joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140150630
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x140150663
mov rax, qword [rsi + 8]
test rax, rax
je 0x14015075b
mov eax, ebx
not eax
test eax, 0x300
je 0x14015075b
cmp edi, 2
lea rax, [0x140437a60]
lea rcx, [0x140437c60]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14015075b
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x14015075b
cmp byte [0x140437a50], 0
setne al
bt ebx, 8
jb 0x14015075b
shr ebx, 9
and ebx, 1
or bl, al
je 0x14015075b
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.Tp__
cmove r12, rax
movzx ebp, byte [rsi + 0x17]
test bpl, bpl
jns 0x1401507b7
mov r14, qword [rsi]
mov rbp, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x140150748
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.14025ee84
test eax, eax
je 0x14015077a
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x140150728
cmp dword [rsp + 0x2c], 0
jne 0x1401507bf
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140242430
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x140150788
test ecx, ecx
jne 0x140150748
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x1401507e8
cmp dword [rsp + 0x2c], 2
jne 0x1401507f9
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x1401507f9
mov r14, rsi
jmp 0x14015070b
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x1401507cb
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.1402aca90
jmp 0x14015075b
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
cmp cx, 0x5c
jne 0x140150812
lea r14, [rax + 2]
dec r13
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x1401507ff
jmp 0x140150815
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov rbp, r13
jmp 0x14015074f
Function at 0x140151250
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r8]
cmovns rax, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
cmovs rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1400ee050
cmp byte [rsi + 0x17], 0
jns 0x1401512b0
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1400ee050
cmp byte [rdi + 0x17], 0
jns 0x1401512d5
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x1401512f4
mov rcx, qword [rsp + 0x48]
call fcn.140240d14
cmp byte [rsp + 0x87], 0
jns 0x140151308
mov rcx, qword [rsp + 0x70]
call fcn.140240d14
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401513b0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1400ee050
cmp byte [rdi + 0x17], 0
jns 0x1401513f1
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x140151412
mov rcx, qword [rsp + 0x58]
call fcn.140240d14
test rsi, rsi
je 0x1401514b9
test edi, edi
je 0x1401514b9
mov ecx, edi
add rcx, rcx
call fcn.140240d4c
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.1400ee050
cmp byte [r14 + 0x17], 0
jns 0x140151455
mov r14, qword [rsp + 0x58]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x140151475
mov rcx, qword [rsp + 0x58]
call fcn.140240d14
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x1401514d7
mov rcx, rbx
call fcn.140268c14
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.1401e9a30
cmp byte [rsi + 0x17], 0
js 0x1401514da
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.140240d54
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
mov rcx, qword [rsi]
call fcn.140240d14
jmp 0x1401514a0
Function at 0x1401575b0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea r14, [rcx + 0x38]
mov rcx, qword [rcx + 0x38]
test rcx, rcx
jne 0x1401576b1
lea r12, [rdi + 0x30]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
jne 0x1401576ca
mov qword [rsp + 0x20], r12
lea rcx, [0x140390878]
lea r9, [0x1403c9b80]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov r15, qword [r12]
test eax, eax
js 0x1401576e4
mov rcx, qword [r14]
test rcx, rcx
jne 0x1401576fd
mov rax, qword [r15]
mov rax, qword [rax + 0x90]
mov rcx, r15
mov rdx, r14
call qword [case.0x1402bbc90.0]
test eax, eax
js 0x140157716
cmp rdi, rbx
je 0x140157663
cmp byte [rdi + 0x17], 0
movzx r8d, byte [rbx + 0x17]
js 0x140157692
test r8b, r8b
jns 0x140157682
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
mov rcx, rdi
call fcn.1400c95e0
add rdi, 0x18
mov rcx, rdi
mov rdx, rsi
call fcn.1400dfe80
mov al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
jmp 0x140157663
test r8b, r8b
jns 0x1401576a0
mov r8, qword [rbx + 8]
mov rbx, qword [rbx]
jmp 0x1401576a4
and r8d, 0x7f
mov rcx, rdi
mov rdx, rbx
call fcn.1400c94f0
jmp 0x140157663
mov qword [r14], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402bbc90.0]
jmp 0x1401575d7
mov qword [r12], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402bbc90.0]
jmp 0x1401575e8
test r15, r15
je 0x140157732
mov qword [r12], 0
mov rax, qword [r15]
mov rax, qword [rax + 0x10]
mov rcx, r15
jmp 0x14015772c
mov qword [r14], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402bbc90.0]
jmp 0x140157621
mov rcx, qword [r14]
test rcx, rcx
je 0x140157732
mov qword [r14], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402bbc90.0]
xor eax, eax
jmp 0x140157674
Function at 0x14015d600
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1403aa440]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14015d6ec
lea rdi, [rsp + 0x6c]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.140244560
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x60]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x14015d6f3
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.14015d750
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x14015d6f3
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x14015d6fc
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14015fb40
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14015fc8d
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14015fc86
cmp r14, rax
ja 0x14015fc92
lea rcx, [r14*8]
call fcn.140240cd8
shl rbx, 3
add rbx, rax
je 0x14015fc97
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rdi], 0
mov qword [rbx], rcx
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
jne 0x14015fc05
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
jne 0x14015fc62
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rdx - 8]
mov qword [rdx - 8], 0
lea r9, [rdx - 8]
mov qword [rbx - 8], r8
add rbx, 0xfffffffffffffff8
mov rdx, r9
cmp r9, rdi
jne 0x14015fc05
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x14015fbf6
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14015fcc3
mov rcx, qword [r14]
mov qword [r14], 0
test rcx, rcx
jne 0x14015fc73
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
je 0x14015fbf6
jmp 0x14015fc40
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140240d14
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x1402bbc90.0]
jmp 0x14015fc54
xor eax, eax
jmp 0x14015fbbd
call fcn.14025af90
call fcn.14027e620
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140280b90
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140280b90
int3

