joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002ff0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180007040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
test edx, edx
je 0x180003123
cmp edx, 1
jne 0x180003170
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1800024a0
test al, al
je 0x180003113
mov rax, qword [0x1800077b8]
mov rcx, qword [rax]
test rcx, rcx
je 0x180003113
mov rax, qword [rcx + 0xb0]
mov qword [0x1800077b0], rax
test rax, rax
je 0x180003113
mov rax, qword [rcx + 0x788]
test rax, rax
je 0x180003113
mov rcx, qword [rax]
test rcx, rcx
je 0x180003113
lea rbx, [rcx + 0x308]
mov edx, 8
mov rax, qword [rbx]
lea r9, [rsp + 0x30]
mov rcx, rbx
mov qword [0x1800077a8], rbx
mov qword [0x1800077a0], rax
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180003113
mov r8d, dword [rsp + 0x30]
lea rax, section..text
lea r9, [rsp + 0x30]
mov qword [rbx], rax
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180003113
xor eax, eax
mov byte [0x1800077d8], 1
mov qword [rsp + 0x28], rax
lea r8, [0x180002fb0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
mov qword [0x1800077d0], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000311a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [0x1800077d8]
jmp 0x180003175
mov byte [0x1800077d8], 0
movzx eax, byte [0x1800077d8]
jmp 0x180003175
cmp byte [0x1800077d8], 0
je 0x180003170
mov rbx, qword [0x1800077a8]
lea r9, [rsp + 0x30]
mov edx, 8
mov rcx, rbx
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180003170
mov rax, qword [0x1800077a0]
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, 8
mov rcx, rbx
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800031a0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x141a8f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141a8f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141a8f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a8f06f
add dl, dl
jne 0x141a8f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a8f0f6
xor eax, eax
add dl, dl
jne 0x141a8f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a8f1ad
add dl, dl
jne 0x141a8f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a8f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a8f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a8f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141a8f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141a8f07e
mov eax, 1
add dl, dl
jne 0x141a8f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a8f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a8f0fb
sub eax, ebx
mov ebx, 1
jne 0x141a8f14c
mov ecx, 1
add dl, dl
jne 0x141a8f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a8f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a8f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a8f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141a8f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a8f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a8f15d
cmp eax, 0x7d00
jae 0x141a8f19b
cmp eax, 0x500
jb 0x141a8f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a8f07e
cmp eax, 0x7f
ja 0x141a8f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a8f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141a8f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141a8f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400046d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x140004733
mov rax, qword [rax + 8]
test rax, rax
je 0x140004733
mov rcx, qword [rax]
test rcx, rcx
je 0x140004733
mov qword [rax], rsi
movzx eax, byte [rcx]
cmp rax, rbx
jb 0x14000472e
mov byte [rcx + rdi], al
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call fcn.140067248
lea rcx, [rbx*4 + 1]
call fcn.140066e10
cmp rbx, 0xff
movzx ecx, bl
cmova ecx, esi
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004760
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000478d
mov r8, qword [rax + 8]
jmp 0x140004790
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x1400047b4
test r8, r8
je 0x1400047b4
cmp qword [r8], 0
jne 0x1400047b4
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
mov qword [r8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140067248
Function at 0x140004ad0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
test rax, rax
jne 0x140004b33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066c50
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140004c36
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x140004b80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066c50
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140004c48
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x140004c60]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
jne 0x140004bf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x140004bd4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140004be3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
call fcn.140066c50
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140004c24
test rdi, rdi
je 0x140004c11
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.140004440
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.140004440
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.140004440
