joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007ca40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400fd480]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [r9 + 0x10]
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r15, rcx
cmp rbx, 0x20
ja 0x14007cb34
xor r12d, r12d
nop dword [rax + rax]
mov r10, qword [rdi + 8]
mov r9, r12
test rbx, rbx
je 0x14007cac8
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov ecx, 0x20
add r8, r9
movzx edx, byte [r10 + r8]
lea eax, [rdx - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r9
xor cl, dl
mov byte [r8], cl
cmp r9, rbx
jb 0x14007caa0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007c2b0
mov dword [rsi], eax
test eax, eax
jne 0x14007caf1
mov rax, qword [r15]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx ecx, byte [rax + 0x48]
call fcn.140085820
mov dword [rsi], eax
cmp dword [rsi], r12d
jne 0x14007cb5c
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007c780
test eax, eax
je 0x14007cb34
mov ecx, dword [r14]
test eax, ecx
jne 0x14007cb55
or ecx, eax
xor r8d, r8d
mov dword [r14], ecx
mov rdx, rdi
lea rcx, [r15 + 8]
call fcn.140085db0
cmp al, 2
jne 0x14007cb34
mov rbx, qword [rdi + 0x10]
cmp rbx, 0x20
jbe 0x14007ca80
mov eax, 0x1a
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140090420
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0x37
jmp 0x14007cb39
xor r8d, r8d
lea rcx, [r15 + 8]
mov rdx, rdi
call fcn.140085db0
cmp al, 2
jne 0x14007cbd3
mov rdx, qword [rdi + 0x10]
cmp rdx, 0x20
ja 0x14007cbd3
mov r11, qword [rdi + 8]
mov r10, r12
test rdx, rdx
je 0x14007cbba
lea rax, [rsp + 0x20]
sub r11, rax
nop dword [rax]
lea r9, [rsp + 0x20]
mov ecx, 0x20
add r9, r10
movzx r8d, byte [r11 + r9]
lea eax, [r8 - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r10
xor cl, r8b
mov byte [r9], cl
cmp r10, rdx
jb 0x14007cb90
lea rcx, [rsp + 0x20]
call fcn.14007c780
cmp eax, 0x10
jne 0x14007cbd3
or dword [r14], eax
xor eax, eax
jmp 0x14007cb39
mov rax, qword [rdi + 8]
mov qword [r15 + 0x18], rax
xor eax, eax
jmp 0x14007cb39
Function at 0x14008e0d8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008e112
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008e117
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008e160
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400defe0]
cmp byte [rcx + rax], 0
je 0x14008e160
dec r8
sub rdx, 1
jne 0x14008e146
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140090d8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140090dd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140090dd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140090dd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140090dd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140090dd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140090dd8
xor al, al
add rsp, 0x28
ret

Function at 0x1400a0948
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400a07db
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a07db
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a07db
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a07db
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a07db
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a07db
cmp dword [rcx + 0xf8], 0
je 0x1400a07db
mov ecx, ebx
call fcn.1400a087c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400a066c
cmp dword [rbp + 0x20], 0
je 0x1400a0828
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400a0830
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400a0774
Function at 0x1400b4110
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b4138
