joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400289b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400913a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp qword [0x1400916f8], 0
jne 0x140028c1a
mov rbx, qword [0x1400916f0]
xor esi, esi
lea rdi, [rsi - 1]
test rbx, rbx
jne 0x140028adb
lea ecx, [rsi + 0x20]
call fcn.140077830
mov rbx, rax
test rax, rax
je 0x140028ad1
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x40]
mov qword [rbx], rsi
mov r8, rdi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
inc r8
cmp word [rax + r8*2], si
jne 0x140028a36
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14001cda0
mov r9, qword [rbx + 0x18]
mov rdx, rbx
mov r8, qword [rbx + 0x10]
cmp r9, 8
jb 0x140028a61
mov rdx, qword [rbx]
test r8, r8
je 0x140028aba
lea rcx, [r8 - 1]
mov rax, r8
cmp rcx, r8
cmovb rax, rcx
cmp word [rdx + rax*2], 0x5c
lea rcx, [rdx + rax*2]
je 0x140028a8f
nop
cmp rcx, rdx
je 0x140028aba
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x140028a80
sub rcx, rdx
sar rcx, 1
cmp rcx, rdi
je 0x140028aba
inc rcx
cmp r8, rcx
jb 0x140028c41
mov rax, rbx
cmp r9, 8
jb 0x140028ab2
mov rax, qword [rbx]
mov qword [rbx + 0x10], rcx
mov word [rax + rcx*2], si
mov r8d, 9
lea rdx, str.debug.log
mov rcx, rbx
call fcn.14001c940
jmp 0x140028ad4
mov rbx, rsi
mov qword [0x1400916f0], rbx
test byte [0x140090038], 1
je 0x140028c1a
cmp qword [rbx + 0x18], 8
jb 0x140028af2
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea edx, [r9 + 4]
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400916f8], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140028c1a
lea rdx, [rsp + 0x40]
mov word [rsp + 0x40], si
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140028c16
lea rax, [rsp + 0x40]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], si
jne 0x140028b60
mov rcx, qword [0x1400916f0]
lea rdx, [rsp + 0x40]
mov r8, rdi
call fcn.14001cda0
mov rcx, qword [0x1400916f0]
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140028b91
mov rdx, qword [rcx]
mov rax, qword [rcx + 0x10]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x140028bb6
mov r8d, 1
lea rdx, [0x14007c46c]
call fcn.14001c940
mov rcx, qword [0x1400916f0]
mov r8d, 9
lea rdx, str.debug.log
call fcn.14001c940
mov rcx, qword [0x1400916f0]
cmp qword [rcx + 0x18], 8
jb 0x140028bd9
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
lea edx, [r9 + 4]
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400916f8], rax
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x140028c1a
mov qword [0x1400916f8], rsi
xor al, al
jmp 0x140028c1c
mov al, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140077590
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.14001c820
int3
Function at 0x14002d850
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1050
call fcn.140077d60
sub rsp, rax
mov rax, qword [0x1400913a8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov rdi, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14002d95b
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jne 0x14002d8ec
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002d8d0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14001cda0
mov eax, ebx
jmp 0x14002d95b
cmp ecx, 2
jne 0x14002d956
mov r8d, 0x400
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x34], eax
dec eax
cmp eax, 0x3ff
ja 0x14002d94f
lea rax, [rsp + 0x840]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002d930
lea rdx, [rsp + 0x840]
mov rcx, rdi
call fcn.14001cda0
mov eax, ebx
jmp 0x14002d95b
mov eax, 0xea
jmp 0x14002d95b
mov eax, 0x3f4
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140077590
