joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c0a10
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r14
sub rsp, 0x90
mov qword [rax - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, rdx
mov rdi, rcx
call fcn.100068a00
mov rsi, rax
mov r8, qword gs:[0x30]
lea rbx, [r8 + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0a66
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000c0a77
mov rdx, qword [rbx + 0xd8]
test rdx, rdx
jne 0x1000c0aaf
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0aa8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rdx, qword [rsi + 0xd8]
mov rcx, rdi
call fcn.1000c13e0
mov dword [rsp + 0x30], 0
xor edx, edx
lea rax, [0x100062030]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x68]
call fcn.10005b410
nop
mov rdx, r14
mov rcx, rdi
call fcn.10010fde0
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x68]
call fcn.10005b4f0
nop
jmp 0x1000c0b02
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0b2d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000c0b3e
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000c0b75
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0b6e
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000c0b83
call fcn.1000618f0
mov qword [rdi + 0x550], 0
mov eax, 0xffff7fff
lock xadd dword [rdi + 0x530], eax
cmp eax, 0x8001
je 0x1000c0bba
lea rcx, [rdi + 0x508]
call fcn.1000931d0
lea rcx, [rdi + 0x4e0]
call fcn.1000931d0
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1000c0be0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, edx
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0c2b
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000c0c3c
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x1000c0c73
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0c6c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rsi, qword [rbx + 0x3f8]
lea rax, [0x1000610e0]
mov rdx, rbx
mov rcx, rbp
mov qword [rbx + 0x3f8], rax
call fcn.1000c13e0
mov edx, r14d
mov rcx, rbp
call fcn.10010fe50
mov qword [rbp + 0x550], 0
mov eax, 0xffff7fff
lock xadd dword [rbp + 0x530], eax
cmp eax, 0x8001
je 0x1000c0cd5
lea rcx, [rbp + 0x508]
call fcn.1000931d0
lea rcx, [rbp + 0x4e0]
call fcn.1000931d0
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x3f8], rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1000c0d00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0d42
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000c0d53
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x1000c0d8a
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0d83
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rsi, qword [rbx + 0x3f8]
lea rax, [0x1000610e0]
mov rdx, rbx
mov rcx, rbp
mov qword [rbx + 0x3f8], rax
call fcn.1000c13e0
mov rcx, rbp
call fcn.10010fe60
mov qword [rbp + 0x550], 0
mov eax, 0xffff7fff
lock xadd dword [rbp + 0x530], eax
cmp eax, 0x8001
je 0x1000c0de9
lea rcx, [rbp + 0x508]
call fcn.1000931d0
lea rcx, [rbp + 0x4e0]
call fcn.1000931d0
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x3f8], rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1000c0e10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, edx
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0e5b
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000c0e6c
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x1000c0ea3
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c0e9c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rsi, qword [rbx + 0x3f8]
lea rax, [0x1000610e0]
mov rdx, rbx
mov rcx, rbp
mov qword [rbx + 0x3f8], rax
call fcn.1000c13e0
mov edx, r14d
mov rcx, rbp
call fcn.10010fe70
mov qword [rbp + 0x550], 0
mov eax, 0xffff7fff
lock xadd dword [rbp + 0x530], eax
cmp eax, 0x8001
je 0x1000c0f05
lea rcx, [rbp + 0x508]
call fcn.1000931d0
lea rcx, [rbp + 0x4e0]
call fcn.1000931d0
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x3f8], rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1000c6d70
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r15, rdx
mov rdi, rcx
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x18], r12
mov dword [rcx + 0x20], r12d
mov qword [rcx + 0x10], r12
test r8, r8
je 0x1000c6f1a
test r9d, r9d
