joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e030
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1401399e0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x57
call fcn.14006fcc0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400763b0
test esi, esi
js 0x14002e131
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.140074630
test al, al
jne 0x14002e138
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002e154
mov esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.1400746a0
lea rcx, [rsp + 0x50]
call fcn.140076540
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14009d180
mov eax, esi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14002e106
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1400ed8d0
jmp 0x14002e0d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x14002e0fc

Function at 0x14002e170
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1401399e0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x88
call fcn.14006fcc0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400763b0
test esi, esi
js 0x14002e274
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.140074630
test al, al
jne 0x14002e27b
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rdi]
lea rcx, [rsp + 0x30]
call fcn.1400746a0
lea rcx, [rsp + 0x50]
call fcn.140076540
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14009d180
mov eax, esi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14002e249
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1400ed8d0
jmp 0x14002e210
Function at 0x14002e2a0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x1401399e0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x9c
call fcn.14006fcc0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400763b0
mov qword [rbx + 8], r14
mov qword [rbx], 0
call fcn.140074630
test al, al
jne 0x14002e380
lea rdi, [rsp + 0x28]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.1400746a0
lea rcx, [rsp + 0x50]
call fcn.140076540
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14009d180
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.1400ed8d0
jmp 0x14002e32d
Function at 0x14002e4d0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov r12d, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [0x1401399e0]
lea rbp, [rsp + 0x60]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rdx, str.DoInitialize
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x15a
call fcn.14006fcc0
mov rcx, rbp
mov rdx, rbx
xor r8d, r8d
call fcn.1400763b0
mov eax, r12d
and eax, 1
neg eax
and eax, 3
test r12b, 2
mov edx, 1
cmove edx, eax
test r12b, 4
mov ecx, 4
cmovne edx, ecx
test r12b, 8
mov ebp, 2
cmove ebp, edx
test r12b, 0x10
mov eax, 5
cmove eax, ebp
test eax, eax
je 0x14002e729
mov edx, r12d
and edx, 0x40
shl edx, 0x18
test r12b, r12b
cmovns ecx, edx
mov edx, r12d
rol edx, 0x1a
mov edi, r12d
shl edi, 0xb
and edi, 0x20000000
mov esi, r12d
shr esi, 4
and esi, 0x10000
and edx, 0x80000100
or edx, edi
or edx, esi
or edx, ecx
mov ecx, r12d
shr ecx, 8
and ecx, 3
mov r8d, r12d
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov edi, r12d
and edi, 0x400
mov ecx, edi
shl ecx, 0x14
mov ebp, r12d
shr ebp, 3
and ebp, 0x100
or ebp, ecx
mov ecx, r12d
shr ecx, 0xb
and ecx, 2
or ecx, ebp
mov ebp, r12d
shl ebp, 0xd
and ebp, 0x4000000
or ebp, ecx
mov ecx, r12d
shl ecx, 8
mov ebx, ecx
and ebx, 0x2000000
or ebx, ebp
and ecx, 0x8000000
or ecx, ebx
cmp byte [r14 + 0x17], 0
jns 0x14002e639
mov r14, qword [r14]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp qword [r15], rax
je 0x14002e695
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r15]
inc rax
cmp rax, 2
jae 0x14002e710
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14002e68a
mov qword [r15], rbx
call fcn.14006fce0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [r15]
inc rbx
cmp rbx, 2
jb 0x14002e6eb
shr edi, 0xa
mov dword [r15 + 0x24], 0
mov byte [r15 + 0x29], dil
test r12b, 4
jne 0x14002e6fe
test r12b, 0xa
je 0x14002e6be
mov byte [r15 + 0x28], 1
lea rcx, [rsp + 0x60]
call fcn.140076540
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14009d180
nop
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14002e3a0
mov dword [r15 + 0x24], eax
jmp 0x14002e6be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [r15 + 0x28]
jmp 0x14002e6be
call fcn.14006fce0
mov rcx, qword [r15]
call fcn.140071fe0
mov qword [r15], 0
jmp 0x14002e676
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [r15 + 0x24], 0xffffffff
jmp 0x14002e6be
Function at 0x140033260
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.14009c328
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x140033680]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140033301
test rbp, rbp
je 0x14003332c
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009d180
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14003331a
mov ebp, eax
cmp eax, 0x5af
je 0x14003331a
cmp ebp, 0xe
jne 0x140033337
mov rcx, r15
call fcn.1400f4160
mov rcx, r14
call fcn.14009c364
jmp 0x1400332df
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400332df
mov eax, dword [0x140165858]
mov ecx, dword [0x140161514]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400333a6
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.1400328f0
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x140165850]
call fcn.14007c010
cmp byte [rsi + 0x17], 0
jns 0x140033322
mov rcx, qword [rsp + 0x38]
call fcn.14009c364
jmp 0x140033322
lea rcx, [0x140165858]
call fcn.14009c480
cmp dword [0x140165858], 0xffffffff
jne 0x140033358
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.14003b090
mov qword [0x140165850], rax
lea rcx, [0x140165858]
call fcn.14009c518
jmp 0x140033358