mov rbx, qword [rsp + 0x1078]
add rsp, 0x1050
pop rdi
ret

Function at 0x14002d980
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x50], 4
mov rbx, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002d9ee
mov ecx, dword [rsp + 0x50]
add ecx, 0xfffffffd
cmp ecx, 1
ja 0x14002d9e9
cmp dword [rsp + 0x68], 4
jne 0x14002d9e9
mov ecx, dword [rsp + 0x30]
mov dword [rbx], ecx
add rsp, 0x40
pop rbx
ret
mov eax, 0x3f4
add rsp, 0x40
pop rbx
ret
Function at 0x140037150
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r11
sar rax, 2
test rax, rax
jne 0x14003716c
add rsp, 8
ret
lea r10, [rax*4]
xor r9d, r9d
test r10, r10
je 0x1400371ae
mov qword [rsp], rbx
lea rbx, [0x14007cbf0]
nop word [rax + rax]
movzx r8d, byte [r9 + r11]
inc r9
movzx edx, al
xor r8, rdx
shr eax, 8
xor eax, dword [rbx + r8*4]
cmp r9, r10
jb 0x140037190
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14003a570
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2f0
mov rax, qword [0x1400913a8]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, rcx
lea rcx, [rsp + 0x90]
call fcn.14002c970
mov rdx, rax
lea rcx, [rsp + 0x30]
xor r8d, r8d
call fcn.14003c0b0
xor ebx, ebx
lea rdx, [rsp + 0xd0]
mov ecx, 0x104
mov word [rsp + 0xd0], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x14003a672
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0xd0]
cmp word [rsp + 0xd0], bx
je 0x14003a60d
nop dword [rax + rax]
inc rbx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x14003a600
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x90]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.14001b970
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.14001c430
mov rdx, rax
mov rcx, rdi
call fcn.14001bb20
lea rcx, [rsp + 0xb0]
call fcn.14001ba80
lea rcx, [rsp + 0x90]
call fcn.14001ba80
lea rcx, [rsp + 0x30]
call fcn.14003c8e0
mov al, 1
jmp 0x14003a67e
lea rcx, [rsp + 0x30]
call fcn.14003c8e0
xor al, al
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140077590
mov rbx, qword [rsp + 0x308]
add rsp, 0x2f0
pop rdi
ret

Function at 0x14003a6a0
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0xa0
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.14002c970
mov rdx, rax
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.14003c0b0
cmp qword [rbx + 0x18], 8
jb 0x14003a6d0
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
lea rcx, [rsp + 0x40]
setne bl
call fcn.14003c8e0
movzx eax, bl
add rsp, 0xa0
pop rbx
ret

Function at 0x14003aad0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14003aaee
mov dword [rbx], eax
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400400e0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call fcn.140062070
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14004f920
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1400913a8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
mov qword [rsp + 0x40], rdx
xorps xmm0, xmm0
mov qword [rsp + 0x38], rcx
movups xmmword [rsp + 0x64], xmm0
mov rbx, r8
mov r9d, 0x40
movups xmmword [rsp + 0x74], xmm0
mov qword [r11 - 0x24], rax
lea r8, [r11 - 0x5c]
mov dword [r11 - 0x1c], eax
lea rdx, [r11 - 0x78]
movups xmmword [r11 - 0x44], xmm0
lea rax, [r11 - 0x64]
movups xmmword [r11 - 0x34], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [fcn.14000ed80]
lea rax, [r11 - 0x60]
mov dword [rsp + 0x50], 0x67452301
mov qword [rsp + 0x28], rax
lea rax, [r11 - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x54], 0xefcdab89
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x5c], 0x10325476
mov dword [rsp + 0x60], 0xc3d2e1f0
call fcn.14004fb00
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14004fa00