je 0x1000c6f1a
mov qword [rcx + 0x18], r8
mov dword [rcx + 0x20], r9d
mov dword [rax - 0x50], 0x40006f
mov qword [rax - 0x48], r12
mov qword [rax - 0x38], r12
mov qword [rax - 0x40], r12
mov qword [rax - 0x30], r12
lea edx, [r12 + 1]
lea rcx, [rax - 0x60]
call fcn.100057f20
nop
mov ebp, dword [rdi + 0x20]
mov rbx, qword [rdi + 0x18]
call fcn.100068a00
mov r14, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c6e1f
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rsi, rsi
je 0x1000c6e30
mov rsi, qword [rsi + 0xd8]
test rsi, rsi
jne 0x1000c6e68
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rcx, qword gs:[0x30]
lea r14, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c6e61
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov rsi, qword [r14 + 0xd8]
mov rcx, qword [rsi + 0x210]
test rcx, rcx
je 0x1000c6e9e
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x1000c6e9e
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x1000c6e9e
mov eax, dword [rax + 0x2d8]
test al, al
js 0x1000c6e9e
bt eax, 8
jae 0x1000c6f09
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx], edx
mov ecx, r12d
sete cl
test ecx, ecx
jne 0x1000c6ebd
mov rcx, rbx
call fcn.100076600
cmp ebp, 1
jne 0x1000c6ed6
cmp dword [rbx + 0x20], 2
je 0x1000c6ee9
cmp dword [rbx + 0x1c], 0
jne 0x1000c6ee9
inc dword [rbx + 0x18]
mov dword [rbx + 0x20], ebp
jmp 0x1000c6ee4
cmp ebp, 2
jne 0x1000c6ee9
cmp dword [rbx + 0x20], 0
jne 0x1000c6ee9
mov dword [rbx + 0x20], ebp
mov dword [rbx], r12d
jmp 0x1000c6f00
lea r9, [rsp + 0x38]
or r8d, 0xffffffff
mov edx, ebp
mov rcx, rbx
call fcn.1001049c0
test eax, eax
jne 0x1000c6f09
cmp ebp, 2
jne 0x1000c6f09
mov qword [rbx + 0x28], rsi
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
not eax
and dword [rcx + 0x220], eax
mov qword [rdi + 0x10], r15
mov rcx, r15
call fcn.1000c68d0
mov qword [rdi], rax
mov rcx, r15
call fcn.1000c6980
mov qword [rdi + 8], rax
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1000c7a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r12, r8
mov r15, rdx
mov edi, r13d
movzx ebx, r13w
mov r14, rcx
call fcn.10006bec0
test eax, eax
je 0x1000c7ae1
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
nop dword [rax]
movzx edx, bx
mov rcx, r15
call fcn.1000f3360
movzx ecx, bx
mov rcx, qword [r14 + rcx*8 + 0x20]
mov rbp, rax
test rcx, rcx
jne 0x1000c7ab1
lea r9, [rsp + 0x68]
mov r8, r12
movzx edx, bx
mov rcx, r14
mov qword [rsp + 0x68], r13
call fcn.1000c7f70
mov rsi, qword [rsp + 0x68]
or edi, eax
test rsi, rsi
je 0x1000c7ac4
mov rdx, rbp
mov rcx, rsi
call fcn.1001015c0
or edi, eax
mov eax, dword [rsi + 0x590]
mov ecx, eax
xor ecx, 0x10
and ecx, eax
mov dword [rsi + 0x590], ecx
jmp 0x1000c7ac4
test byte [rcx + 0x590], 0x10
jne 0x1000c7ac4
mov rdx, rax
call fcn.1001015c0
or edi, eax
inc bx
call fcn.10006bec0
movzx ecx, bx
cmp ecx, eax
jb 0x1000c7a50
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000c8a80
Capabilities:
Get thread local storage value
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x290
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, ecx
mov dword [rsp + 0x20], ecx
call fcn.10006c870
test eax, eax
je 0x1000c8ad9
lea rcx, [rsp + 0x30]
call fcn.10006c820
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.10006c890
lea rcx, [rsp + 0x30]
call fcn.10006c8a0
call fcn.100058010
xor esi, esi
test rax, rax
setne sil
test esi, esi
je 0x1000c8b76
call fcn.100068a00
mov r14, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c8b1c
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000c8b2d
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x1000c8b66
call fcn.100063d30
call fcn.100068a00
mov r14, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000c8b5f
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
test byte [rax + 0x2d8], 4
jne 0x1000c8b76
xor ecx, ecx
call fcn.1000cd440
mov rcx, qword [0x100278500]
test rcx, rcx
je 0x1000c8b8b
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 2
call fcn.100115430
call fcn.10006bd20
test eax, eax
je 0x1000c8bac
call fcn.100114040
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test esi, esi
je 0x1000c8bbe
call fcn.10006b940
test eax, eax
je 0x1000c8bbe
call fcn.1000cc930
jmp 0x1000c8bc4