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b4138
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x45b500
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov rbx, rcx
mov r8, rdx
mov qword [rsp + 0x28], rax
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
je 0x45b53b
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret

Function at 0x45b560
Capabilities:
Create thread
Resume thread

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rsi
mov rsi, r9
mov r9, r8
mov rbx, rcx
mov r8, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
mov rbx, qword [rsp + 0x58]
mov rdi, rax
je 0x45b5c5
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x45b5e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
mov eax, ecx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x48
ret

Function at 0x45b860
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45b88c
cmp dword [rsp + 0x24], 6
jne 0x45b88c
cmp dword [rsp + 0x28], 0
je 0x45b8b5
lea rcx, [0x0045d9a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x45b8b5
mov ecx, 0xc00
call rax
add rsp, 0x148
ret

Function at 0x45bbf0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x00400000], 0x5a4d
je 0x45bc11
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
movsxd rax, dword [0x0040003c]
lea rcx, [0x00400000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x45bc32
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x45bc70
cmp ecx, 0x20b
je 0x45bc4e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
cmp dword [rax + 0x84], 0xe
ja 0x45bc5f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
cmp dword [rax + 0x74], 0xe
ja 0x45bc7e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call 0x45c3d0
add byte [rax - 0x39], cl
add eax, 0x240e5
Function at 0x140023d50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rdx
test ecx, ecx
jle 0x140023db9
mov qword [rsp], rbx
lea rbx, [0x140371430]
mov r11d, ecx
nop dword [rax + rax]
movzx r8d, word [r10]
lea r10, [r10 + 2]
lea ecx, [r8 - 0x61]
cmp ecx, 0x1a
sbb cx, cx
and cx, 0x20
sub r8w, cx
mov ecx, eax
shr eax, 8
movzx r9d, r8w
xor rcx, r9
shr r9, 8
movzx edx, cl
xor eax, dword [rbx + rdx*4]
mov ecx, eax
shr eax, 8
xor r9, rcx
movzx ecx, r9b
xor eax, dword [rbx + rcx*4]
sub r11, 1
jne 0x140023d70
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x140023e30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140026c50
ret
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, rcx
mov esi, 0xffffffff
lock xadd dword [rcx + 0x48], esi
sub esi, 1
jne 0x140026d46
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
test rcx, rcx
mov qword [rsp + 0x38], rbp
lea rbx, [r14 + 0x18]
mov qword [rsp + 0x40], rdi
cmovne rbx, rcx
mov edi, dword [r14 + 0x40]
test edi, edi
je 0x140026cb1
mov rcx, qword [rbx]
test rcx, rcx
je 0x140026ca4
call 0x140026c50
add rbx, 8
sub edi, 1
jne 0x140026c97
mov rcx, qword [r14 + 0x38]
mov rbp, qword [rsp + 0x38]
test rcx, rcx
je 0x140026cc0
call fcn.1400556b0
mov ecx, dword [0x14038c5a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x140026d04
lea ecx, [rax + 0x18]
call fcn.14001c7e0
mov rbx, rax
test rax, rax
je 0x140026cf2
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x140026cf5
mov rbx, rdi
mov ecx, dword [0x14038c5a0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x140026d2e
mov rdx, qword [rbx]
test rdx, rdx
je 0x140026d1e
lea rcx, [0x14038c5a8]
call fcn.140026b00
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x140026d32
mov rdi, qword [rbx + 8]
mov qword [r14], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r14