mov edx, 0x60
lea rcx, [rsp + 0x50]
call fcn.1400620a0
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140077590
add rsp, 0xc0
pop rbx
ret
Function at 0x140040670
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
sub rsp, 0x38
movsd xmm0, qword [0x1400918d8]
movaps xmmword [rsp + 0x20], xmm6
xorps xmm6, xmm6
ucomisd xmm0, xmm6
jp 0x1400407cf
jne 0x1400407cf
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword gs:[0x58]
mov edx, dword [0x140094620]
mov ebp, 0x28
mov rbx, qword [rcx + rdx*8]
mov ecx, dword [rbx + rbp]
cmp dword [0x1400918e8], ecx
jg 0x1400407d9
mov eax, dword [rbx + rbp]
cmp dword [0x1400918f8], eax
mov rbp, qword [rsp + 0x58]
jg 0x140040813
rdtsc
shl rdx, 0x20
lea rcx, [rsp + 0x40]
or rax, rdx
mov qword [rsp + 0x40], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x40]
xorps xmm2, xmm2
sub rcx, qword [0x1400918f0]
mov rdi, qword [rsp + 0x30]
js 0x140040765
cvtsi2sd xmm2, rcx
jmp 0x14004077a
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm1, qword [rsp + 0x48]
divsd xmm2, xmm1
movsd xmm1, qword [0x14007f500]
comisd xmm1, xmm2
ja 0x1400407ca
sub rbx, qword [0x1400918e0]
js 0x1400407a9
cvtsi2sd xmm0, rbx
jmp 0x1400407be
mov rax, rbx
and ebx, 1
shr rax, 1
or rax, rbx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
divsd xmm0, xmm2
movsd qword [0x1400918d8], xmm0
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
lea rcx, [0x1400918e8]
call fcn.140077c40
cmp dword [0x1400918e8], 0xffffffff
jne 0x1400406ef
rdtsc
shl rdx, 0x20
lea rcx, [0x1400918e8]
or rax, rdx
mov qword [0x1400918e0], rax
call fcn.140077be0
jmp 0x1400406ef
lea rcx, [0x1400918f8]
call fcn.140077c40
cmp dword [0x1400918f8], 0xffffffff
jne 0x140040703
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
lea rcx, [0x1400918f8]
mov qword [0x1400918f0], rax
call fcn.140077be0
jmp 0x140040703

Function at 0x1400409f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
test rdx, rdx
je 0x140040a55
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov qword [rsp + 0x30], rbp
mov rbx, rdx
mov qword [rsp + 0x38], rsi
mov ebp, 0xffffffff
mov rdi, rcx
nop dword [rax]
nop dword [rax + rax]
cmp rbx, rbp
mov esi, ebx
mov rcx, rdi
cmova esi, ebp
mov edx, esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140040a37
int3
mov eax, esi
add rdi, rax
sub rbx, rax
jne 0x140040a20
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400410e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov dword [rcx], 0xffffffff
mov dword [rcx + 4], edi
mov rsi, rcx
mov ecx, dword [0x140091350]
mov rbp, rdx
cmp ecx, 0xffffffff
je 0x14004111a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14004111f
call fcn.140041690
call fcn.140041a20
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x14004113c
mov rcx, rbx
call fcn.140026580
mov r8, qword [0x140093130]
lea r9, [0x140091910]
nop word [rax + rax]
mov eax, edi
lea rcx, [r8 + 1]
add rcx, rax
movzx edx, cl
lea rax, [rdx + rdx*2]
cmp dword [r9 + rax*8], 0
je 0x140041173
inc edi
cmp edi, 0x100
jl 0x140041150
jmp 0x140041195
lea rax, [rdx + rdx*2]
mov qword [0x140093130], rdx
mov dword [r9 + rax*8], 1
mov qword [r9 + rax*8 + 8], rbp
mov dword [rsi], edx
mov eax, dword [r9 + rax*8 + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
jne 0x1400411a6
int3
cmp eax, 0x100
jl 0x1400411ae
int3
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140041690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
mov eax, 0x1040
call fcn.140077d60
sub rsp, rax
mov rax, qword [0x1400913a8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov ecx, dword [0x140091350]
mov dword [rsp + 0x20], ecx