Function at 0x1400353c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401658f8]
mov ecx, dword [0x140161514]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003541c
movzx eax, word [0x1401658c8]
cmp ax, 9
jne 0x14003547e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009d180
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401658f8]
call fcn.14009c480
cmp dword [0x1401658f8], 0xffffffff
jne 0x1400353f5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x1401658e8], xmm2
movups xmmword [0x1401658d8], xmm1
movups xmmword [0x1401658c8], xmm0
lea rcx, [0x1401658f8]
call fcn.14009c518
jmp 0x1400353f5
xor esi, esi
test ax, ax
je 0x140035407
cmp ax, 6
jne 0x140035495
mov esi, 2
jmp 0x140035407
cmp ax, 0xc
jne 0x1400354a5
mov esi, 3
jmp 0x140035407
mov esi, 4
jmp 0x140035407
Function at 0x1400354b0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov al, 1
test al, al
je 0x1400355be
mov rax, qword [rsi]
test rax, rax
jne 0x1400355c5
cmp dword [rsi + 0x14], 0
jne 0x1400355c3
xor eax, eax
cmp qword [rsi + 8], 0
mov edx, 0
jne 0x1400355c5
mov rdi, qword [r14]
cmp rdx, rdi
je 0x140035539
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003558d
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14003552d
mov qword [rsi], rdi
call fcn.14006fce0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi + 8]
mov rdi, qword [r14 + 8]
cmp rax, rdi
je 0x140035572
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400355a6
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14003556a
mov qword [rsi + 8], rdi
call fcn.14006fce0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [r14 + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [r14 + 0x14]
mov dword [rsi + 0x14], eax
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14006fce0
mov rcx, qword [rsi]
call fcn.140071fe0
mov qword [rsi], 0
jmp 0x14003551b
call fcn.14006fce0
mov rcx, qword [rsi + 8]
call fcn.140071fe0
mov qword [rsi + 8], 0
jmp 0x140035557
mov rax, qword [rsi]
jmp 0x1400355c5
xor eax, eax
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x14003560d
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jae 0x1400355f0
mov rdx, rax
mov qword [rsi + 0x10], 0
mov rax, rcx
jmp 0x1400354ff
call fcn.14006fce0
mov rcx, qword [rsi + 8]
call fcn.140071fe0
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
jmp 0x1400355dd
call fcn.14006fce0
mov rcx, qword [rsi]
call fcn.140071fe0
mov qword [rsi], 0
xor eax, eax
jmp 0x1400355cf
Function at 0x140039400
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140039473
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140039473
cmp dword [rsp + 0x38], 4
jne 0x140039473
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009d180
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140039490
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14009d110
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14009fa40
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140039543
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140039547
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.14006c920
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14009d180
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140039524
cmp eax, 2
jne 0x14003958c
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14009fa40
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x140039593
lea rdx, [rsp + 0x40]
jmp 0x14003951a
mov edi, 0x3f4
jmp 0x140039524
mov edi, 0xea
jmp 0x140039524

Function at 0x140039fe0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140161338]
cmp ecx, 0xffffffff
je 0x14003a005
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14003a000
Function at 0x14003a010
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14009d110
sub rsp, rax
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140161338]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14003a0c4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14003a0f3
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14009fa40
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14009c39c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14009f630
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14009d180
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140046990
test al, al
je 0x14003a0f6
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14003a0f9
mov eax, 0xffffffff
lock cmpxchg dword [0x140161338], ecx
jne 0x14003a11e
mov ecx, dword [rsp + 0x2c]
jmp 0x14003a048
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.140046990
test al, al
je 0x14003a136
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14003a136
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14003a0db
mov ecx, dword [rsp + 0x2c]
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140161338]
mov dword [rsp + 0x2c], ecx
jmp 0x14003a048
int3

