joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d550
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14005d597
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14005d5b1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14005d58f
mov qword [rsi], rdi
call fcn.140065cd0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14005d5c7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140065cd0
mov rcx, qword [rsi]
call fcn.1400665e0
mov qword [rsi], 0
jmp 0x14005d57d
int3

Function at 0x14005d620
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x14005d6b7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14005d6a1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14005d67e
mov qword [rsi], rdi
call fcn.140065cd0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x14005d6bb
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140065cd0
mov rcx, qword [rsi]
call fcn.1400665e0
mov qword [rsi], 0
jmp 0x14005d66c
mov byte [rsi + 8], 1
int3
Function at 0x140065930
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.140066950
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140114300]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14006598d
jnp 0x1400659f2
ucomisd xmm0, xmm6
jne 0x140065999
jnp 0x140065b1c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1400ec9e0]
subpd xmm1, xmmword [0x1400ec9f0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1400f3d10]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400797f0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140114310]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140065b23
mov eax, dword [0x140114320]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140065b5d
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x140114318]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1400ec9e0]
subpd xmm1, xmmword [0x1400ec9f0]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1400f3d08]
ucomisd xmm2, xmm1
ja 0x14006598d
shl r15, 0x20
or r14, r15
sub r14, qword [0x140114308]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1400ec9e0]
subpd xmm0, xmmword [0x1400ec9f0]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x140114300], xmm0
jmp 0x14006598d
xor eax, eax
jmp 0x1400659cb
lea rcx, [0x140114310]
call fcn.140078a90
cmp dword [0x140114310], 0xffffffff
jne 0x140065a3c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140114308], rdx
lea rcx, [0x140114310]
call fcn.140078b28
jmp 0x140065a3c
lea rcx, [0x140114320]
call fcn.140078a90
cmp dword [0x140114320], 0xffffffff
jne 0x140065a61
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x140114318], rax
lea rcx, [0x140114320]
call fcn.140078b28
jmp 0x140065a61
Function at 0x14006b920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x14006b94c
xor ecx, ecx
lea r9, [0x1400f8e80]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 1
cmp r8, rcx
jne 0x14006b930
ret

Function at 0x14006d020
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14006d058
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x14006d062
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14006d069
add rdi, rbx
sub rsi, rbx
jne 0x14006d03a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x14006d042
int3

Function at 0x14006d410
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14010f5d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006d444
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14006d444
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14006d43e