cmp ecx, 0xffffffff
jne 0x14004171e
lea rcx, [rsp + 0x20]
call fcn.14003aad0
test al, al
jne 0x1400416cf
int3
mov ecx, dword [rsp + 0x20]
cmp ecx, 0xffffffff
jne 0x1400416fc
lea rcx, [rsp + 0x20]
call fcn.14003aad0
test al, al
je 0x1400416ed
cmp dword [rsp + 0x20], 0xffffffff
jne 0x1400416ee
int3
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x20]
mov eax, 0xffffffff
lock cmpxchg dword [0x140091350], ecx
mov ecx, dword [rsp + 0x20]
je 0x14004171e
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140091350]
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140041729
int3
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400774f0
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x20]
mov rdx, rbx
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rax, rbx
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140077590
add rsp, 0x1040
pop rbx
ret
Function at 0x1400417a0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140091350]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400417d4
movsxd rdx, dword [rbx]
mov ecx, dword [rbx + 4]
add rdx, rdx
cmp dword [rax + rdx*8 + 8], ecx
jne 0x1400417d4
mov rax, qword [rax + rdx*8]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400419d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140041ac0
mov ecx, dword [0x140091350]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
and rcx, 0xfffffffffffffffc
jne 0x1400419f7
xor ecx, ecx
jmp 0x140041a0c
movsxd rax, dword [rbx]
shl rax, 4
add rcx, rax
mov eax, dword [rbx + 4]
cmp dword [rcx + 8], eax
jne 0x1400419f3
mov rcx, qword [rcx]
test rcx, rcx
lea rax, [0x14007f508]
cmovne rax, rcx
add rsp, 0x20
pop rbx
ret

Function at 0x140041ac0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x58]
mov ecx, dword [0x140094620]
mov edx, 0x28
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140093110], eax
jg 0x140041b0b
lea rax, [0x140091354]
add rsp, 0x28
ret
lea rcx, [0x140093110]
call fcn.140077be0
lea rax, [0x140091354]
add rsp, 0x28
ret
lea rcx, [0x140093110]
call fcn.140077c40
cmp dword [0x140093110], 0xffffffff
jne 0x140041ae7
mov ecx, dword [0x140091350]
mov qword [rsp + 0x20], rbx
cmp ecx, 0xffffffff
je 0x140041b3a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140041b3f
call fcn.140041690
call fcn.140041a20
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x140041b5c
mov rcx, rbx
call fcn.140026580
mov r9, qword [0x140093130]
lea r10, [0x140091910]
xor edx, edx
nop dword [rax]
mov eax, edx
lea rcx, [r9 + 1]
add rcx, rax
movzx r8d, cl
lea rax, [r8 + r8*2]
cmp dword [r10 + rax*8], 0
je 0x140041b94
inc edx
cmp edx, 0x100
jl 0x140041b70
jmp 0x140041bc2
lea rax, [r8 + r8*2]
mov qword [0x140093130], r8
mov dword [r10 + rax*8], 1
mov qword [r10 + rax*8 + 8], 0
mov eax, dword [r10 + rax*8 + 0x10]
mov dword [0x140091358], eax
mov dword [0x140091354], r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [0x140091354]
mov rbx, qword [rsp + 0x20]
cmp eax, 0xffffffff
jne 0x140041bdc
int3
cmp eax, 0x100
jl 0x140041af3
int3

Function at 0x140041bf0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140091350]
cmp ecx, 0xffffffff
jne 0x140041c06
xor al, al
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 1
setbe al
add rsp, 0x28
ret
Function at 0x140041d90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x140091350]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x140041dbc
test rdi, rdi
je 0x140041dd3
call fcn.140041690
movsxd rcx, dword [rbx]
add rcx, rcx
mov qword [rax + rcx*8], rdi
movsxd rdx, dword [rbx]
mov ecx, dword [rbx + 4]
add rdx, rdx