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140024630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14038c3e0]
jmp fcn.1400262e0
Function at 0x140025350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov ecx, dword [0x14038c3e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400253a1
lea ecx, [rax + 0xc]
call fcn.14001c7e0
mov rbx, rax
test rax, rax
je 0x14002538f
mov qword [rax], rsi
mov dword [rax + 8], esi
jmp 0x140025392
mov rbx, rsi
mov ecx, dword [0x14038c3e0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 8], 0x40
jl 0x1400253c2
mov edx, dword [rbx]
test edx, edx
je 0x1400253b9
lea rcx, [0x14038c3e8]
call fcn.140026a20
mov eax, dword [rbx + 4]
mov dword [rbx], eax
mov qword [rbx + 4], rsi
test edi, edi
jne 0x1400253cb
mov rcx, rsi
jmp 0x1400253ee
mov rcx, rdi
lea rdx, [0x1403842c8]
mov rax, rdi
shr rax, 0xe
and ecx, 0x3fff
mov rax, qword [rdx + rax*8]
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
and qword [rcx], 0xfffffffffc000000
mov dword [rcx + 0x10], esi
mov eax, dword [rbx + 4]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 8], rax
inc dword [rbx + 8]
mov dword [rbx + 4], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140025660
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
movss xmm0, dword [0x1402828c0]
jmp fcn.1400e9d60
Function at 0x140026b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
mov edi, dword [r14 + 0x40]
lea rbx, [r14 + 0x18]
cmovne rbx, rcx
test edi, edi
je 0x140026ba5
nop
mov rcx, rbx
call fcn.140023e30
add rbx, 8
sub edi, 1
jne 0x140026b90
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x140026baf
call fcn.1400556b0
mov ecx, dword [0x14038c5a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x140026bf3
lea ecx, [rax + 0x18]
call fcn.14001c7e0
mov rbx, rax
test rax, rax
je 0x140026be1
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
jmp 0x140026be4
mov rbx, rdi
mov ecx, dword [0x14038c5a0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [rbx + 0x10], 0x20
jl 0x140026c1d
mov rdx, qword [rbx]
test rdx, rdx
je 0x140026c0d
lea rcx, [0x14038c5a8]
call fcn.140026b00
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
jmp 0x140026c21
mov rdi, qword [rbx + 8]
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
inc dword [rbx + 0x10]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x14002ab30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
sub rsp, 0x50
movsxd rdi, dword [rcx + 8]
mov rbx, rdx
mov r12, rcx
test edi, edi
jne 0x14002ab56
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x48], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
cmp dword [rcx + 8], eax
je 0x14002ab9b
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002ab9b
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov rax, qword [rax + 0x38]
call qword [case.0x140041db8.0]
mov rax, qword [rax]
cmp rax, qword [rbx]
mov r15, rdi
setne al
xor edi, edi
mov byte [rsp + 0x70], al
nop word [rax + rax]
movsxd r14, ebp
inc rdi
inc ebp
cmp rdi, r15
jge 0x14002ac21
mov rdx, qword [rsp + 0x78]
mov rbx, rdi
shl rbx, 4
movzx esi, al
nop dword [rax]
mov rcx, qword [r12]
xor eax, eax
cmp dword [rcx + rbx + 8], eax
je 0x14002ac02
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x14002ac02
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
mov rax, qword [rax + 0x38]
call qword [case.0x140041db8.0]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, qword [rdx]
setne cl
cmp esi, ecx
jne 0x14002ac1c
inc ebp
inc rdi
add rbx, 0x10
cmp rdi, r15
jl 0x14002abd0
movzx eax, byte [rsp + 0x70]
mov esi, ebp
sub esi, r14d
test al, al
je 0x14002ac5b
cmp r13d, r14d
je 0x14002ac56