call fcn.100114040
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
cmp eax, 0x7fffffff
je 0x1000c8bf8
cmp eax, 1
jge 0x1000c8bf8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10005f420
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1000c9120
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x40]
xor ebp, ebp
call fcn.1000f2980
call fcn.10006af00
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x80], xmm1
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0xa0], xmm1
movups xmm0, xmmword [rax + 0x60]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x70]
movaps xmmword [rsp + 0xc0], xmm1
call fcn.1000f3550
lea rcx, [rsp + 0x20]
call fcn.1000f3580
call fcn.100109770
lea rdx, [rsp + 0xd0]
mov rsi, qword [rax]
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.1000f35f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x40]
mov r8, rbx
mov rcx, rdi
mov rdx, rax
call qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
je 0x1000c9208
mov esi, 5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
cmp eax, ebx
je 0x1000c9230
rdtsc
shl rdx, 0x20
sub r11d, ebx
or rax, rdx
xor edx, edx
mov ecx, r11d
sub rax, rdi
div rcx
imul rax, rax
add rbp, rax
dec rsi
jne 0x1000c9217
call fcn.100109770
mov rbx, rax
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [rsp + 0x40]
mov rdx, rax
xor r9d, r9d
mov rcx, rbx
call qword [rdi + 0x30]
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
test rbp, rbp
jns 0x1000c9297
addsd xmm0, qword [0x100004e90]
divsd xmm0, qword [0x1000225d0]
call sub.MSVCR100.dll_sqrt
movsd xmm1, qword [0x100004e88]
xor eax, eax
comisd xmm0, xmm1
jbe 0x1000c92cb
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x1000c92cb
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si rcx, xmm0
add rcx, rax
call fcn.1000cd270
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.10005f420
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1000cb590
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x68], 0
call fcn.100109770
mov r9, qword [rax]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [r9 + 0x50]
test eax, eax
je 0x1000cb5e9
xor edx, edx
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0
lea r8d, [rdx + 0x2c]
call sub.MSVCR100.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x58
ret
mov ecx, dword [rsp + 0x60]
call fcn.10006b870
mov ecx, dword [rsp + 0x68]
call fcn.10006b890
add rsp, 0x58
ret
Function at 0x1000cc460
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r13d, r13d
lea rcx, [r11 - 0xb8]
call fcn.10006ae10
xor r14d, r14d
call fcn.10006bea0
test eax, eax
je 0x1000cc6b5
nop dword [rax]
mov ecx, r14d
call fcn.10006bde0
mov rsi, rax
cmp dword [rax + 0x18], 0
je 0x1000cc4e5
test r13d, r13d
jne 0x1000cc4e5
mov rbx, qword [0x100278968]
mov r13d, 1
jmp 0x1000cc4f5
call fcn.10006add0
mov rcx, rax
call fcn.100081ff0
mov rbx, rax
test rbx, rbx
je 0x1000cc6ae
xor edi, edi
cmp dword [rsi + 0x18], edi
setne dil
test edi, edi
je 0x1000cc51b
lea rcx, [rsi + 8]
xor edx, edx
call fcn.1000f2a60
mov r12d, eax
jmp 0x1000cc51e
xor r12d, r12d
mov dword [rsp + 0x24], edi
test edi, edi
je 0x1000cc5b8
call fcn.100068a00
mov r15, rax
mov rcx, qword gs:[0x30]
lea rbp, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cc557
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rbp, rbp
je 0x1000cc568
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
jne 0x1000cc5a1
call fcn.100063d30
call fcn.100068a00
mov r15, rax
mov rcx, qword gs:[0x30]
lea rbp, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cc59a
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov rcx, qword [rbp + 0xd8]
mov dword [rcx + 0x7c], r12d
mov edx, r12d
mov rcx, qword [rcx + 0x228]
call fcn.100089910
mov dword [rsp + 0x20], eax
mov word [rbx + 0x80], r14w
mov rcx, rbx
call fcn.1000842c0
lea rcx, [rsp + 0x30]
call fcn.1000f2e20
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x30]
call fcn.1000f3280
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.1000f2ea0
cmp dword [rsi + 0x18], 0
je 0x1000cc606
lea rcx, [rsp + 0x30]
call fcn.1000f33d0
test eax, eax
je 0x1000cc60d
or dword [rbx + 0x4120], 2
test edi, edi
je 0x1000cc69b
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cc640