mov dword [rax + rdx*8 + 8], ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400447f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rax, [0x14007f688]
mov rsi, rcx
mov qword [rcx], rax
lea rax, [0x14007f698]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x48]
call fcn.140062020
mov rdx, rsi
mov rcx, rax
call fcn.140062060
call fcn.14005b960
lea rdx, [rsi + 8]
mov rcx, rax
call fcn.14005c080
mov rbx, qword [rsi + 0x10]
add rbx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x140044857
mov rcx, rbx
call fcn.140026580
xor ebp, ebp
cmp qword [rsi + 0x18], rbp
je 0x140044898
mov rax, qword [rsi + 0x10]
mov ecx, dword [rsi + 0x28]
mov eax, dword [rax + 0x454]
cmp ecx, eax
jne 0x140044898
mov rax, qword [rsi + 0x10]
lea r8, [rsp + 0x40]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov r9, qword [rax + 0x10]
mov rax, qword [rsi + 0x18]
mov qword [rsi + 0x18], rbp
mov rdx, qword [rsi + 0x20]
mov qword [rsp + 0x40], rax
call r9
call sub.KERNEL32.dll_GetCurrentThreadId
mov r10, qword [rsi + 0x10]
movabs r11, 0x100000001b3
mov r9d, eax
movzx r8d, al
mov ecx, r9d
sar ecx, 8
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx edx, cl
imul r8, r11
mov eax, r9d
xor r8, rdx
sar eax, 0x10
imul r8, r11
movzx ecx, al
mov eax, r9d
xor r8, rcx
sar eax, 0x18
imul r8, r11
movzx ecx, al
xor r8, rcx
mov rcx, qword [r10 + 0x3e8]
imul r8, r11
mov r11, qword [r10 + 0x3f8]
and r8, qword [r10 + 0x410]
mov rdx, r8
shl rdx, 4
add rdx, r11
mov rdi, qword [rdx + 8]
cmp rdi, rcx
je 0x1400449ce
mov rax, qword [rdx]
cmp r9d, dword [rdi + 0x10]
je 0x140044943
nop dword [rax + rax]
cmp rdi, rax
je 0x1400449ce
mov rdi, qword [rdi + 8]
cmp r9d, dword [rdi + 0x10]
jne 0x140044930
test rdi, rdi
je 0x1400449ce
add r8, r8
mov rax, qword [r11 + r8*8]
cmp qword [rdx + 8], rdi
jne 0x140044972
cmp rax, rdi
jne 0x140044968
mov qword [r11 + r8*8], rcx
mov qword [rdx + 8], rcx
jmp 0x14004497e
mov rcx, qword [rdi + 8]
mov qword [rdx + 8], rcx
jmp 0x14004497e
cmp rax, rdi
jne 0x14004497e
mov rax, qword [rdi]
mov qword [r11 + r8*8], rax
mov rcx, qword [rdi]
dec qword [r10 + 0x3f0]
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400449c1
lea rdx, [rcx + 8]
mov eax, 0xffffffff
lock xadd dword [rdx], eax
cmp eax, 1
jne 0x1400449c1
test rdx, rdx
cmovne rbp, rcx
mov rcx, rbp
call fcn.14003a850
mov edx, 0x20
mov rcx, rdi
call fcn.14001d8c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsi + 0x10]
xor edx, edx
add rcx, 0x3c8
call fcn.140041d90
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x140044a02
mov rcx, rbx
call fcn.14005f380
mov rcx, rbx
call fcn.140077870
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140048f50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140049101
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140028ca0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400490c6
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140049040
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400490b5
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x14004907d
mov r8, qword [rax]
cmp r8, rcx
je 0x140049077
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400490b5
cmp r9, rax
je 0x140049091
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x1400490db
cmp r9, rax
jne 0x140049082
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140048ff0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400490b5
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3

Function at 0x14004e540
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x28
mov rdx, qword [rdx]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x14004e710
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
add rsp, 0x28
ret