joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400200c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov dword [rsp + 0x38], 0
mov ecx, 0x70
call fcn.140007fe8
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14002010d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
call fcn.140020760
mov qword [rsp + 0x68], rax
jmp 0x140020116
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x40]
mov qword [rcx + 0x498], rax
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x498]
call fcn.140020950
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
lea rcx, str.m_pSensorManagerEvents__Initialize___08x___n
call fcn.140001000
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekAudio
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400201bf
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.InitSensorAPI_HRESULT_
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0
jl 0x1400201cd
mov eax, 1
jmp 0x14002022d
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x498]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002020f
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x20]
mov qword [rsp + 0x70], rax
jmp 0x140020218
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x90]
mov qword [rax + 0x498], 0
xor eax, eax
add rsp, 0x88
ret
Function at 0x140020d00
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekRealtekEffectsAP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020da2
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.AutoRotationState
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SensorIndex
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x48
ret

Function at 0x140020db0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x11
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAutoRotation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020e93
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Enable
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.LastOrientation
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x140020eb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x11
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020f4d
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.ConvertibleSlateMode
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x140020f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x11
xor r8d, r8d
lea rdx, str.SOFTWARELenovoMultiMode
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140021029
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.CameraAudio
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x14002101a
cmp dword [rsp + 0x38], 0
jne 0x14002100a
mov dword [rsp + 0x50], 1
jmp 0x140021012
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x38]
add rsp, 0x68
ret
Function at 0x140022b70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
cmp qword [rsp + 0x98], 0
je 0x140022d17
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x98]
mov qword [rcx + 0x7a0], rax
mov dword [rsp + 0x30], 0
jmp 0x140022bbb
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x3c
jge 0x140022c93
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x20
mov rax, qword [rsp + 0x90]
mov qword [rax + rcx + 8], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdx, rax
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x20
mov rax, qword [rsp + 0x90]
mov qword [rax + rcx], rdx
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x20
mov rax, qword [rsp + 0x90]
cmp qword [rax + rcx], 0
je 0x140022c8e
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x20
lea rdi, [rsp + 0x50]
mov rax, qword [rsp + 0x90]
lea rsi, [rax + rcx]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
call fcn.140022650
lea rdi, [rsp + 0x60]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x20
mov rax, qword [rsp + 0x90]
lea rsi, [rsp + 0x60]
lea rdi, [rax + rcx + 0x10]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
jmp 0x140022bb0
mov rax, qword [rsp + 0x90]
mov qword [rax + 0x788], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdx, rax
mov rax, qword [rsp + 0x90]
mov qword [rax + 0x780], rdx
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x780], 0
je 0x140022d17
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
lea r8, [0x1400228f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rax, qword [rsp + 0x90]
mov qword [rax + 0x7a8], rdx
mov rax, qword [rsp + 0x90]
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x140023560
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x40]
call fcn.140023190
test eax, eax
jne 0x14002358f
jmp 0x140023613
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x14], 0
jne 0x140023613
lea rcx, str.CMMDeviceHandler::Start_n
call fcn.140001000
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0x14], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax], r11
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x20]
call fcn.1400284c0
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x40]
lea r8, [0x140023530]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], r11
add rsp, 0x38
ret
Function at 0x140027da0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [rsp + 0x58], 0
je 0x140027dc2
lea rax, [0x140037498]
mov qword [rsp + 0x38], rax
jmp 0x140027dce
lea rax, str.REALTEK
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x38]
lea rdx, [0x140039260]
lea rcx, str.__s__CService::Initialize_for__s_n