Function at 0x140160510
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140160570
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x140160579
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x140160559
int3
mov rcx, qword [rcx + 8]
jmp 0x140160510
Function at 0x140160580
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x140160623
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140160612
cmp eax, 0xffffffff
je 0x140160637
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x1401605c1
mov eax, dword [rsp + 0x2c]
jmp 0x1401605f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1401605f4
int3

Function at 0x140160b00
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.140160a20
test rax, rax
jne 0x140160b3f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x140160b5b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140242430
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1401de860
test al, al
jne 0x140160b6d
xor esi, esi
jmp 0x140160b3f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.1402b3940
lea rcx, [rsp + 0x40]
lea rdx, [0x1403cb7d7]
mov r8d, ntohl
call fcn.14027e630
mov rcx, rsi
call fcn.1402b39c0
jmp 0x140160b69

Function at 0x140161050
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140160570
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x140160579
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x140160559
int3
mov rcx, qword [rcx + 8]
jmp 0x140160510

Function at 0x14016b3f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140439020], 0
jne 0x14016b42d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14016b420
mov dword [rdi], eax
mov dword [0x140439028], eax
mov qword [0x140439020], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x14016b4e0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, r8
mov rsi, rdx
mov r12, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, rbx
shr r15, 0x20
movzx eax, r9b
lea ebp, [rax + rax]
add ebp, 4
mov qword [rsp + 0x20], r12
mov rcx, r8
mov edx, ebp
mov r8d, r15d
mov r9d, ebx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x14016b5a7
movaps xmm0, xmmword [0x1403aa440]
lea rdi, [rsp + 0x30]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov r8d, 0x30
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rdi + 0x18]
sub rcx, r14
add rcx, qword [rdi + 8]
test rax, rax
cmove rcx, rax
mov byte [rsi], 1
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14032a100
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov edx, ebp
mov r8d, r15d
mov r9d, ebx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x14016b542
call fcn.14032a100
mov byte [rsi], 0
jmp 0x14016b588

Function at 0x14016ead0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140439070]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14016eb0d
lea rcx, [0x140439060]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1401eaa10
lea rcx, [0x140439070]
call fcn.140240e30
cmp dword [0x140439070], 0xffffffff
jne 0x14016eaf9
xorps xmm0, xmm0
movups xmmword [0x140439060], xmm0
lea rcx, [0x140439060]
xor edx, edx
call fcn.1400eeb90
lea rcx, [0x140439070]
call fcn.140240ec8
jmp 0x14016eaf9

Function at 0x14016eb50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140439070]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14016eb85
lea rcx, [0x140439060]
add rsp, 0x28
jmp fcn.1401ea9d0
lea rcx, [0x140439070]
call fcn.140240e30
cmp dword [0x140439070], 0xffffffff
jne 0x14016eb75
xorps xmm0, xmm0
movups xmmword [0x140439060], xmm0
lea rcx, [0x140439060]
xor edx, edx
call fcn.1400eeb90
lea rcx, [0x140439070]
call fcn.140240ec8
jmp 0x14016eb75