mov rdx, r14
movsxd rcx, r13d
shl rdx, 4
add rdx, qword [r12]
shl rcx, 4
add rcx, qword [r12]
movsxd r8, esi
shl r8, 4
call fcn.140260aa6
movzx eax, byte [rsp + 0x70]
add r13d, esi
jmp 0x14002acc0
mov rbx, r14
shl rbx, 4
add rbx, qword [r12]
test esi, esi
je 0x14002acc0
xor r14d, r14d
nop dword [rax]
cmp dword [rbx + 8], r14d
je 0x14002aca5
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002aca5
mov rax, qword [rcx]
xor edx, edx
mov rax, qword [rax]
call qword [case.0x140041db8.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002aca1
xor r8d, r8d
xor edx, edx
call fcn.14005fe10
mov qword [rbx], rax
mov dword [rbx + 8], r14d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002acb2
call fcn.1400556b0
add rbx, 0x10
sub esi, 1
jne 0x14002ac70
movzx eax, byte [rsp + 0x70]
xor al, 1
mov byte [rsp + 0x70], al
cmp rdi, r15
jl 0x14002abb0
mov r14, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x28]
sub eax, r13d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
Function at 0x14002b360
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
lea rax, [0x14028eb60]
mov rsi, rcx
mov qword [rcx], rax
mov rdi, rdx
add rcx, 8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r13d, r13d
mov qword [rsi + 0x58], rdi
lea rcx, [rsp + 0x20]
mov dword [rsi + 0x30], r13d
mov dword [rsi + 0x40], r13d
mov dword [rsi + 0x50], r13d
call fcn.1400e2f80
mov edx, dword [rax + 0x10]
test edx, edx
mov eax, 0x10000
cmove edx, eax
lea ecx, [rdx + 0x1fffff]
neg edx
mov eax, edx
and rcx, rax
call fcn.1400dc470
mov rcx, rsi
mov qword [rsi + 0x38], rax
call fcn.140035420
mov ecx, eax
call fcn.1400dc470
mov qword [rsi + 0x48], rax
test rax, rax
je 0x14002b409
mov rax, qword [rsi + 0x38]
test rax, rax
jne 0x14002b420
lea rcx, str.Memory_pools_allocations_failed__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400e8840
mov rax, qword [rsi + 0x38]
test al, 0xf
jne 0x14002b42a
test byte [rsi + 0x48], 0xf
je 0x14002b43d
lea rcx, str.OS_allocations_must_be_aligned_to_a_value_multiple_of_16__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400e8840
mov r15d, r13d
lea r12, [0x14036e2d0]
lea rdx, [0x14038cb68]
nop
movsxd rax, r15d
mov edi, r13d
imul rbx, rax, 0x4020
mov eax, dword [r12]
add rbx, rdx
add eax, 0x10
mov edx, dword [r12 + 4]
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x4018], edx
test edx, edx
je 0x14002b4cb
mov ebp, dword [rbx + 0x10]
mov rcx, rsi
mov r14d, dword [rsi + 0x50]
add ebp, r14d
call fcn.140035420
cmp ebp, eax
ja 0x14002b4a2
mov eax, r14d
mov dword [rsi + 0x50], ebp
add rax, qword [rsi + 0x48]
jmp 0x14002b4a5
mov rax, r13
lea rcx, [rax + 0x10]
mov qword [rax], r13
mov qword [rax + 8], rcx
mov ecx, edi
inc edi
mov qword [rbx + rcx*8 + 0x18], rax
mov edx, dword [rbx + 0x4018]
cmp edi, edx
jb 0x14002b480
cmp edx, 0x800
jae 0x14002b4ef
mov eax, edx
mov r8d, 0x800
sub r8d, edx
add rax, 3
shl r8, 3
xor edx, edx
lea rcx, [rbx + rax*8]
call fcn.140260ab0
mov edx, dword [rbx + 0x4018]
imul edx, dword [rbx + 0x10]
inc r15d
add r12, 8
add edx, 0x4000
mov dword [rbx + 0x401c], edx
lea rdx, [0x14038cb68]
cmp r15d, 0xe
jb 0x14002b450
lea r11, [rsp + 0xa0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002ce40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x38
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [0x1403ebb08], 0
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x58]
mulsd xmm0, qword [0x1403c81e0]
subsd xmm0, qword [0x1403e95f0]
cvttsd2si eax, xmm0
mov dword [0x1403c5768], eax
je 0x14002cee7
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x58]
sub rdi, qword [rsp + 0x50]
cmp rdi, qword [rax + 0x40]
