joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049460
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
xor eax, eax
lea r8, [0x14004d570]
mov edi, edx
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], eax
mov r9, rcx
xor edx, edx
xor ecx, ecx
call fcn.1400c7114
mov qword [rbx + 8], rax
test rax, rax
je 0x1400494da
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400494e7
lea rdx, str.UID:_timeout
lea rcx, [rsp + 0x40]
call fcn.140043f20
mov rax, qword [rsp + 0x40]
mov ebx, 0xffffffff
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400494da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x10]
sub rcx, 0x18
mov qword [rsp + 0x48], rsi
call fcn.14000c440
mov rcx, rax
mov rdi, rax
call fcn.14000c440
mov ebx, 0xffffffff
lea rsi, [rax + 0x18]
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140049525
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x50]
call fcn.140042de0
mov r8, qword [rax]
test r8, r8
je 0x1400495a4
mov rax, rsi
sub r8, rsi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140049554
add rax, 2
test ecx, ecx
jne 0x140049540
test edx, edx
mov eax, ebx
lea rdx, [rsi - 0x18]
setne dil
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140049573
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x50]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140049590
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rsi, qword [rsp + 0x48]
movzx eax, dil
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000c310
int3
Function at 0x14004efa0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x14015b6d8]
test rcx, rcx
jne 0x14004f071
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [rcx + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14015b6d8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14004f06a
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14004f1e9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rdx, str.CryptAcquireContext_has_failed
lea rcx, [rsp + 0x88]
cmp rdx, 0x10000
jae 0x14004f031
movzx edx, dx
call fcn.14000d4c0
jmp 0x14004f037
call fcn.14000aae0
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f1d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [0x14015b6d8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14004f0df
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14004f1f4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.CryptCreateHash_has_failed
lea rcx, [rsp + 0x30]
cmp rdx, 0x10000
jae 0x14004f0cf
movzx edx, dx
call fcn.14000d4c0
jmp 0x14004f0d5
call fcn.14000aae0
nop
mov rdx, qword [rsp + 0x30]
jmp 0x14004f03f
mov rdx, qword [rdi]
mov r8d, dword [rdx - 0x10]
add r8d, r8d
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14004f14a
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14004f1ff
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.CryptHashData_has_failed
lea rcx, [rsp + 0x38]
cmp rdx, 0x10000
jae 0x14004f13a
movzx edx, dx
call fcn.14000d4c0
jmp 0x14004f140
call fcn.14000aae0
nop
mov rdx, qword [rsp + 0x38]
jmp 0x14004f03f
mov dword [rsp + 0x80], 0x10
lea r8, [rbx + 8]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov edx, 2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x14004f1c8
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14004f1de
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.CryptGetHashParam_has_failed
lea rcx, [rsp + 0x40]
cmp rdx, 0x10000
jae 0x14004f1b8
movzx edx, dx
call fcn.14000d4c0
jmp 0x14004f1be
call fcn.14000aae0
nop
mov rdx, qword [rsp + 0x40]
jmp 0x14004f03f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
Function at 0x140060250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r15, r9
movzx r12d, r8b
mov rsi, rdx
mov r13, qword [rcx]
mov r14, r13
mov rbx, qword [r13 + 8]
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x1400602db
mov r14, rbx
test r12b, r12b
je 0x1400602b0
lea rcx, [rbx + 0x20]
mov rdx, r15
call fcn.140060aa0
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x1400602c2
lea rdx, [rbx + 0x20]
mov rcx, r15
call fcn.140060aa0
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x1400602cc
mov rbx, qword [rbx]
jmp 0x1400602d0
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x140060291
mov rcx, qword [rsp + 0x70]
mov rbx, r14
mov qword [rsp + 0x30], rbx
test dil, dil
je 0x14006032d
cmp r14, qword [r13]
jne 0x14006031e
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8b, 1
lea rdx, [rsp + 0x70]
call fcn.14005fd30
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x140060380
lea rcx, [rsp + 0x30]
call fcn.140042000
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 0x20]
mov rdx, r15
call fcn.140060aa0
shr eax, 0x1f
test al, al
je 0x140060376
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r15
mov r9, r14
movzx r8d, dil
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.14005fd30
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x140060380
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400623d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r15, r9
movzx r12d, r8b
mov rsi, rdx
mov r13, qword [rcx]
mov r14, r13
mov rbx, qword [r13 + 8]