Function at 0x14006d450
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14010f5d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006d48e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14006d487
call fcn.140042bb0
jmp 0x14006d46e
Function at 0x14006db20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x14006dba0
test rax, rax
jne 0x14006db8f
cmp dword [rsi + 0x50], 0
jne 0x14006db8f
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x14006db87
lea rdi, [rsi + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.140057870
cmp rax, 0xffffffffffffffff
jne 0x14006db79
cmp dword [rsi + 0x58], 1
jne 0x14006dbc3
jmp 0x14006dba6
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x14006db55
mov byte [rsi + 0x54], 1
xor ebx, ebx
jmp 0x14006dc0c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400d80a0
mov rax, qword [rsi + 0x40]
jmp 0x14006db34
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x14006dbc3
movabs rcx, 0x100003600
bt rcx, rax
jb 0x14006db79
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x14006dc0c
movabs r14, 0x100003600
nop dword [rax]
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.140057870
cmp rax, 0xffffffffffffffff
jne 0x14006dc0c
cmp dword [rsi + 0x58], 1
je 0x14006dc18
mov rax, qword [rsi + 0x10]
add rax, 1
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x14006dbe0
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsi + 0x10]
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x14006dbfe
bt r14, rcx
jae 0x14006dbfe
jmp 0x14006dc0c
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], 0
mov byte [rsp + 0x22], 0
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
cmp rax, rcx
je 0x1400d8102
mov edx, dword [rsi + 0x58]
movabs rdi, 0x100003600
cmp edx, 1
jne 0x1400d8102
movzx ebx, byte [rax]
cmp rbx, 0x20
ja 0x1400d8102
bt rdi, rbx
jae 0x1400d8102
inc rax
mov qword [rsi + 0x10], rax
cmp rcx, rax
jne 0x1400d80df
mov rax, rcx
cmp byte [rsi + 0x54], 0
sete dil
lea rbx, [rsp + 0x20]
test dil, 1
je 0x1400d813f
mov rdx, rcx
mov rcx, rax
mov byte [rsi + 0x54], 1
mov qword [rsi + 8], rcx
cmp rcx, rdx
je 0x1400d81a4
mov rax, rcx
inc rax
mov qword [rsi + 0x10], rax
xor edi, edi
test byte [rsi + 0x50], 1
mov rcx, rdx
je 0x1400d810f
jmp 0x1400d818a
mov byte [rsi + 0x54], 0
mov qword [rsi + 8], rax
cmp rax, rcx
je 0x1400d8178
mov r8b, byte [rax]
mov rcx, rsi
mov rdx, rbx
call fcn.1400d81b0
test al, al
je 0x1400d8184
mov rax, qword [rsi + 0x10]
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400d814c
mov rcx, rax
cmp qword [rsi + 8], rax
jne 0x1400d818a
test byte [rsi + 0x50], 2
jne 0x1400d818a
mov rdx, qword [rsi + 0x18]
jmp 0x1400d811b
mov rax, qword [rsi + 0x10]
jmp 0x1400d816f
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400797f0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400d818d
Function at 0x14006e580
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x14006e7f2
mov rsi, rcx
mov byte [rsp + 0x37], 0xaa
lea r14, [rcx + 0x718]
lea rbx, [rcx + 8]
mov edi, 1
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x14006e602
jmp 0x14006e7d1
pause
dec eax
jne 0x14006e5e1
add ebp, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r12d
cmp ebp, 0x3e8
jl 0x14006e5d2
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r14]
mov rdi, qword [rax]
test rdi, rdi
je 0x14006e7a8
mov byte [rsp + 0x37], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14006e62e
mov rdx, rcx
not rdx
cmp qword [rdi + 8], rdx
jne 0x14006e7f5
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xorps xmm6, xmm6
movups xmmword [rdi + 0x2d8], xmm6
movups xmmword [rdi + 0x2c8], xmm6
movups xmmword [rdi + 0x2b8], xmm6
movups xmmword [rdi + 0x2a8], xmm6
movups xmmword [rdi + 0x298], xmm6
mov qword [rdi + 0x2e8], 0
xor r14d, r14d
mov r8d, 0x291
mov rcx, rdi
xor edx, edx
call fcn.14007c0b0
mov qword [rdi + 0x2f0], rsi
movups xmmword [rdi + 0x2f8], xmm6
mov ebp, 1
lea rbx, [0x14010f5e0]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x14006e6db
jmp 0x14006e7e0
pause
dec eax
jne 0x14006e6b4
add r14d, ebp
add ebp, ebp
cmp ebp, 0x40
cmovge ebp, r12d
cmp r14d, 0x3e8
jl 0x14006e6a5
lea rcx, [0x14010f5e0]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov qword [rdi + 0x300], 0
mov rax, qword [0x14010f5e8]
mov qword [0x14010f5e8], rdi
mov qword [rdi + 0x2f8], rax
test rax, rax
je 0x14006e707
mov qword [rax + 0x300], rdi
lea rcx, [0x14010f5e0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add rsi, 0x10
mov eax, 0xa
jmp 0x14006e737
mov dword [rdi + rax - 2], 0
add rax, 0x10
add rsi, 0x28
cmp rax, 0x29a
je 0x14006e775
cmp qword [rsi], 0
je 0x14006e71f
mov ecx, dword [rsi + 0x18]
cmp ecx, 0x10000
jae 0x14006e7ef
mov word [rdi + rax], cx
cmp ecx, 0x80
jbe 0x14006e767
cmp ecx, 0x100
ja 0x14006e76e
mov byte [rdi + rax - 1], 0x40
jmp 0x14006e727
mov byte [rdi + rax - 1], 0x80
jmp 0x14006e727
mov byte [rdi + rax - 1], 0x20
jmp 0x14006e727
mov ecx, dword [0x140117fa0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400797f0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x308
mov rcx, r14
mov rdx, rsi
mov r8d, 2
call fcn.140050620
mov rdi, rax
jmp 0x14006e638
mov eax, edi
test edi, edi
jg 0x14006e5e1
jmp 0x14006e5e9
mov eax, ebp
test ebp, ebp
jg 0x14006e6b4
jmp 0x14006e6bd
int3
int3
call 0x1400a5820
int3
Function at 0x1400700a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140118020]
cmp rsi, 1
jbe 0x1400700c3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14006d450
lea rcx, [0x140118020]
call fcn.1400407a0
test al, al
je 0x140070109
mov qword [0x140118028], 0
lea rdi, [0x140118020]
lea rsi, [0x140118028]
mov rcx, rsi
xor edx, edx
call fcn.140042ce0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140040840
jmp 0x1400700b3
mov rsi, qword [0x140118020]
jmp 0x1400700b3