call fcn.140001000
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
mov dword [rcx + 0x578], eax
mov rcx, qword [rsp + 0x50]
add rcx, 0xa8
mov r8d, 5
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x578]
call fcn.14001fa10
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
add rcx, 0xa8
call fcn.14001b010
test eax, eax
je 0x140027f86
mov rcx, qword [rsp + 0x50]
call fcn.140026190
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140027e7b
lea r9, [0x1400392c8]
mov r8d, 0x2f8
lea rdx, [0x1400392e8]
lea rcx, [0x140039320]
call fcn.140001000
mov eax, 2
jmp 0x140027f92
mov rcx, qword [rsp + 0x50]
call fcn.1400260c0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140027eba
lea r9, [0x140039388]
mov r8d, 0x2fc
lea rdx, [0x1400393a8]
lea rcx, [0x1400393e0]
call fcn.140001000
mov eax, 3
jmp 0x140027f92
mov rcx, qword [rsp + 0x50]
add rcx, 0xa8
call fcn.14001b230
test eax, eax
je 0x140027f1f
mov rcx, qword [rsp + 0x50]
call fcn.140025ff0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140027f0e
lea r9, [0x140039448]
mov r8d, 0x302
lea rdx, [0x140039468]
lea rcx, str.__s__RETURN_VALUE_ON_FALSE:_Line___d__File___s_n
call fcn.140001000
mov eax, 4
jmp 0x140027f92
mov rcx, qword [rsp + 0x50]
add rcx, 0xa8
call fcn.14001d060
mov rcx, qword [rsp + 0x50]
add rcx, 0xa8
call fcn.14001b890
mov r11d, eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], r11d
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
je 0x140027f86
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140026be0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x570], r11
mov rcx, qword [rsp + 0x50]
call fcn.140026c40
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400287a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x10068
call fcn.140029d10
sub rsp, rax
mov qword [rsp + 0x10050], 0xfffffffffffffffe
mov rax, qword [0x1400430e0]
xor rax, rsp
mov qword [rsp + 0x10058], rax
mov dword [rsp + 0x10048], 0
lea rdx, [0x140034174]
lea rcx, [rsp + 0x10040]
call fcn.140001980
nop
mov dword [rsp + 0x30], 0x26
mov r8d, 0xfffe
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140007910
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x140028879
lea rcx, [rsp + 0x40]
call fcn.140007874
movzx eax, word [rsp + rax*2 + 0x3e]
cmp eax, 0x5c
jne 0x140028853
lea rcx, [rsp + 0x40]
call fcn.140007874
mov r11, rax
xor eax, eax
mov word [rsp + r11*2 + 0x3e], ax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x10040]
call fcn.140001a00
mov rdx, qword [rsp + 0x10040]
lea rcx, str.GetProgramFilesPath___s_n
call fcn.140001000
lea rdx, [rsp + 0x10040]
mov rcx, qword [rsp + 0x10070]
call fcn.140001950
mov eax, dword [rsp + 0x10048]
or eax, 1
mov dword [rsp + 0x10048], eax
lea rcx, [rsp + 0x10040]
call fcn.1400019e0
mov rax, qword [rsp + 0x10070]
mov rcx, qword [rsp + 0x10058]
xor rcx, rsp
call fcn.140006e00
add rsp, 0x10068
ret
Function at 0x140017fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14001806a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140018060
cmp r11, r10
ja 0x1400180e6
cmp r10, rdx
ja 0x1400180f8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140018062
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140018040
jmp 0x1400180c7
ja 0x14001806a
mov r11, r10
cmp rax, r8
jne 0x140018007
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1400180cb
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400180a0
mov r8, r10
sub ecx, r9d
jns 0x1400180be
jmp 0x1400180cd
cmp r10, rdx
je 0x1400180da
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400180cd
xor al, 1
cmp r8, rdx
jne 0x140018080
jmp 0x1400180cd
xor eax, eax
jmp 0x1400180cd
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140011820
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400160d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140016050
int3
Function at 0x14001c059
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x140285018]
jmp 0x14001ce19
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
test rdx, rdx
je 0x14001c6ba
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
and qword [rdx], 0
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
cmp qword [rsp + 0x20], 0
je 0x14001c6b0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x28]
jmp 0x14001c6bd
lea rcx, [rsp + 0x20]
call fcn.14001c70c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
mov qword [rsi], 1
lea rdi, [rsi + 8]
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 8], xmm0
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x18], rax
call fcn.14001c70c
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.14001cebf
test rax, rax
je 0x14001cdae
mov rdi, rax
cmp rax, 1
jne 0x14001cde7
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [str.Lp__]
mov al, byte [rax]
mov ecx, 0x28
mov edx, 8
call fcn.140185ed0
test rax, rax
je 0x14001ce09
mov rdi, rax
mov qword [rax], rbx
and qword [rax + 8], 0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14001cdfd
dec ecx
mov rdx, rdi
call fcn.14021230c
add rdi, 8
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14001c674
mov rcx, rbx
call fcn.140190580
mov ecx, eax
jmp 0x14001cddf
mov ecx, 8
mov edx, 0x28
call fcn.140003b50
int3
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14001cebf
cmp rax, 2
jb 0x14001ce42
cmp qword [rax + 8], 0
je 0x14001ce42
add rax, 0x10
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14001cd84

