joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.14007c020
test eax, eax
je 0x140065f6c
mov ebp, eax
xor edi, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
movzx edx, bp
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140065f6e
mov r14, rax
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140065f6c
mov rdi, rax
mov rcx, rbx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
xor edi, edi
test ebx, ebx
je 0x140065f6e
test rax, rax
je 0x140065f6e
mov r8d, ebx
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.14016f380
cmp byte [rsi + 0x17], 0
jns 0x140065f56
mov rcx, qword [rsi]
call fcn.14013a790
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov dil, 1
jmp 0x140065f6e
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14013bb80
mov eax, edi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140065f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rcx, rdx
call fcn.14007c020
test eax, eax
je 0x140066065
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
movzx edx, bx
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140066065
mov rbx, rax
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140066065
mov r14, rax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LockResource]
test ebp, ebp
je 0x140066065
mov rbx, rax
test rax, rax
je 0x140066065
mov ecx, 0x70
call fcn.14013a754
mov rdi, rax
mov r8d, ebp
mov dword [rsp + 0x20], 1
mov rcx, rax
mov rdx, rbx
xor r9d, r9d
call fcn.14008db40
test rdi, rdi
je 0x140066058
mov rax, qword [rdi + 8]
movsxd rax, dword [rax + 4]
lea rcx, [rdi + rax]
add rcx, 8
mov rax, qword [rdi + rax + 8]
mov rax, qword [rax]
call qword [0x140219008]
mov rcx, rsi
mov rdx, rdi
call fcn.1400a83b0
jmp 0x14006606c
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140066a40
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov edi, esi
shr edi, 1
and edi, 6
mov r14, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
call r14
lea ebx, [rdi + 8]
test ax, ax
cmovns ebx, edi
mov r15d, esi
shl r15d, 4
and r15d, 0x10
mov r12d, esi
and r12d, 0x10
shl esi, 5
and esi, 0x40
mov ecx, 0x90
call r14
mov edi, eax
and edi, 1
shl edi, 8
mov ecx, 0x14
call r14
and eax, 1
lea ecx, [r15 + r12*2]
or ecx, esi
or ecx, ebx
or ecx, edi
or eax, ecx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140066ac0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
shr eax, 0xf
add rsp, 0x28
ret

Function at 0x140066ae0
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
movzx r14d, ax
shr r14d, 0xf
lea ebp, [r14 + r14]
mov ecx, 0x11
call rsi
test ax, ax
lea r14d, [r14 + r14 + 4]
cmovns r14d, ebp
mov ecx, 0x12
call rsi
lea r15d, [r14 + 8]
test ax, ax
cmovns r15d, r14d
mov ecx, 0x90
call rsi
mov ebp, eax
and ebp, 1
shl ebp, 8
mov ecx, 0x14
call rsi
mov esi, eax
and esi, 1
or esi, ebp
or esi, r15d
lea rax, [rbx - 0x5b]
cmp rax, 0x35
ja 0x140066b8a
movabs rcx, 0x200000001dffe0
bt rcx, rax
jae 0x140066b73
or esi, 0x200
jmp case.0x140066ba2.14
test rax, rax
je 0x140066c28
cmp rax, 1
jne 0x140066b8a
or esi, 0x800
jmp case.0x140066ba2.14
add rbx, 0xfffffffffffffff4
cmp rbx, 0x22
ja case.0x140066ba2.14
lea rax, [0x140066c30]
movsxd rcx, dword [rax + rbx*4]
add rcx, rax
jmp rcx
lea eax, [rsi + 0x200]
bt edi, 0x18
cmovb eax, esi
mov esi, eax
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
shr edi, 0xf
and edi, 0x200
or esi, edi
jmp case.0x140066ba2.14
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140066c28
mov ecx, 0xa1
jmp 0x140066c12
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140066c28
mov ecx, 0xa3
jmp 0x140066c12
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140066c28
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [rsi + 0x800]
test ax, ax
cmovns ecx, esi
mov esi, ecx
jmp case.0x140066ba2.14
or esi, 0x400
jmp case.0x140066ba2.14
Function at 0x140068a70
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
jne 0x140068b79
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140068ade
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.14013d5f0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x140068b79
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x140068bc3
lea rcx, [r12*8]
call fcn.14013a754
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x140068b52
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x140068b97
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x140068b3a
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x140068b79
mov rcx, r14
call fcn.14013a790
mov r15, qword [rsi + 0x10]
test r15, r15
je 0x140068b97
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140170320
call fcn.14016f5e0
int3
Function at 0x140068bd0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x140068bf4
mov r14, rbx
jmp 0x140068ce5
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x140068c49
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r14, [r15 + r12*8]
sub r15, rbx
je 0x140068c38
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.14013d5f0
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r14
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x140068ce5
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x140068d30