Function at 0x1400710b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140118060]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400710e5
lea rcx, [0x140118058]
add rsp, 0x28
jmp fcn.14006d410
lea rcx, [0x140118060]
call fcn.140078a90
cmp dword [0x140118060], 0xffffffff
jne 0x1400710d5
mov qword [0x140118058], 0
lea rcx, [0x140118058]
xor edx, edx
call fcn.140042ce0
lea rcx, [0x140118060]
call fcn.140078b28
jmp 0x1400710d5

Function at 0x1400775a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401189e8]
cmp rsi, 1
jbe 0x1400775c3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14006d450
lea rcx, [0x1401189e8]
call fcn.1400407a0
test al, al
je 0x140077609
mov qword [0x1401189f0], 0
lea rdi, [0x1401189e8]
lea rsi, [0x1401189f0]
mov rcx, rsi
xor edx, edx
call fcn.140042ce0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140040840
jmp 0x1400775b3
mov rsi, qword [0x1401189e8]
jmp 0x1400775b3

Function at 0x140077620
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140118a00]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007765d
lea rcx, [0x1401189f8]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14006d450
lea rcx, [0x140118a00]
call fcn.140078a90
cmp dword [0x140118a00], 0xffffffff
jne 0x140077649
mov qword [0x1401189f8], 0
lea rcx, [0x1401189f8]
xor edx, edx
call fcn.140042ce0
lea rcx, [0x140118a00]
call fcn.140078b28
jmp 0x140077649
Function at 0x140078810
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140118a10]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400788b2
lea rcx, [0x140118a08]
xor edx, edx
call fcn.14006d450
mov eax, dword [0x140118a20]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140078876
lea rcx, [0x140118a18]
xor edx, edx
add rsp, 0x28
jmp fcn.14006d450
lea rcx, [0x140118a20]
call fcn.140078a90
cmp dword [0x140118a20], 0xffffffff
jne 0x140078864
mov qword [0x140118a18], 0
lea rcx, [0x140118a18]
xor edx, edx
call fcn.140042ce0
lea rcx, [0x140118a20]
call fcn.140078b28
jmp 0x140078864
lea rcx, [0x140118a10]
call fcn.140078a90
cmp dword [0x140118a10], 0xffffffff
jne 0x140078835
mov qword [0x140118a08], 0
lea rcx, [0x140118a08]
xor edx, edx
call fcn.140042ce0
lea rcx, [0x140118a10]
call fcn.140078b28
jmp 0x140078835
Function at 0x1400a5a20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov al, 1
xchg byte [rcx + 0xb0], al
test al, 1
je 0x1400a5a58
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400797f0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov edi, edx
mov rbx, rcx
xor eax, eax
xchg qword [rcx + 0x90], rax
mov qword [rcx + 0xa8], rax
lock inc qword [rcx + 0xa0]
mov ecx, 0x58
call fcn.1400a5b00
mov rsi, rax
mov rcx, rax
mov rdx, rbx
call fcn.1400a5de0
cmp edi, 1
jne 0x1400a5aa9
call fcn.1400a6170
lea rdx, [rsp + 0x20]
mov qword [rdx], rsi
mov rcx, rax
call fcn.1400a6230
jmp 0x1400a5a42
mov rcx, rsi
call fcn.1400a62f0
test rsi, rsi
je 0x1400a5a42
lea rcx, [rsi + 0x40]
mov rdx, qword [rsi + 0x48]
call fcn.1400a64e0
mov rcx, rsi
add rcx, 0x28
call fcn.1400a6830
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400a5ae1
mov qword [rsi + 0x18], rcx
call fcn.1400a6b70
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400797f0
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.1400a6b70
Function at 0x1400a6230
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.140056e00
mov rax, qword [rsi]
mov qword [rsi], 0
mov rbx, qword [rdi + 0x10]
mov qword [rdi + 0x10], rax
test rbx, rbx
jne 0x1400a6284
mov rcx, rdi
call fcn.140056e30
add rdi, 8
mov rcx, rdi
call fcn.14001da10
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
jne 0x1400a62b6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [rbx + 0x40]
mov rdx, qword [rbx + 0x48]
call fcn.1400a64e0
lea rcx, [rbx + 0x28]
call fcn.1400a6830
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400a62ac
mov qword [rbx + 0x18], rcx
call fcn.1400a6b70