Function at 0x14001c808
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14001c829
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14021230c
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x14001c81c
Function at 0x14001cd84
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x140285018]
jmp 0x14001ce19
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
test rdx, rdx
je 0x14001c6ba
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
and qword [rdx], 0
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
cmp qword [rsp + 0x20], 0
je 0x14001c6b0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x28]
jmp 0x14001c6bd
lea rcx, [rsp + 0x20]
call fcn.14001c70c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
mov qword [rsi], 1
lea rdi, [rsi + 8]
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 8], xmm0
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x18], rax
call fcn.14001c70c
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.14001cebf
test rax, rax
je 0x14001cdae
mov rdi, rax
cmp rax, 1
jne 0x14001cde7
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [str.Lp__]
mov al, byte [rax]
mov ecx, 0x28
mov edx, 8
call fcn.140185ed0
test rax, rax
je 0x14001ce09
mov rdi, rax
mov qword [rax], rbx
and qword [rax + 8], 0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14001cdfd
dec ecx
mov rdx, rdi
call fcn.14021230c
add rdi, 8
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14001c674
mov rcx, rbx
call fcn.140190580
mov ecx, eax
jmp 0x14001cddf
mov ecx, 8
mov edx, 0x28
call fcn.140003b50
int3
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14001cebf
cmp rax, 2
jb 0x14001ce42
cmp qword [rax + 8], 0
je 0x14001ce42
add rax, 0x10
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14001cd84
Function at 0x14001ce19
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x140285018]
jmp 0x14001ce19
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
test rdx, rdx
je 0x14001c6ba
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
and qword [rdx], 0
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
cmp qword [rsp + 0x20], 0
je 0x14001c6b0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x28]
jmp 0x14001c6bd
lea rcx, [rsp + 0x20]
call fcn.14001c70c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
mov qword [rsi], 1
lea rdi, [rsi + 8]
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 8], xmm0
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x18], rax
call fcn.14001c70c
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.14001cebf
test rax, rax
je 0x14001cdae
mov rdi, rax
cmp rax, 1
jne 0x14001cde7
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [str.Lp__]
mov al, byte [rax]
mov ecx, 0x28
mov edx, 8
call fcn.140185ed0
test rax, rax
je 0x14001ce09
mov rdi, rax
mov qword [rax], rbx
and qword [rax + 8], 0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14001cdfd
dec ecx
mov rdx, rdi
call fcn.14021230c
add rdi, 8
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14001c674
mov rcx, rbx
call fcn.140190580
mov ecx, eax
jmp 0x14001cddf
mov ecx, 8
mov edx, 0x28
call fcn.140003b50
int3
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14001cebf
cmp rax, 2
jb 0x14001ce42
cmp qword [rax + 8], 0
je 0x14001ce42
add rax, 0x10
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14001cd84

Function at 0x14001cebf
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14001ced8
dec ecx
add rsp, 0x28
jmp fcn.140212314
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x14001cecf

Function at 0x14001d054
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x20]
and qword [rdi], 0
mov rcx, rdx
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rdi]
test eax, eax
je 0x14001d091
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x14001d0c3
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x20]
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.140180660
mov rcx, qword [rsp + 0x20]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140025794
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400257b5
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14021230c
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x1400257a8

Function at 0x140025b30
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
xor esi, esi
test rdi, rdi
je 0x140025b9a
mov r14, rbx
cmp rdi, r12
mov r15d, 0xffffffff
cmovb r15, rdi
add rbx, r15
sub rdi, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x140025b4c
mov ebp, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140025b4c
and ebp, 0x7fffffff
mov esi, ebp
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140043ee9
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140043f0f
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140043ef9
mov qword [rcx], rax
ret

Function at 0x140061bdd
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140061c03
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140061bed
mov qword [rcx], rax
ret