lea rcx, [r12*8]
call fcn.14013a754
lea r14, [r12 + r12]
add r14, 6
and r14, 0xfffffffffffffff8
add r14, rax
mov rcx, r14
sub r15, rbx
je 0x140068cc1
mov rdx, r15
sar rdx, 3
and r15, 0xfffffffffffffff8
mov rcx, r15
add rcx, r14
shl rdx, 3
xor r8d, r8d
mov r9, r14
add r9, r8
je 0x140068d04
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140068ca9
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
test rbx, rbx
je 0x140068ce5
mov rcx, rbx
call fcn.14013a790
mov r14, qword [rsi + 8]
add r14, 0xfffffffffffffff8
je 0x140068d04
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140170320
call fcn.14016f5e0
int3
Function at 0x140072680
Capabilities:
Log keystrokes via input method manager

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
movsxd rax, r9d
test rax, r8
je 0x14007275d
mov ebx, r9d
mov r14, rdx
mov rcx, rdx
mov edx, r9d
xor r8d, r8d
xor r9d, r9d
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
test eax, eax
jle 0x140072787
mov ebp, esi
add ebp, 2
js 0x1400727c7
mov r12, qword [rsp + 0x90]
mov r15d, ebp
add r15, r15
mov rcx, r15
call fcn.14013a754
mov rdi, rax
xor eax, eax
mov rcx, rdi
add rcx, rax
je 0x14007279b
mov word [rcx], 0
add rax, 2
cmp r15, rax
jne 0x1400726e1
mov rcx, r14
mov edx, ebx
mov r8, rdi
mov r9d, ebp
call sub.IMM32.dll_ImmGetCompositionStringW
test rdi, rdi
je 0x140072761
mov rcx, rdi
call fcn.14015bcc0
mov r8, qword [r12 + 8]
test rax, rax
je 0x140072772
mov rbx, rax
test r8, r8
jne 0x140072750
mov ecx, 0x18
call fcn.14013a754
mov r8, rax
mov qword [r12 + 8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [r12 + 0x10], 1
mov rcx, rdi
mov rdx, rbx
call sub.libcef.dll_cef_string_wide_to_utf8
jmp 0x14007277f
xor eax, eax
jmp 0x14007278c
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x140072787
call sub.libcef.dll_cef_string_utf8_clear
jmp 0x140072787
test r8, r8
je 0x14007277f
mov rcx, r8
call sub.libcef.dll_cef_string_utf8_clear
mov rcx, rdi
call fcn.14013a790
test esi, esi
setg al
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140170320
call fcn.140153cb0
int3
Function at 0x14007a5c0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x60], 0
je 0x14007a6a7
mov rdi, r8
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], r9d
mov eax, 1
mov ecx, edx
or ecx, 2
cmp ecx, 0x106
je 0x14007a61a
xor eax, eax
cmp edx, 0x105
sete al
mov dword [rsp + 0x40], eax
mov eax, edx
or eax, 4
cmp eax, 0x104
je 0x14007a641
and edx, 0xfffffffb
cmp edx, 0x101
jne 0x14007a6bd
mov dword [rsp + 0x30], 2
mov rcx, rdi
mov rdx, r9
call fcn.140066ae0
mov ebx, eax
mov dword [rsp + 0x34], ebx
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
lea rsi, [rsp + 0x28]
mov rdx, rsi
call qword [0x140219008]
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x108]
lea rdx, [rsp + 0x30]
call qword [0x140219008]
mov rax, qword [rsi]
test rax, rax
je 0x14007a6a7
mov rcx, qword [rax + 8]
movsxd rcx, dword [rcx + 4]
add rcx, rax
add rcx, 8
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140219008]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14013bb80
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov dword [rsp + 0x30], 3
mov rcx, rdi
mov rdx, r9
call fcn.140066ae0
mov ebx, eax
mov dword [rsp + 0x34], eax
mov ecx, 0xa5
call fcn.140066ac0
test al, al
je 0x14007a652
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, edi
mov rdx, rax
call qword [sym.imp.USER32.dll_VkKeyScanExW]
not eax
test eax, 0x600
jne 0x14007a652
and ebx, 0xffffeff3
or ebx, 0x1000
jmp 0x14007a64e
Function at 0x1400a4ef0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x1400a5091
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x1400a4f6b
cmp r14, rax
ja 0x1400a5096
lea rcx, [r14*8]
call fcn.14013a754
jmp 0x1400a4f6d
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x1400a5065
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rbx], rcx
mov qword [rdi], 0
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x1400a500d
mov r8, qword [rdx - 8]
mov qword [rbx - 8], r8
mov qword [rdx - 8], 0
lea r8, [rdx - 8]
add rbx, 0xfffffffffffffff8
mov rdx, r8
cmp r8, rdi
jne 0x1400a4f9b
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x1400a5018
add r14, 0xfffffffffffffff8
test r14, r14
je 0x1400a5039
mov rax, qword [r14]
test rax, rax
je 0x1400a4fff
mov rcx, qword [rax + 8]
movsxd rcx, dword [rcx + 4]
add rcx, rax
add rcx, 8
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140219008]
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x1400a4fd6
jmp 0x1400a5018
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
je 0x1400a502e
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14013a790
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140170320
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140170320
call fcn.140153cb0
call fcn.14016f5e0
int3

Function at 0x1400c2010
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c2098
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400c2082
cmp dword [rsp + 0x38], 4
jne 0x1400c2082
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14013bb80
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x1400c2082
Function at 0x1400c20a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14013bb20
