8, r13
sar r8, 0x3f
mov qword [rsp + 0x20], r12
mov rcx, r14
mov rdx, r12
mov r9, r15
call fcn.1400c7180
inc rsi
add r15, 0xd8
cmp rsi, 0x11
jne 0x1400c7788
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx + 0x40], rax
movaps xmm0, xmmword [0x140141df0]
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [r12 + 0x48]
mov rcx, r14
call fcn.1400c78a0
movsxd rcx, dword [r14 + 0x40]
test rcx, rcx
je 0x1400c7876
and edi, 1
mov rax, rdi
neg rax
dec rdi
test rcx, rcx
mov r8d, 1
cmovne r8, rcx
cmp ecx, 1
jne 0x1400c781c
xor ecx, ecx
jmp 0x1400c785e
mov rdx, r8
and rdx, 0xfffffffffffffffe
xor ecx, ecx
mov rsi, qword [rsp + rcx*8 + 0x30]
and rsi, rax
mov rbx, qword [r12 + rcx*8 + 0x48]
and rbx, rdi
or rbx, rsi
mov qword [r12 + rcx*8 + 0x48], rbx
mov rbx, qword [rsp + rcx*8 + 0x38]
and rbx, rax
mov rsi, qword [r12 + rcx*8 + 0x50]
and rsi, rdi
or rsi, rbx
mov qword [r12 + rcx*8 + 0x50], rsi
add rcx, 2
cmp rdx, rcx
jne 0x1400c7825
test r8b, 1
je 0x1400c7876
and rax, qword [rsp + rcx*8 + 0x30]
and rdi, qword [r12 + rcx*8 + 0x48]
or rdi, rax
mov qword [r12 + rcx*8 + 0x48], rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140107cc0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cea30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140102e80]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14016c088]
lea rdx, [0x140102e70]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400ceb09
cmp dword [0x14016c090], 0
jne 0x1400ceace
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [0x14016c094]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1400ceace
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400ceace
mov eax, dword [rsi + 0x204]
xor edi, edi
cmp eax, dword [rsi + 0x200]
jne 0x1400ceb0e
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140107cc0
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 0x210
call fcn.14004bd80
test rax, rax
je 0x1400ceb1d
mov rsi, rax
xor edi, edi
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.14010a410
lea r8, [0x140102940]
xor ecx, ecx
mov rdx, rsi
call fcn.14002a830
test eax, eax
jne 0x1400ceaa8
jmp 0x1400ceab8
call fcn.140106230
inc eax
and eax, 0xf
shl rax, 5
mov edi, dword [rsi + rax + 0x10]
jmp 0x1400ceab8
xor edi, edi
jmp 0x1400ceab8

Function at 0x1400d21f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [0x1401666f4]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rax, qword [rax + 0x120]
cmp rax, qword [rcx + 0x20]
jne 0x1400d2165
mov eax, dword [0x1401666f4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x128]
ret
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400d2190
mov r8d, dword [0x1401666f4]
mov rdx, qword gs:[0x58]
mov rdx, qword [rdx + r8*8]
lea rdx, [rdx + 0x120]
cmp qword [rax + 8], rdx
jne 0x1400d2190
ret
jmp 0x1400d21f0
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400d222b
mov eax, dword [0x1401666f4]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
lea rax, [rax + 0x120]
cmp qword [rcx + 8], rax
je 0x1400d22ba
mov rcx, qword [rcx + 0x20]
jmp 0x1400d21fc
mov rax, qword [rsi + 0x28]
cmp rax, 0x60
mov edi, 0x60
cmova rdi, rax
mov rcx, rdi
call qword [rsi + 0x48]
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], 0x18
mov qword [rax + 0x10], rdi
lock add qword [rsi + 0x10], rdi
lea rcx, [rax + 0x18]
mov qword [rax + 8], 0x60
mov qword [rax + 0x18], rsi
mov edi, dword [0x1401666f4]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdi*8]
lea rax, [rax + 0x120]
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rdx
lea rax, [rdx + 0x60]
mov qword [rdx + 0x40], rax
mov rax, qword [rdx + 0x10]
add rax, rdx
mov qword [rdx + 0x48], rax
mov qword [rdx + 0x30], r8
xorps xmm0, xmm0
movups xmmword [rdx + 0x50], xmm0
mov rax, qword [rsi]
mov qword [rdx + 0x38], rax
lock cmpxchg qword [rsi], rcx
jne 0x1400d22af
mov eax, dword [0x1401666f4]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov qword [rax + 0x128], rcx
mov rdx, qword [rsi + 0x20]
mov qword [rax + 0x120], rdx
mov qword [rsi + 8], rcx
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400d4a97
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, r8d
mov r8d, dword [rcx]
mov r9d, dword [rcx + 8]
mov r10d, r8d
xor r10d, eax
mov r11d, 0xff
and r10d, r11d
shr r8d, 8
xor r8d, dword [rdx + r10*4]
mov dword [rcx], r8d
and r8d, r11d
add r8d, dword [rcx + 4]
imul r8d, r8d, 0x8088405
inc r8d
mov dword [rcx + 4], r8d
shr r8d, 0x18
and r11d, r9d
xor r11d, r8d
shr r9d, 8
xor r9d, dword [rdx + r11*4]
mov dword [rcx + 8], r9d
ret

