joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015c080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x14019c230
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ecx, dword [0x140394158]
test ecx, ecx
je 0x14019c25c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14019c275
add rax, 8
jmp 0x14019c310
lea rcx, [0x140394140]
call fcn.1401d8500
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14019c253
je 0x14019c30e
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x1404a3130]
mov edx, 0x18
xor ecx, ecx
call fcn.140201a50
test rax, rax
je 0x14019c33d
mov rbx, rax
mov rsi, rax
lea rax, [0x140394140]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x140394158]
test ecx, ecx
je 0x14019c31d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140394158]
test ecx, ecx
je 0x14019c32d
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14019c309
mov rcx, qword [0x1404a30d0]
xor edx, edx
mov r8, rdi
call fcn.14021d5e4
mov rax, rbx
jmp 0x14019c310
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140394140]
call fcn.1401d8500
mov ecx, eax
jmp 0x14019c2d3
lea rcx, [0x140394140]
call fcn.1401d8500
mov ecx, eax
jmp 0x14019c2e7
mov ecx, 8
mov edx, 0x18
call fcn.140043da0
int3
Function at 0x14015dab0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x100
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14015dac0
test al, 1
je 0x14015db69
test al, 2
jne 0x14015db81
test al, 8
jne 0x14015dafb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 3
lea rdx, [rsp + 0x58]
call fcn.14015d9d0
jmp 0x14015db19
test al, 0x10
je 0x14015db19
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x14015dc05
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14015db99
jne 0x14015db5f
mov rcx, rsi
add rsp, 0x100
pop rsi
jmp fcn.14015d910
nop
add rsp, 0x100
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:_P_fD_
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x140440c80]
lea rcx, [rsp + 0x58]
call fcn.1400467a0
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 8
xorps xmm0, xmm0
push rdi
ror byte [rdi], 0x11
and al, 0x70
lea rdx, str.AeD_
lea rcx, [rsp + 0x58]
and al, 0x58
call fcn.1400467a0
int3
Function at 0x14015e2f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14015e300
test al, 1
je 0x14015e39f
test al, 2
jne 0x14015e3b7
test al, 8
jne 0x14015e337
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.14015e210
jmp 0x14015e34f
test al, 0x10
je 0x14015e34f
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x14015e43b
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14015e3cf
jne 0x14015e395
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp fcn.14015e150
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_P_fD_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x140440c80]
lea rcx, [rsp + 0x28]
call fcn.1400467a0
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
cmp byte [rax], cl
add byte [rax], al
add byte [rdi], cl
push rdi
ror byte [rdi], 0x11
and al, 0x40
lea rdx, str.AeD_
lea rcx, [rsp + 0x28]
call fcn.1400467a0
int3
Function at 0x14015ede0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14015ee00
test al, 1
je 0x14015ef23
test al, 2
jne 0x14015ef3b
test al, 8
jne 0x14015ee40
mov rdi, qword [rsi + 0x28]
call fcn.140206580
test rax, rax
je 0x14015ee60
movups xmm6, xmmword [rax]
mov qword [rax], 1
mov qword [rax + 8], rdi
jmp 0x14015ee63
test al, 0x10
je 0x14015ee80
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14015efbf
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x14015ee80
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.14015eca0
mov byte [rsi + 0xa8], 4
call fcn.140206580
test rax, rax
je 0x14015ee80
movups xmmword [rax], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14015ef53
jne 0x14015ef11
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14015eecf
mov rcx, rdi
call fcn.14014c020
lea rcx, [rsi + 0x30]
call fcn.14015eca0
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14015eeee
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1404a30d0]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.14021d5e4
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_P_fD_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140440c80]
lea rcx, [rsp + 0x30]
call fcn.1400467a0
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.AeD_
lea rcx, [rsp + 0x30]
call fcn.1400467a0
out dx, al
dec esp
Function at 0x14015f730
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14015f740
test al, 1
je 0x14015f7e8
test al, 2
jne 0x14015f800
test al, 8
jne 0x14015f77a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0xc8], 4
lea rdx, [rsp + 0x58]
call fcn.14015f620