int3
Function at 0x1400057b0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x14009a2c0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r14, rcx
mov qword [rsp + 0x38], rcx
mov ecx, 0x38
call fcn.140066e10
mov rdi, rax
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1400047e0
mov ebx, eax
call fcn.140066c50
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rax
test ebx, ebx
jne 0x14000598d
mov qword [rdi + 0x28], r14
xor ebx, ebx
mov qword [rdi + 0x30], rbx
mov qword [r14], rdi
mov eax, 1
lock xadd dword [0x14009ec98], eax
inc eax
cmp eax, 1
jne 0x14000584f
lea ecx, [rbx + 2]
lea rdx, [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14009ec9c], eax
lock xadd dword [0x14009ec9c], ebx
test ebx, ebx
jne 0x14000599f
mov ecx, 0xa8
call fcn.140066e10
mov qword [rsp + 0x30], rax
lea r8d, [rbx - 1]
mov rdx, r14
mov rcx, rax
call fcn.140004d30
mov r15, rax
mov qword [rsp + 0x30], rax
mov rbp, qword [r14]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14001d9e0
mov rax, qword [r15 + 0x18]
cmp qword [rbp + 0x28], rax
jne 0x140005965
mov qword [rsp + 0x40], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x48], 1
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x140005911
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400058e8
test rdi, rdi
je 0x1400058e8
cmp rax, rdi
je 0x140005979
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140005908
test rsi, rsi
je 0x140005908
lea rdx, [rsi + 8]
add rcx, 8
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x140005979
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x1400058d1
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r15 + 8], xmm0
mov rdx, qword [rbp + 0x30]
mov qword [r15 + 0x20], rdx
mov qword [rbp + 0x30], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov qword [r14 + 0x10], r15
mov rax, r14
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140066cd0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, [rsp + 0x50]
call fcn.1400049a0
nop
mov rcx, rax
call fcn.140014f40
nop
lea rcx, [rsp + 0x68]
call fcn.140004950
nop
mov rcx, rax
call fcn.140014f80
nop
lea rdx, str.mutex
lea rcx, [rsp + 0x20]
call fcn.140004440
nop
call fcn.140066c50
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], rax
lea rdx, str.winsock
lea rcx, [rsp + 0x20]
call fcn.140004440
int3
Function at 0x140005b00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.140066c50
mov qword [rsp + 0x28], rax
mov rbx, qword [rbx + 0x10]
mov eax, edi
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x140005ba0
mov ecx, 1
mov eax, ecx
xchg dword [rbx + 0x34], eax
test eax, eax
jne 0x140005b75
xchg dword [rbx + 0x38], ecx
test ecx, ecx
jne 0x140005b75
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x140005b75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x40], eax
call fcn.140066c50
mov qword [rsp + 0x48], rax
test ebx, ebx
jne 0x140005c79
mov dword [rsp + 0x40], edi
call fcn.140066c50
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
jmp 0x140005c56
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400053b0
test rax, rax
je 0x140005c26
nop dword [rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
lea r8, [rsp + 0x20]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400053b0
test rax, rax
jne 0x140005c00
mov rdx, qword [rsp + 0x60]
mov ecx, dword [0x14009eca4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140005c47
call fcn.140067248
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005c56
call fcn.140067248
cmp dword [rsp + 0x20], 0
jne 0x140005c6e
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.140004400
int3
lea rdx, str.pqcs
lea rcx, [rsp + 0x40]
call fcn.140004440
int3
mov rcx, qword [rcx + 0x18]
jmp 0x140005b00
Function at 0x140012720
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14009a2c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x14009ec98], eax
inc eax
cmp eax, 1
jne 0x14001276d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14009ec9c], eax
test dil, dil
je 0x140012780
xor eax, eax
lock xadd dword [0x14009ec9c], eax
test eax, eax
jne 0x1400127a4
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140066cd0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov dword [rsp + 0x20], eax
call fcn.140066c50
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.140004440
int3
Function at 0x140014fc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x40
xor r14d, r14d
mov rbp, rcx
mov qword [rcx + 8], r14
mov rbx, rdx
mov qword [rcx + 0x10], r14
lea ecx, [r14 + 0x20]
call fcn.140066e10
mov rdi, rax
mov qword [rsp + 0x60], rax
lea rax, vtable.boost::asio::detail::win_thread::func_struct_boost::asio::detail::win_iocp_io_context::timer_thread_function_.0
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
mov qword [rdi], rax
mov qword [rdi + 0x18], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 8], rax
mov rsi, rax
test rax, rax
jne 0x14001504f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi]
lea edx, [rsi + 1]
mov rcx, rdi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066c50
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140015158
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rdi + 0x10], rax
cmp qword [rbp + 0x10], r14