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.14013dca0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c2163
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x1400c2167
lea rcx, [rsp + 0x840]
call fcn.14015bcc0
lea rdx, [rsp + 0x840]
mov rcx, rsi
mov r8, rax
call fcn.14008c6d0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14013bb80
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x1400c2144
cmp eax, 2
jne 0x1400c21bc
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.14013dca0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x1400c21c3
lea rcx, [rsp + 0x40]
call fcn.14015bcc0
lea rdx, [rsp + 0x40]
jmp 0x1400c2137
mov edi, 0x3f4
jmp 0x1400c2144
mov edi, 0xea
jmp 0x1400c2144
Function at 0x1400d8610
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x1400d882c
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1401eebd0], rax
jne 0x1400d882f
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.14011daa0
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400d87ee
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x1400d877c
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d87e7
lea rdx, [rsi + r12*8]
bswap rcx
mov r14d, dword [rdx + 0x60]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x1400d87fb
mov edx, ecx
and edx, 0x1fc000
je 0x1400d87fb
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.140120420
mov ecx, dword [0x140202ba0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1401fc744]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14013bb80
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.1401255e0
test rax, rax
je 0x1400d8832
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x1400d86f7
xor ecx, ecx
jmp 0x1400d86dd
mov rcx, rbx
call fcn.140121270
jmp 0x1400d868e
movaps xmm0, xmmword [0x1401c9ef0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.1401887d0
mov rcx, rsi
call fcn.140019c10
mov rcx, r14
call fcn.140188840
int3
int3
xor edi, edi
jmp 0x1400d8721
Function at 0x1400da2f0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xc0]
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x58], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14013a754
mov rsi, rax
mov rax, qword [0x1401eeae0]
and rax, r15
cmp rax, qword [0x1401eeac8]
je 0x1400da3b4
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x1400da7e0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400da3be
test r14, r14
je 0x1400da409
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14013bb80
mov eax, ebx
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, r15
call fcn.140117d10
jmp 0x1400da34d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400da3d7
mov ebp, eax
cmp eax, 0x5af
je 0x1400da3d7
cmp ebp, 0xe
jne 0x1400da417
mov rcx, rbx
call fcn.140191510
test rsi, rsi
je 0x1400da390
mov rcx, qword [rsi]
mov rax, qword [0x1401eeae0]
and rax, rcx
cmp rax, qword [0x1401eeac8]
jne 0x1400da3ff
call fcn.140117e60
mov rcx, rsi
call fcn.14013a790
jmp 0x1400da390
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400da390
mov eax, dword [0x140203958]
mov ecx, dword [0x1401fc744]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400da48f
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, ebp
call fcn.1400d9330
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
cmovs rcx, qword [rbx + 8]
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, qword [0x140203950]
call fcn.140127090
cmp byte [rbx + 0x17], 0
jns 0x1400da3df
mov rcx, qword [rsp + 0x30]
call fcn.14013a790
jmp 0x1400da3df
lea rcx, [0x140203958]
call fcn.14013a8b0
cmp dword [0x140203958], 0xffffffff
jne 0x1400da438
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400edd10
mov qword [0x140203950], rax
lea rcx, [0x140203958]
call fcn.14013a948
jmp 0x1400da438
Function at 0x1400dadd0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x1401c55e0]
mov qword [rcx], rax
add rcx, 8
call fcn.140128be0
lea rcx, [rsi + 0x10]
call fcn.140128be0
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140128be0
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
mov qword [rsi + 0xc0], rbx
movups xmmword [rsi + 0xc8], xmm6
movups xmmword [rsi + 0xd8], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x1401d42fc]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.1400f08f0
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.1400ef190
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.1400ef190
lea rcx, [rsi + 0x330]
xor edx, edx
call fcn.1400ef190
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
mov dword [rsi + 0x360], ebp
movups xmmword [rsi + 0x368], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
mov byte [rsi + 0x398], bl
mov dword [rsi + 0x39c], edi
mov byte [rsi + 0x3a0], bl
movups xmmword [rsi + 0x3a8], xmm6
movups xmmword [rsi + 0x3b8], xmm6
call fcn.140019c10
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.1400db000
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x1400dafeb
call fcn.1400f04b0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400f0560
mov qword [0x140203d40], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x140219008]
jmp 0x1400dafb9