Function at 0x14003a140
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov eax, 0xffffffff
mov qword [rcx], rax
mov ecx, dword [0x140161338]
cmp ecx, 0xffffffff
je 0x14003a222
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14003a222
mov eax, dword [0x140169378]
mov ecx, dword [0x140161514]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003a22c
mov rbx, qword [0x140169370]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14003a272
mov rax, qword [0x140167b68]
inc rax
xor ecx, ecx
lea r8, [0x140167b70]
lea edx, [rax + rcx]
movzx edi, dl
lea rdx, [rdi + rdi*2]
cmp dword [r8 + rdx*8], 0
jne 0x14003a27f
lea rax, [r8 + rdx*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x140167b68], rdi
mov dword [rsi], edi
mov eax, dword [rax + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
je 0x14003a294
cmp eax, 0x100
jge 0x14003a297
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14003a010
jmp 0x14003a174
lea rcx, [0x140169378]
call fcn.14009c480
cmp dword [0x140169378], 0xffffffff
jne 0x14003a199
mov ecx, 8
call fcn.14009c328
mov rbx, rax
mov rcx, rax
call fcn.140073360
mov qword [0x140169370], rbx
lea rcx, [0x140169378]
call fcn.14009c518
jmp 0x14003a199
mov rcx, rbx
call fcn.140073370
jmp 0x14003a1b1
inc rcx
cmp rcx, 0x100
jne 0x14003a1c4
jmp 0x14003a1f6
int3
int3
Function at 0x14003b210
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401693a8]
cmp rdi, 1
jbe 0x14003b239
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14007bca0
lea rcx, [0x1401693a8]
call fcn.1400469e0
test al, al
je 0x14003b27f
mov qword [0x1401693b0], 0
lea rbx, [0x1401693a8]
lea rdi, [0x1401693b0]
mov rcx, rdi
xor edx, edx
call fcn.14003a140
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140046a80
jmp 0x14003b227
mov rdi, qword [0x1401693a8]
jmp 0x14003b227
Function at 0x140046990
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400469a5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14004a1f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140169a48], 0
jne 0x14004a22d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14004a220
mov dword [rdi], eax
mov dword [0x140169a50], eax
mov qword [0x140169a48], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x14004a8f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov ebx, ecx
mov rax, qword [0x14015e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x14004a8c0]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x14016a2c8]
lea rdx, [0x14004a780]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14004a9ed
cmp dword [0x14016a2d0], 0
jne 0x14004a9fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x14016a2d4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
jne 0x14004a9a3
mov ecx, 0x18
call fcn.140081a40
test rax, rax
je 0x14004a9fa
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov ecx, dword [0x14016a2d4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14004a9f2
lea rbp, [0x14016a2d8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x14016a2e0]
mov qword [rax + rbx*8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsi + rbx*8], r14
mov esi, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14009d180
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400ae3a0
mov rcx, rsi
call fcn.140081a70
mov rcx, r14
call rdi
xor esi, esi
jmp 0x14004a9d3

Function at 0x14004abd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14004ac0c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14004ac16
add rdi, rbx
sub rsi, rbx
jne 0x14004abea
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400ae3a0
int3
Function at 0x14004cc70
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
lea r15, [rcx + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14004ce51
mov r8, qword [r13 + 0x28]
test r8, r8
je 0x14004cdef
mov rax, r12
shr rax, 0x20
lea edx, [r12*8]
add rdx, 8
xor rdx, rax
movabs rbx, 0x9ddfea08eb382d69
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rdx, rax
xor rdx, rcx
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rbx
mov rax, r8
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, r8
sub rax, rdx
movabs rdx, 0x3333333333333333
mov rbx, rax
and rbx, rdx
shr rax, 2
and rax, rdx
add rax, rbx
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs rdi, 0x101010101010101
imul rdi, rax
shr rdi, 0x38
cmp rdi, 1
ja 0x14004ce5e
lea rbx, [r8 - 1]
and rbx, rcx
mov rax, qword [r13 + 0x20]
mov rax, qword [rax + rbx*8]
test rax, rax
je 0x14004cdef
mov rsi, qword [rax]
test rsi, rsi
je 0x14004cdef
lea r9, [r8 - 1]
mov rax, qword [rsi + 8]
cmp rax, rcx
jne 0x14004cdd6
cmp qword [rsi + 0x10], r12
jne 0x14004cde7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [0x14016a378]
cmp rdi, 1
jbe 0x14004ce08
mov rcx, rdi
call fcn.14007bc60
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call fcn.14007bca0
mov rcx, qword [r14 + 0x28]
mov rdx, r12
call qword [rcx + 8]
mov rcx, rdi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14007bca0
cmp edi, 1
ja 0x14004ce7a
and rax, r9
cmp rax, rbx
jne 0x14004cdef
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14004cd77
mov rcx, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rcx, [0x14016a378]
call fcn.1400469e0
test al, al
je 0x14004ce90
mov qword [0x14016a380], 0
lea rbx, [0x14016a378]
lea rdi, [0x14016a380]
mov rcx, rdi
xor edx, edx
call fcn.14003a140
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140046a80
jmp 0x14004cd9c
mov rcx, r15
call fcn.140073370
jmp 0x14004cc9d
mov rbx, rcx
cmp rcx, r8
jb 0x14004cd5a
mov rax, rcx
xor edx, edx
div r8
mov rbx, rdx
jmp 0x14004cd5a
cmp rax, r8
jb 0x14004cde2
xor edx, edx
div r8
mov rax, rdx
jmp 0x14004cde2
mov rdi, qword [0x14016a378]
jmp 0x14004cd9c

Function at 0x14004d230
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14016a338]
cmp rdi, 1
jbe 0x14004d259
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14007bca0
lea rcx, [0x14016a338]
call fcn.1400469e0
test al, al
je 0x14004d29f
mov qword [0x14016a340], 0
lea rbx, [0x14016a338]
lea rdi, [0x14016a340]
mov rcx, rdi
xor edx, edx
call fcn.14003a140
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140046a80
jmp 0x14004d247
mov rdi, qword [0x14016a338]
jmp 0x14004d247