jmp 0x14015f798
test al, 0x10
je 0x14015f798
mov rax, qword [rsi + 0xb8]
test rax, rax
je case.0x14015b87a.45
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x14015f818
jne 0x14015f7de
mov rcx, rsi
add rsp, 0xd0
pop rsi
jmp fcn.14015f550
nop
add rsp, 0xd0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:_P_fD_
add eax, 0x2e1417
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
add byte [rax], al
add byte [rax - 0x39], cl
and al, 0x78
add byte [rax], al
add byte [rax], al
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x140440c80]
lea edx, [0x140440c80]
lea rcx, [rsp + 0x58]
call fcn.1400467a0
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
and al, 0x58
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
invalid
lea rdx, str.AeD_
lea rcx, [rsp + 0x58]
call fcn.1400467a0
outsb dx, byte [rsi]
out dx, al
dec esp
Function at 0x14015ffa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, 0x1020
call fcn.14021d420
sub rsp, rax
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14015ffc0
test al, 1
je 0x140160069
test al, 2
jne 0x140160081
test al, 8
jne 0x14015fffb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 4
lea rdx, [rsp + 0x58]
call fcn.14015fec0
jmp 0x140160019
test al, 0x10
je 0x140160019
mov rax, qword [rsi + 0x1008]
test rax, rax
je 0x140160105
mov rcx, qword [rsi + 0x1010]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x140160099
jne 0x14016005f
mov rcx, rsi
add rsp, 0x1020
pop rsi
jmp fcn.14015fe00
nop
add rsp, 0x1020
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x38], eax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:_P_fD_
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
add al, byte [rax]
add byte [rax], al
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
and al, 0x38
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
add al, byte [rax]
add byte [rax], al
lea rdx, [0x140440c80]
lea rcx, [rsp + 0x58]
lea ecx, [rsp + 0x58]
call fcn.1400467a0
lea rax, str.waker_missing
Function at 0x140160850
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x240
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140160860
test al, 1
je 0x140160909
test al, 2
jne 0x140160921
test al, 8
jne 0x14016089b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 7
lea rdx, [rsp + 0x58]
call fcn.140160760
jmp 0x1401608b9
test al, 0x10
je 0x1401608b9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1401609a5
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x140160939
jne 0x1401608ff
mov rcx, rsi
add rsp, 0x240
pop rsi
jmp fcn.140160690
nop
add rsp, 0x240
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x38], eax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:_P_fD_
lea eax, [0x140440c60]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
add al, byte [rax]
add byte [rax], al
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
and al, 0x38
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
Function at 0x140161800
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140161820
test al, 1
je 0x140161944
test al, 2
jne 0x14016195c
test al, 8
jne 0x140161860
mov rdi, qword [rsi + 0x28]
call fcn.140206580
test rax, rax
je 0x140161880
movups xmm6, xmmword [rax]
mov qword [rax], 1
mov qword [rax + 8], rdi
jmp 0x140161883
test al, 0x10
je 0x1401618a1
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1401619e0
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
jmp 0x1401618a1
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.140161650
mov qword [rsi + 0x30], 4
call fcn.140206580
test rax, rax
je 0x1401618a1
movups xmmword [rax], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140161974
jne 0x140161932
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1401618f0
mov rcx, rdi
call fcn.14014c020
lea rcx, [rsi + 0x30]
call fcn.140161650
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x14016190f
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1404a30d0]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.14021d5e4
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_P_fD_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140440c80]
lea rcx, [rsp + 0x30]
call fcn.1400467a0
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.AeD_
lea rcx, [rsp + 0x30]
call fcn.1400467a0
int3
Function at 0x140162410
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140162420
test al, 1
je 0x1401624c2
test al, 2
jne 0x1401624da
test al, 8
jne 0x14016245a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.140162330
jmp 0x140162472
test al, 0x10
je 0x140162472
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14016255e
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1401624f2