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cc651
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000cc688
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cc681
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov edx, dword [rsp + 0x20]
mov dword [rcx + 0x7c], edx
mov rcx, qword [rcx + 0x228]
call fcn.100089910
inc r14d
call fcn.10006bea0
cmp r14d, eax
jb 0x1000cc4c0
jmp 0x1000cc6b5
mov eax, 0xc0000000
jmp 0x1000cc6b7
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10005f420
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000cd270
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x58], 0
call fcn.10006c0a0
lea r11, [rsp + 0x58]
lea rdx, [0x100022540]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000cd354
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x1000225a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000cd349
mov ecx, dword [rsp + 0x48]
imul rcx, rcx, 0x3e8
test rbx, rbx
je 0x1000cd344
movsd xmm2, qword [0x100004e90]
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
test rcx, rcx
jns 0x1000cd317
addsd xmm1, xmm2
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
test rbx, rbx
jns 0x1000cd328
addsd xmm0, xmm2
divsd xmm1, xmm0
comisd xmm1, xmmword [0x1000225c0]
jb 0x1000cd349
movsd xmm0, qword [0x1000225c8]
comisd xmm0, xmm1
jb 0x1000cd349
call fcn.10006c0a0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x1000cd440
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, ecx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cd47c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cd48d
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000cd4c4
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cd4bd
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp esi, 1
jne 0x1000cd4e0
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.100062190
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movabs rcx, 0x7fffffffffffffff
mov qword [rax + 0x2f8], rcx
add rsp, 0x20
pop rdi
ret
Function at 0x1000cf5a0
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x280
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 0x10], rbx
mov rsi, rcx
mov qword [r11 + 0x20], rdi
call fcn.100070690
test eax, eax
je 0x1000ce7ee
lea rcx, [rsp + 0x20]
call fcn.100070640
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1000706b0
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1000706c0
lea rcx, [rsp + 0x20]
call fcn.1000706d0
call fcn.10006bfe0
mov rdi, rax
mov rbx, qword [rax + 8]
cmp rbx, rax
je 0x1000ce836
mov qword [rsp + 0x2a0], rbp
xor ebp, ebp
nop dword [rax]
mov rdx, rbx
test rbx, rbx
je 0x1000ce82e
mov rcx, qword [rbx + 8]
mov rbx, rcx
cmp rcx, rdi
mov rcx, rsi
cmove rbx, rbp
call qword [rdx + 0x10]
jmp 0x1000ce810
mov rbp, qword [rsp + 0x2a0]
call fcn.100070690
mov rdi, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x298]
test eax, eax
je 0x1000ce87f
lea rcx, [rsp + 0x20]
call fcn.100070640
lea rcx, [rsp + 0x20]
mov edx, 1
call fcn.1000706b0
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1000706c0
lea rcx, [rsp + 0x20]
call fcn.1000706d0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x280
pop rsi
ret
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov qword [rsp + 0x48], rdi
mov ebp, edx
call fcn.100058010
test rax, rax
je 0x1000cf648
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf5f3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000cf604
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x1000cf63b
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf634
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
cmp rbx, qword [rax + 0x210]
jne 0x1000cf648
xor esi, esi
jmp 0x1000cf66c
mov esi, 1
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x90], edx
je 0x1000cf66c
lea rcx, [rbx + 0x90]
call fcn.100057ac0
lock or dword [rbx + 0xb4], 4
mov eax, dword [rbx + 0xb8]
mov rcx, qword [rbx + 0xa0]
mov rdx, rbx
cmp eax, ebp
cmovl eax, ebp
xor r9d, r9d
lea r8d, [r9 + 2]
mov dword [rbx + 0xb8], eax
call fcn.1000d91e0
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x30]
test esi, esi
mov rsi, qword [rsp + 0x40]
je 0x1000cf6b8
mov dword [rbx + 0x90], 0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1000ce790