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x14006245b
mov r14, rbx
test r12b, r12b
je 0x140062430
lea rcx, [rbx + 0x20]
mov rdx, r15
call fcn.140060aa0
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x140062442
lea rdx, [rbx + 0x20]
mov rcx, r15
call fcn.140060aa0
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x14006244c
mov rbx, qword [rbx]
jmp 0x140062450
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x140062411
mov rcx, qword [rsp + 0x70]
mov rbx, r14
mov qword [rsp + 0x30], rbx
test dil, dil
je 0x1400624ad
cmp r14, qword [r13]
jne 0x14006249e
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8b, 1
lea rdx, [rsp + 0x70]
call fcn.140061f00
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x140062500
lea rcx, [rsp + 0x30]
call fcn.140042000
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 0x20]
mov rdx, r15
call fcn.140060aa0
shr eax, 0x1f
test al, al
je 0x1400624f6
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r15
mov r9, r14
movzx r8d, dil
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.140061f00
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x140062500
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140063120
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea edx, [rdi + 3]
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x50]
call fcn.140021890
nop
lea rdx, str.Global_
lea rcx, [rsp + 0x60]
call fcn.1400611a0
mov rcx, rax
lea rdx, str.B4838C68_197D_43FA_995A_8E691EBE14FD
call fcn.1400611a0
nop
movdqa xmm0, xmmword [0x1400f5620]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], di
mov dword [rsp + 0x20], 4
mov rcx, qword [rbp - 0x28]
test cl, 2
jne 0x1400631d3
mov rax, qword [rbp - 0x58]
mov r8, qword [rax]
test r8, r8
je 0x1400631d3
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x30]
cmovb r8, qword [rbp - 0x30]
sub r8, rdx
jmp 0x1400631fb
test cl, 4
jne 0x140063208
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax]
test rcx, rcx
je 0x140063208
mov rax, qword [rbp - 0x80]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x48]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rbp + 0x50]
call fcn.140015eb0
nop
lea rcx, [rsp + 0x50]
call fcn.140021d00
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae r8, qword [rbp + 0x50]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x14006326c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400632d9
call fcn.1400a7308
movdqa xmm0, xmmword [0x1400f5620]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], di
mov edx, 0xea60
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1400632b6
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400a79f0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rdx, str.mutex_timeout
lea rcx, [rsp + 0x38]
call fcn.140009c40
lea rdx, [0x140145de0]
lea rcx, [rsp + 0x38]
call fcn.1400ae2cc
int3
call fcn.1400b7964
int3
Function at 0x14006fa30
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rdi, rdx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x14006fa5c
mov rcx, qword [rdx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
jne 0x14006fa7d
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor eax, eax
mov word [rsp + 0x68], ax
mov rdx, rbx
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.14001c400
nop
cmp qword [rdi + 0x18], 8
jb 0x14006faa6
mov rdi, qword [rdi]
mov r8d, ebx
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14006fac3
xor dil, dil
jmp 0x14006fae9
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14006fad0
mov rdx, rbx
mov rcx, rsi
call fcn.140015eb0
mov dil, 1
test rbx, rbx
je 0x14006fb25
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
sar rdx, 1
add rdx, rdx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14006fb1d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006fb39
mov rcx, rbx
call fcn.1400a7308
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400b7964
int3
Function at 0x14007bdc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
cmp dword [rcx - 0x10], 0
je 0x14007bde3
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007bde3
test al, 0x10
jne 0x14007bde3
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400a5210
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
xor edi, edi
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a5260
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
test rax, rax
je 0x1400a5260
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
jne 0x1400a524f
mov eax, edi
jmp 0x1400a5256
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
cmp byte [rax + 0x70], dil
je 0x1400a5260
mov al, 1
jmp 0x1400a5262
xor al, al
mov byte [rbx], al
test al, al
je 0x1400a5281
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a527d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov rdi, rax
mov byte [rdi + 0x70], 0
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a53a0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a53ef
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
test rax, rax
je 0x1400a53ef
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
jne 0x1400a53e2
xor eax, eax
movzx ecx, byte [rbx]
mov byte [rax + 0x70], cl