jbe 0x14002cedb
xor ecx, ecx
call fcn.1400cd940
mov r9, qword [rsp + 0x50]
lea rdx, str.FGenericCrashContext::Initialize_Lambda
mov rcx, qword [0x1403ebb08]
mov r8d, eax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
mov rdi, qword [rsp + 0x30]
mov al, 1
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x140030a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140030a74
mov ebp, dword [rdx + 0x28]
jmp 0x140030a77
mov ebp, r12d
call fcn.140025430
mov rdi, rax
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140030aba
lea ecx, [rax + 0x18]
call fcn.14001c7e0
mov rbx, rax
test rax, rax
je 0x140030aac
mov qword [rax], r12
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
jmp 0x140030aaf
mov rbx, r12
mov ecx, dword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x140030b34
mov rax, qword [rbx]
test rax, rax
je 0x140030adf
mov edx, 0x20
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], edx
mov rcx, rax
mov qword [rbx], r12
jmp 0x140030b37
lea rcx, [rdi + 8]
call fcn.140026290
mov qword [rbx + 8], rax
test rax, rax
jne 0x140030b26
xor edx, edx
mov ecx, 0x2000
call fcn.14005e7b0
mov qword [rbx + 8], rax
mov edx, 0x1f
nop word [rax + rax]
lea rcx, [rax + 0x100]
mov qword [rax], rcx
mov rax, rcx
sub rdx, 1
jne 0x140030b10
mov qword [rcx], r12
mov rcx, qword [rbx + 8]
mov edx, 0x20
mov dword [rbx + 0x10], edx
jmp 0x140030b37
mov edx, dword [rbx + 0x10]
mov rax, qword [rcx]
mov rdi, qword [rsp + 0x58]
mov qword [rbx + 8], rax
lea eax, [rdx - 1]
mov dword [rbx + 0x10], eax
lea rax, [0x1402826d8]
mov rbx, qword [rsp + 0x40]
mov qword [rcx], rax
lea eax, [rbp + 1]
mov rbp, qword [rsp + 0x48]
mov dword [rcx + 8], 0xff
mov dword [rcx + 0xc], eax
lea rax, [0x140290920]
mov qword [rcx], rax
mov rax, r14
mov qword [r14 + 8], rsi
mov rsi, qword [rsp + 0x50]
mov byte [rcx + 0x28], r12b
mov qword [rcx + 0x30], r12
mov qword [r14], rcx
mov dword [r14 + 0x10], r15d
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140030ba0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140030bd4
mov ebp, dword [rdx + 0x28]
jmp 0x140030bd7
mov ebp, r12d
call fcn.140025430
mov rdi, rax
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140030c1a
lea ecx, [rax + 0x18]
call fcn.14001c7e0
mov rbx, rax
test rax, rax
je 0x140030c0c
mov qword [rax], r12
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
jmp 0x140030c0f
mov rbx, r12
mov ecx, dword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x140030c94
mov rax, qword [rbx]
test rax, rax
je 0x140030c3f
mov edx, 0x20
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], edx
mov rcx, rax
mov qword [rbx], r12
jmp 0x140030c97
lea rcx, [rdi + 8]
call fcn.140026290
mov qword [rbx + 8], rax
test rax, rax
jne 0x140030c86
xor edx, edx
mov ecx, 0x2000
call fcn.14005e7b0
mov qword [rbx + 8], rax
mov edx, 0x1f
nop word [rax + rax]
lea rcx, [rax + 0x100]
mov qword [rax], rcx
mov rax, rcx
sub rdx, 1
jne 0x140030c70
mov qword [rcx], r12
mov rcx, qword [rbx + 8]
mov edx, 0x20
mov dword [rbx + 0x10], edx
jmp 0x140030c97
mov edx, dword [rbx + 0x10]
mov rax, qword [rcx]
mov rdi, qword [rsp + 0x58]
mov qword [rbx + 8], rax
lea eax, [rdx - 1]
mov dword [rbx + 0x10], eax
lea rax, [0x1402826d8]
mov rbx, qword [rsp + 0x40]
mov qword [rcx], rax
lea eax, [rbp + 1]
mov rbp, qword [rsp + 0x48]
mov dword [rcx + 8], 0xff
mov dword [rcx + 0xc], eax
lea rax, [0x140290910]
mov qword [rcx], rax
mov rax, r14
mov qword [r14 + 8], rsi
mov rsi, qword [rsp + 0x50]
mov byte [rcx + 0x28], r12b
mov qword [rcx + 0x30], r12
mov qword [r14], rcx
mov dword [r14 + 0x10], r15d
add rsp, 0x20
pop r15
pop r14
pop r12
ret