mov rcx, rbx
call fcn.1400a6b70
jmp 0x1400a6259
lea rcx, [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
call fcn.1400a64e0
lea rcx, [rdi + 0x28]
call fcn.1400a6830
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400a62de
mov qword [rdi + 0x18], rcx
call fcn.1400a6b70
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400a6b70
Function at 0x1400a92a0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.1400a6eb0
mov rsi, rax
mov r15, rax
mov byte [rsp + 0x37], 0
cmp byte [rax + 2], 0
je 0x1400a936d
mov edi, dword [0x140117fa0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test ebx, ebx
jne 0x1400a9363
cmp rdi, 1
jbe 0x1400a93fe
inc qword [rdi + 0x298]
mov rbx, qword [rdi + 0xc0]
test rbx, rbx
je 0x1400a9428
inc qword [rdi + 0x2a0]
mov rax, qword [rbx]
test rax, rax
je 0x1400a9334
mov rcx, rax
not rcx
cmp qword [rbx + 8], rcx
jne 0x1400a949e
bswap rax
dec byte [rdi + 0xc8]
mov qword [rdi + 0xc0], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400797f0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400a92f4
lea r14, [rsi + 0x1f0]
add rsi, 8
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, rsi
call r12
test al, al
jne 0x1400a93ba
jmp 0x1400a94a3
pause
dec eax
jne 0x1400a939a
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x1400a938b
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r14]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400a94ba
mov byte [rsp + 0x37], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a93e6
mov rdx, rcx
not rdx
cmp qword [rbx + 8], rdx
jne 0x1400a949e
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x1400a9344
je 0x1400a9453
mov byte [r15 + 2], 0
mov rcx, r15
call fcn.14006e580
mov rdi, rax
mov byte [r15 + 2], 1
inc qword [rax + 0x298]
mov rbx, qword [rax + 0xc0]
jmp 0x1400a930c
inc qword [rdi + 0x2b0]
inc qword [rdi + 0x2a8]
mov edx, 0xc
mov rcx, rdi
call fcn.14006e800
mov rbx, qword [rdi + 0xc0]
test rbx, rbx
jne 0x1400a931c
lea r14, [rsi + 0x1f0]
add rsi, 8
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, rsi
call r12
test al, al
jne 0x1400a93ba
jmp 0x1400a94b2
pause
dec eax
jne 0x1400a9481
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x1400a9471
jmp 0x1400a93b2
call 0x1400a5820
mov eax, edi
test edi, edi
jg 0x1400a939a
jmp 0x1400a93a2
mov eax, edi
test edi, edi
jg 0x1400a9481
jmp 0x1400a9489
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140050620
mov rbx, rax
jmp 0x1400a93f0
Function at 0x1400c6c60
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140078938
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400c6cd0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400868b0
mov qword [rbx], rax
test rax, rax
je 0x1400c6cb7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400c8720
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x17], 0
jns 0x1400c872d
mov rcx, qword [rcx]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400c8f10
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401141b8]
test rax, rax
je 0x1400c9054
cmp eax, 2
jne 0x1400c8f8c
mov ecx, 2
call fcn.140064750
test al, al
je 0x1400c9024
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140033a00
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400c9017
mov eax, 1
lock xadd qword [0x1401141f0], rax
test rax, rax
jle 0x1400c8fac
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140114170], eax
mov qword [0x140114168], rsi
mov rcx, qword [0x14010e288]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140064750
test al, al
je 0x1400c9024
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xaf
mov r9d, 2
call fcn.140033a00
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140051090
mov rcx, rsi
call fcn.140033ea0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400797f0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401141b8]
test rax, rax
je 0x1400c905b
jmp 0x1400c8f3e