jne 0x14001509b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
mov ebx, eax
call qword [r8]
mov dword [rsp + 0x30], ebx
call fcn.140066c50
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x14001516a
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x28], rax
lea r8, [0x140004c60]
mov r9, rdi
mov dword [rsp + 0x20], r14d
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 8], rax
test rax, rax
jne 0x140015114
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
mov ebx, eax
call qword [r8]
test rsi, rsi
je 0x1400150f3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140015102
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
call fcn.140066c50
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x140015146
test rsi, rsi
je 0x140015130
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x68]
mov rax, rbp
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.140004440
int3
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.140004440
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.140004440
int3

Function at 0x14002b010
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
jne 0x14002b03d
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002b03d
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv_s]
mov rbx, qword [rsp + 0x30]
test eax, eax
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x14002bcf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebp, ebp
lea rbx, [rcx + 0x28]
mov qword [rsp + 0x58], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14002be76
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14002be81
cmp qword [rdi + 0x78], rbp
je 0x14002bd40
mov eax, 3
lock cmpxchg dword [rdi + 0x80], ebp
jmp 0x14002bdd1
mov eax, ebp
xchg dword [rdi + 0x80], eax
mov ecx, SafeArrayGetElemsize
call fcn.140066e10
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002bdaa
mov ecx, 8
call fcn.140066e10
test rax, rax
je 0x14002bd73
mov qword [rax], rdi
jmp 0x14002bd76
mov rax, rbp
mov qword [rsp + 0x60], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x14002b9c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14002be69
jmp 0x14002bdad
mov rbx, rbp
mov rcx, qword [rdi + 0x78]
mov qword [rdi + 0x78], rbx
test rcx, rcx
je 0x14002bdd1
cmp dword [rcx + 8], 0
je 0x14002bdc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov edx, SafeArrayGetElemsize
call fcn.140067250
mov eax, dword [rdi + 0x80]
nop
test eax, eax
jne 0x14002be53
movabs rbp, 0x7fffffffffffb1df
movabs rsi, 0x7fffffffffffffff
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14002be0c
imul rax, rax, 0x64
jmp 0x14002be27
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rbp
jge 0x14002be39
add rax, 0x4e20
mov qword [rsp + 0x50], rax
jmp 0x14002be3e
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x50]
call fcn.14001b100
mov eax, dword [rdi + 0x80]
nop
test eax, eax
je 0x14002bdf0
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp fcn.140065c8e
mov dword [rsi], ebp
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140038d00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rbp, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140038f16
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rbp + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x58], r14
inc ecx
shl rdi, cl
lea rcx, [rbp + 0x18]
lea rdx, [rdi + rdi]
call fcn.140038bb0
mov rcx, qword [rbp + 8]
lea rax, [rdi - 1]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140038edf
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r12
mov r12d, 0xe6546b64
mov qword [rsp + 0x20], r15
movabs r15, 0xc6a4a7935bd1e995
nop word [rax + rax]
mov rdx, qword [rdx]
lea r11, [rcx + 0x18]
lea rdi, [r11 + 0x20]
xor eax, eax
mov r10, r11
cmp r11, rdi
je 0x140038de8
nop word [rax + rax]
mov r8, qword [r10]
add r10, 8
imul r8, r15
mov r9, r8
shr r9, 0x2f
xor r9, r8
imul r9, r15
xor rax, r9
imul rax, r15
add rax, r12
cmp r10, rdi
jne 0x140038dc0
and rax, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x18]
shl rax, 4
add rdi, rax
mov r9, qword [rdi]
cmp r9, rbx
jne 0x140038e0b
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
jmp 0x140038ec4
mov rax, qword [rdi + 8]
mov rsi, qword [r11]
cmp rsi, qword [rax + 0x18]
jne 0x140038e65
mov r8, qword [rax + 0x20]
cmp qword [r11 + 8], r8
jne 0x140038e65
mov r8, qword [rax + 0x28]
cmp qword [r11 + 0x10], r8
jne 0x140038e65
mov r8, qword [rax + 0x30]
cmp qword [r11 + 0x18], r8
jne 0x140038e65
mov r10, qword [rax]
cmp r10, rcx
je 0x140038e5f
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi + 8], rcx
jmp 0x140038ec4
mov r10, rax
cmp r9, rax
je 0x140038ea0
nop dword [rax]
mov rax, qword [rax + 8]
mov r10, rax
cmp rsi, qword [rax + 0x18]
jne 0x140038e9b
mov r8, qword [rax + 0x20]
cmp qword [rcx + 0x20], r8
jne 0x140038e9b
mov r8, qword [rax + 0x28]
cmp qword [rcx + 0x28], r8
jne 0x140038e9b
mov r8, qword [rax + 0x30]
cmp qword [rcx + 0x30], r8
je 0x140038ef0
cmp r9, rax
jne 0x140038e70
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [rdi], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140038da0
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
add rsp, 0x28
pop rdi
pop rbp
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140038ec4
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3