Function at 0x1400d60c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14016bfc8]
cmp rsi, 1
jbe 0x1400d610c
mov ecx, dword [0x140166310]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov al, 2
and rcx, 0xfffffffffffffffc
je 0x1400d6105
movsxd rdx, dword [rsi]
shl rdx, 4
mov edi, dword [rcx + rdx + 8]
cmp edi, dword [rsi + 4]
jne 0x1400d6105
mov rcx, qword [rcx + rdx]
test rcx, rcx
je 0x1400d6105
mov al, byte [rcx]
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14016bfc8]
call fcn.14000c730
test al, al
je 0x1400d6152
mov qword [0x14016bfd0], 0
lea rdi, [0x14016bfc8]
lea rsi, [0x14016bfd0]
mov rcx, rsi
xor edx, edx
call fcn.14002ec30
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14000a660
jmp 0x1400d60d3
mov rsi, qword [0x14016bfc8]
jmp 0x1400d60d3

Function at 0x1400d7be0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x140102e80]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x14016c088]
lea rdx, [0x140102e70]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400d7d58
cmp dword [0x14016c090], 0
jne 0x1400d7d14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x14016c094]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400d7d14
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400d7d14
mov eax, dword [rdi + 0x200]
cmp eax, dword [rdi + 0x204]
jne 0x1400d7cbf
test rsi, rsi
je 0x1400d7cd6
mov r8, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
add r8, 8
mov rcx, rsi
xor edx, edx
call fcn.14010a410
mov rdi, qword [0x140166348]
mov rbx, qword [rdi + 0x28]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140107cc0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov rax, rbx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp rax
shl rax, 5
lea rbx, [rdi + rax]
add rbx, 8
mov rdi, qword [rbx]
test rdi, rdi
jne 0x1400d7cec
mov qword [rbx], rsi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140107cc0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
add r8, 8
mov rcx, rdi
xor edx, edx
call fcn.14010a410
mov rcx, qword [0x140166348]
mov rdx, rdi
xor r8d, r8d
call qword [rcx + 0x28]
jmp 0x1400d7cd3
mov ecx, 0x210
call fcn.14004bd80
test rax, rax
je 0x1400d7c76
mov rdi, rax
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.14010a410
lea r8, [0x140102940]
xor ecx, ecx
mov rdx, rdi
call fcn.14002a830
test eax, eax
jne 0x1400d7c68
jmp 0x1400d7c76
call fcn.140106230
int3
Function at 0x1400db530
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x140141df0]
lea rdi, [rsp + 0xc0]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, rdi
call fcn.1400c3390
and byte [rdi], 0xf8
mov al, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdi + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.14010a410
mov rcx, r15
mov rdx, rdi
call fcn.140031ca0
mov rcx, r14
mov rdx, r15
call fcn.140070280
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140107cc0
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400dd210
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14016c0f0]
cmp rdi, 1
jbe 0x1400dd239
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140021d30
lea rcx, [0x14016c0f0]
call fcn.14000c730
test al, al
je 0x1400dd27f
mov qword [0x14016c0f8], 0
lea rbx, [0x14016c0f0]
lea rdi, [0x14016c0f8]
mov rcx, rdi
xor edx, edx
call fcn.14002ec30
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14000a660
jmp 0x1400dd227
mov rdi, qword [0x14016c0f0]
jmp 0x1400dd227