Function at 0x14016eda0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140439088]
cmp rdi, 1
jbe 0x14016edc9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1401eaa10
lea rcx, [0x140439088]
call fcn.1400e2f80
test al, al
je 0x14016ee0e
xorps xmm0, xmm0
movups xmmword [0x140439090], xmm0
lea rbx, [0x140439088]
lea rdi, [0x140439090]
mov rcx, rdi
xor edx, edx
call fcn.1400eeb90
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400e3040
jmp 0x14016edb7
mov rdi, qword [0x140439088]
jmp 0x14016edb7
Function at 0x14016fc40
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x14016fd83
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x14016fd7c
cmp r14, rax
ja 0x14016fd88
lea rcx, [r14*8]
call fcn.140240cd8
shl rbx, 3
add rbx, rax
je 0x14016fd8d
mov rcx, qword [rdi]
mov qword [rbx], rcx
test rcx, rcx
je 0x14016fcd9
lock inc dword [rcx + 8]
lea rax, [rax + r14*8]
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x14016fd65
mov r8, qword [rdx - 8]
mov qword [rbx - 8], r8
mov qword [rdx - 8], 0
lea r8, [rdx - 8]
add rbx, 0xfffffffffffffff8
mov rdx, r8
cmp r8, rdi
jne 0x14016fced
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x14016fd4f
add r14, 0xfffffffffffffff8
test r14, r14
je 0x14016fdb9
mov rcx, qword [r14]
test rcx, rcx
je 0x14016fd43
lock dec dword [rcx + 8]
je 0x14016fde5
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x14016fd28
test rdi, rdi
je 0x14016fd72
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140240d14
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
jmp 0x14016fd4f
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x14016fcbd
call fcn.14025af90
call fcn.14027e620
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140280b90
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140280b90
mov edx, 1
call fcn.14018f170
jmp 0x14016fd43
Function at 0x1401722d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1401722a0]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x140439188]
lea rdx, [0x1401720f0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1401723d9
cmp dword [0x140439190], 0
jne 0x1401723e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x140439194]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x14017238d
mov ecx, 0x28
call fcn.140212f10
test rax, rax
je 0x1401723e6
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x20], 0
mov ecx, dword [0x140439194]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401723de
lea r15, [0x140439198]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x1404391a0]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14025af90
mov rcx, r14
call fcn.140212f50
mov rcx, rsi
mov rax, rdi
call qword [case.0x1402bbc90.0]
xor esi, esi
jmp 0x1401723bd

Function at 0x140172b50
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x140172b8c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140172b96
add rdi, rbx
sub rsi, rbx
jne 0x140172b6a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14025af90
int3
Function at 0x140183ed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1404396e4]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140183f34
cmp rdi, rsi
je 0x140183f29
mov eax, 0xffffffff
lea rcx, [0x1404392e4]
mov dl, byte [rdi]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [rcx + rdx*4]
inc rdi
cmp rdi, rsi
jne 0x140183f10
not eax
jmp 0x140183f2b
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1404396e4]
call fcn.140240e30
cmp dword [0x1404396e4], 0xffffffff
jne 0x140183eff
lea rbx, [0x1404392e4]
mov r8d, 0x400
mov rcx, rbx
mov dl, 0xaa
call fcn.140244560
mov dl, 1
xor ecx, ecx
mov eax, 0xedb88320
test dl, 1
je 0x140184047
mov r9d, ecx
shl r9d, 0x1e
sar r9d, 0x1f
and r9d, eax
mov r8d, ecx
and r8d, 1
neg r8d
and r8d, eax
mov edx, ecx
shr edx, 1
xor edx, r8d
mov r8d, edx
shr r8d, 1
xor r8d, r9d
mov r9d, r8d
shl r9d, 0x1a
sar r9d, 0x1f
and r9d, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
mov r10d, ecx
shl r10d, 0x1a
sar r10d, 0x1f
and r10d, 0x3b6e20c8
mov r11d, ecx
shl r11d, 0x1b
sar r11d, 0x1f
and r11d, 0x1db71064
xor r11d, r10d
mov r10d, ecx
shl r10d, 0x1c
sar r10d, 0x1f
and r10d, 0xedb8832
mov ebp, ecx
shl ebp, 0x1d
sar ebp, 0x1f
and ebp, 0x76dc419
xor ebp, r10d
xor ebp, r11d
shr r8d, 6
xor r8d, ebp
xor r8d, edx
xor r8d, r9d
mov dword [rbx], r8d
cmp rcx, 0xff
lea r8, [rcx + 1]
setb dl
add rbx, 4
mov rcx, r8
cmp r8, 0x100
jne 0x140183f69
lea rcx, [0x1404396e4]
call fcn.140240ec8
jmp 0x140183eff
lea rax, str.out_of_bounds_access_in_std::array_T__N_
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_array
lea r9, str.__n____Size
mov r8d, 0xda
call fcn.140280b90
int3