jne 0x1401624b8
mov rcx, rsi
add rsp, 0x80
pop rsi
jmp fcn.140162270
invalid
std
invalid
invalid
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
push rax
out 0x2d, eax
add byte [rdx + 0x25], bh
call fcn.140047420
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.1400468c0]
mov eax, 0x48ffee43
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
and al, 0x70
Function at 0x140162eb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140162ed0
test al, 1
je 0x140162ff4
test al, 2
jne 0x14016300c
test al, 8
jne 0x140162f10
mov rdi, qword [rsi + 0x28]
call fcn.140206580
test rax, rax
je 0x140162f30
movups xmm6, xmmword [rax]
mov qword [rax], 1
mov qword [rax + 8], rdi
jmp 0x140162f33
test al, 0x10
je 0x140162f51
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140163090
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
jmp 0x140162f51
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.140162dc0
mov qword [rsi + 0x30], 0xc
call fcn.140206580
test rax, rax
je 0x140162f51
movups xmmword [rax], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1402073f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140163024
jne 0x140162fe2
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140162fa0
mov rcx, rdi
call fcn.14014c020
lea rcx, [rsi + 0x30]
call fcn.140162dc0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140162fbf
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1404a30d0]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
jmp fcn.14021d5e4
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140440bf8]
mov edx, 0x23
call fcn.140047420
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140440c38]
mov edx, 0x25
call fcn.140047420
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [fcn.1400468c0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:_P_fD_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140440c80]
lea rcx, [rsp + 0x30]
call fcn.1400467a0
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.AeD_
lea rcx, [rsp + 0x30]
call fcn.1400467a0
int3
Function at 0x140179840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1401798d6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14039ed10]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14039ed20]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140057120
test rdi, rdi
je 0x140179965
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14017997e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140179a76
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140179af8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140179a83
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140179940
cmp r9, 8
jae 0x140179a8c
jmp 0x140179af8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140057120
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140179af8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140179af8
mov r8, rcx
cmp r9, 8
jb 0x140179af8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140179a90
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14019a780
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x14019a780
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ecx, dword [0x1403941a8]
test ecx, ecx
je 0x14019a7a7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14019a7c0
add rax, 8
jmp 0x14019a890
lea rcx, [0x140394190]
call fcn.1401d8500
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14019a79e
je 0x14019a88e
movzx eax, byte [0x1404a3130]
mov edx, 0x50
xor ecx, ecx
call fcn.140201a50
test rax, rax
je 0x14019a8b8
mov rbx, rax
mov rsi, rax
lea rax, [0x140394190]
mov qword [rsi], rax
movups xmm0, xmmword [0x1404405f8]
movups xmmword [rsi + 8], xmm0
movups xmm0, xmmword [0x140440608]
movups xmmword [rsi + 0x18], xmm0
movups xmm0, xmmword [0x140440618]
movups xmmword [rsi + 0x28], xmm0
movups xmm0, xmmword [0x140440628]
movups xmmword [rsi + 0x38], xmm0
movabs rax, 0x2000000000000
mov qword [rsi + 0x48], rax
mov ecx, dword [0x1403941a8]
test ecx, ecx
je 0x14019a898
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1403941a8]
test ecx, ecx
je 0x14019a8a8
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14019a889
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x14019a878
lock dec qword [rax]
jne 0x14019a878
mov rcx, rdi
add rcx, 0x28
call fcn.14014c020
mov rcx, qword [0x1404a30d0]
xor edx, edx
mov r8, rdi
call fcn.14021d5e4
mov rax, rbx
jmp 0x14019a890
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140394190]
call fcn.1401d8500
mov ecx, eax
jmp 0x14019a838
lea rcx, [0x140394190]
call fcn.1401d8500
mov ecx, eax
jmp 0x14019a84c
mov ecx, 8
mov edx, 0x50
call fcn.140043da0
int3