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
movzx ecx, byte [rbx]
mov byte [rax + 0x70], cl
add rsp, 0x30
pop rbx
ret
Function at 0x1400a5870
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, r8
mov r14, rdx
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a58af
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x1400a58cc
call fcn.1400a63d0
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
jne 0x1400a58c3
xor esi, esi
jmp 0x1400a58cc
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rax, qword [r14]
mov qword [rsp + 0x38], rax
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x40], rcx
mov edx, 1
test rcx, rcx
je 0x1400a58f8
mov eax, edx
lock xadd dword [rcx + 8], eax
test rcx, rcx
je 0x1400a58f8
lock xadd dword [rcx + 8], edx
mov qword [rsp + 0x68], rbp
mov edi, 0xffffffff
test rcx, rcx
je 0x1400a5939
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400a5939
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a5939
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x88], rbp
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x28]
call fcn.1400a4ce0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.1400a4fc0
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400a59e5
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400a59e5
mov rbx, qword [rsp + 0x80]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a59e5
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rbx, qword [r14 + 8]
test rbx, rbx
je 0x1400a5a17
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400a5a17
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400a5a17
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400a5ba0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a5c05
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a5c05
mov rcx, qword [rax + 0x28]
mov rax, rcx
mov rdx, qword [rcx + 8]
cmp byte [rdx + 0x19], 0
jne 0x1400a5bf3
cmp qword [rdx + 0x20], rbx
jae 0x1400a5bdc
mov rdx, qword [rdx + 0x10]
jmp 0x1400a5be2
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1400a5bd0
cmp rax, rcx
je 0x1400a5bf3
cmp rbx, qword [rax + 0x20]
jae 0x1400a5bf6
mov rax, rcx
cmp rax, rcx
je 0x1400a5c05
add rax, 0x28
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400a61e0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor ebx, ebx
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a622b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x14014c200]
test rax, rax
je 0x1400a622b
cmp ecx, 0xffffffff
jne 0x1400a6216
mov eax, ebx
jmp 0x1400a6222
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x14014c200]
cmp byte [rax + 0x70], bl
je 0x1400a622b
mov al, 1
jmp 0x1400a622d
xor al, al
test al, al
je 0x1400a6272
cmp ecx, 0xffffffff
je 0x1400a626c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a626c
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a6255
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x1400a626c
mov al, 1
jmp 0x1400a626e
xor al, al
test al, al
jne 0x1400a6278
add rsp, 0x30
pop rbx
ret
call fcn.1400a5c10
lea rcx, [rax + 0x68]
call fcn.1400a56f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [0x140147250]
lea rcx, [rsp + 0x40]
call fcn.1400ae2cc
int3

Function at 0x1400a63d0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
call fcn.1400a5170
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rdx, [0x1400a5a30]
lea rcx, [0x14015cd98]
call fcn.140085470
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a6414
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x30
pop rbx
ret
Function at 0x1400a67d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
jne 0x1400a67f8
xor esi, esi
jmp 0x1400a6801
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x1400a6925
mov rcx, qword [rsi + 0x30]
mov rax, qword [rsi + 0x18]
mov rbx, rax
nop word [rax + rax]
mov r8, rbx
mov rdx, rcx
test rcx, rcx
jne 0x1400a6834
test rax, rax
je 0x1400a68fe
mov rbx, rax
test rdx, rdx
cmovne rbx, r8
test rbx, rbx
je 0x1400a68ab
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a6887
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsi + 0x18]
mov rbx, rax
test rax, rax
jne 0x1400a6850
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x1400a6820
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400a68df
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1400a68df
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.1400a5ab0
mov rcx, qword [rsi + 0x30]
test rcx, rcx
jne 0x1400a68c0
jmp 0x1400a6813
lea rdx, [0x1400a5a30]
lea rcx, [0x14015cd98]
call fcn.140085470
mov ecx, dword [0x14014c200]
cmp ecx, 0xffffffff
je 0x1400a6925
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1400a6958
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1400a6958
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a6be0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x1400a6c70]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call fcn.1400c7114
mov rsi, rax
test rax, rax
jne 0x1400a6c24
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbx
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400a6c47
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret