joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180134d60
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1806c4cd8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x40]
call fcn.180134e80
nop
lea rcx, [rsp + 0x40]
call fcn.18010b7a0
movzx eax, al
test eax, eax
jne 0x180134dec
lea rdx, [0x1805c3d08]
mov rcx, qword [rsp + 0x290]
call fcn.18007d860
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.18007d7e0
mov rax, qword [rsp + 0x290]
jmp 0x180134e63
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call fcn.18007d760
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x60]
lea r8, [0x1805c3d08]
lea rdx, [0x1805dbd38]
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x290]
call fcn.18007d860
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.18007d7e0
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1804688c0
add rsp, 0x280
pop rdi
ret
Function at 0x180171580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov rax, qword [rcx + 0x18]
sub rax, qword [rcx + 0x10]
sar rax, 2
cmp rax, rdx
jbe 0x18017175a
test r8, r8
je 0x18017175a
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
xor r15d, r15d
test rax, rax
jne 0x180171687
lea ecx, [rax + 0x20]
call fcn.1804688ec
mov rdi, rax
mov qword [rsp + 0x80], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov rax, qword [rax + 0x10]
sub rax, qword [rdi]
sar rax, 3
cmp rax, 0x20
jae 0x180171617
mov rcx, rdi
call fcn.1801718c0
nop
mov qword [rsp + 0x80], rdi
mov rdx, rdi
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, 1
jne 0x180171722
lea rbx, [rsi + 8]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x28]
mov rax, qword [rcx + 8]
sub rax, qword [rcx]
sar rax, 3
mov qword [rdi + 0x18], rax
mov rdx, qword [rcx + 8]
cmp qword [rcx + 0x10], rdx
je 0x180171670
mov qword [rdx], rdi
add qword [rcx + 8], 8
jmp 0x18017167e
lea r8, [rsp + 0x80]
call fcn.180147180
nop
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi + 8]
sub rax, qword [rdi]
sar rax, 3
cmp rbp, rax
jb 0x180171707
lea rbx, [rsi + 8]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rdi + 8]
mov rax, rcx
sub rax, qword [rdi]
sar rax, 3
cmp rbp, rax
jb 0x1801716fe
mov qword [rsp + 0x80], r15
cmp qword [rdi + 0x10], rcx
je 0x1801716d8
mov qword [rcx], r15
add qword [rdi + 8], 8
jmp 0x1801716eb
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, rdi
call fcn.180147180
mov rcx, qword [rdi + 8]
mov rax, rcx
sub rax, qword [rdi]
sar rax, 3
cmp rbp, rax
jae 0x1801716c8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov qword [rax + rbp*8], r14
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.TlsSetValue_tlsKey__pData___TRUE
lea rcx, [rsp + 0x38]
call fcn.18014ce20
nop
mov dword [rsp + 0x20], 0x3d4
lea r9, str.e:zhanlue_rcimage_vendordependsopencvmodulescore_src_system.cpp
lea r8, str.cv::TlsAbstraction::SetData
lea rdx, [rsp + 0x38]
mov ecx, 0xffffff29
call fcn.1804afa50
nop
lea rdx, str.tlsSlots.size_____slotIdx__pData___NULL
lea rcx, [rsp + 0x38]
call fcn.18014ce20
nop
mov dword [rsp + 0x20], 0x468
lea r9, str.e:zhanlue_rcimage_vendordependsopencvmodulescore_src_system.cpp
lea r8, str.cv::TlsStorage::setData
lea rdx, [rsp + 0x38]
mov ecx, 0xffffff29
call fcn.1804afa50
int3
Function at 0x180197f60
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov rdx, rax
test rax, rax
je 0x180197f8d
and rdx, 0xfffffffffffffffe
jmp 0x180197fa5
call fcn.1801d2130
nop
xor ecx, ecx
call fcn.18021f690
nop
mov rdx, rax
mov byte [rax + 0xac], 1
mov byte [rbx - 0xc], 4
cmp qword [rbx - 0x30], rdx
jne 0x180197fc7
mov rax, qword [rdx + 0x98]
mov qword [rbx - 8], rax
mov qword [rdx + 0x98], rbx
add rsp, 0x30
pop rbx
ret
lea rcx, [rbx - 0x40]
call qword [case.0x18022e5e6.0]
nop
add rsp, 0x30
pop rbx
ret

Function at 0x180197fe0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword [rcx - 0x20]
mov qword [rdx - 0x20], rax
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov rdx, rax
test rax, rax
je 0x180198015
and rdx, 0xfffffffffffffffe
jmp 0x18019802d
call fcn.1801d2130
nop
xor ecx, ecx
call fcn.18021f690
nop
mov rdx, rax
mov byte [rax + 0xac], 1
mov byte [rbx - 0xc], 4
cmp qword [rbx - 0x30], rdx
jne 0x18019804f
mov rax, qword [rdx + 0x98]
mov qword [rbx - 8], rax
mov qword [rdx + 0x98], rbx
add rsp, 0x30
pop rbx
ret
lea rcx, [rbx - 0x40]
call qword [case.0x18022e5e6.0]
nop
add rsp, 0x30
pop rbx
ret
Function at 0x1801980a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rsi, rcx
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x1801980e0
and rdi, 0xfffffffffffffffe
jmp 0x1801980f6
call fcn.1801d2130
xor ecx, ecx
call fcn.18021f690
mov rdi, rax
mov byte [rax + 0xac], 1
mov rbp, qword [rsi - 0x20]
xor r15d, r15d
mov qword [rsi - 0x20], r15
mov r14, qword [rsi - 0x38]
mov rbx, qword [rdi + 0x98]
test rbx, rbx
je 0x18019811e
mov rax, qword [rbx - 8]
mov qword [rdi + 0x98], rax
jmp 0x18019816d
lea rcx, [rdi + 0xb8]
cmp qword [rcx], r15
je 0x18019814b
mov rbx, r15
xchg qword [rcx], rbx
mov rax, qword [0x1806c73d8]
test rax, rax
je 0x18019813e
call rax
mov rax, qword [rbx - 8]
mov qword [rdi + 0x98], rax
jmp 0x18019816d
mov edx, 0x100
mov ecx, 1
call fcn.18021da20
lea rbx, [rax + 0x40]
mov qword [rbx - 0x30], rdi
mov qword [rbx - 8], r15
inc qword [rdi + 0xb0]
mov qword [rbx - 0x38], r14
mov qword [rbx - 0x28], rdi
mov qword [rbx - 0x18], r15
mov dword [rbx - 0x10], r15d
mov qword [rbx - 0x20], rbp
mov dword [rbx - 0xc], 3
mov qword [rsp + 0x60], rbx
lea rax, vtable.tbb::task.0
mov qword [rbx], rax
mov byte [rbx - 0xb], 1
lea rax, vtable.tbb::interface9::internal::flag_task.0
mov qword [rbx], rax
mov byte [rbx + 8], 0
mov qword [rsi - 0x20], rbx
mov qword [rbx - 0x18], 2
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1801981cc
and rax, 0xfffffffffffffffe
jmp 0x1801981df
call fcn.1801d2130
xor ecx, ecx
call fcn.18021f690
mov byte [rax + 0xac], 1
mov r9, qword [rbx - 0x38]
mov r8, rbx
mov edx, 0x40
mov rcx, rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.18021e110
Function at 0x180198210
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1806c4cd8]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r14, rdx
mov rsi, rcx
mov eax, dword [rcx]
cmp dword [rcx + 4], eax
jge 0x18019840e
mov dword [rsp + 0x40], 1
mov qword [rbp - 0x40], 0x10002
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov qword [rsp + 0x60], r15
mov qword [rbp - 0x20], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x1801982ba
and rdi, 0xfffffffffffffffe
jmp 0x1801982d0
call fcn.1801d2130
xor ecx, ecx
call fcn.18021f690
mov rdi, rax
mov byte [rax + 0xac], 1
mov r9, qword [rsp + 0x20]
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, rdi
call fcn.18021e110
mov rbx, rax
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x180198317
mov rax, qword [rdi + 0xa0]
cmp qword [rdi + 0x40], rax
jne 0x18019830a
mov rax, qword [rsp + 0x20]
mov dword [rax], r15d
jmp 0x180198317
mov rdx, rdi
mov rcx, qword [rsp + 0x20]
call fcn.1801d1b50
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
test ecx, ecx
mov rcx, qword [rsp + 0x20]
jne 0x180198357
mov eax, dword [rcx + 0x80]
bt rax, 0x11
jb 0x180198357
mov rax, qword [rdi + 0xa0]
mov rax, qword [rax - 0x38]
mov rax, qword [rax + 0x70]
mov qword [rcx + 0x70], rax
or qword [rcx + 0x80], 0x20000
mov rcx, qword [rsp + 0x20]
mov rax, qword [0x1806c73e0]
test rax, rax
jne 0x180198368
mov rax, r15
jmp 0x18019836f
call rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x20], rax
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x1801983ef
lea rax, vtable.tbb::task.0
mov qword [rbx], rax
mov byte [rbx - 0xb], 1
lea rax, vtable.._AV__start_for_V__blocked_range_H_tbb__VProxyLoopBody__A0xcf67f9a5____CBVauto_partitioner_2__internal_interface9_tbb__.0
mov qword [rbx], rax
movups xmm0, xmmword [rsi]
movups xmmword [rbx + 8], xmm0
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x18], xmm0
movsd xmm1, qword [r14 + 0x10]
movsd qword [rbx + 0x28], xmm1
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 1
je 0x1801983c5
and rax, 0xfffffffffffffffe
jmp 0x1801983d2
mov r8b, 1
mov ecx, 0xffffffff
call fcn.1801d21f0
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0xd4]
mov dword [rbx + 0x38], r15d
mov byte [rbx + 0x3c], 5
inc ecx
add rcx, rcx
mov qword [rbx + 0x30], rcx
jmp 0x1801983f2
mov rbx, r15
mov rcx, qword [rbx - 0x28]
mov rax, qword [rcx]
lea r8, [rbx - 8]
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rsp + 0x40]
call fcn.1801d1840
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1804688c0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180199990
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
mov rbx, r9
mov dword [r9], eax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r14d, 0x40000000
mov ecx, dword [rsi + 0x1c]
mov r8d, edi
sub r8d, eax
mov edx, eax
cmp r8d, r14d
cmova r8d, r14d
add rdx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov edx, eax
test eax, eax
jle 0x1801999ec
mov eax, dword [rbx]
add eax, edx
mov dword [rbx], eax
cmp eax, edi
jb 0x1801999c1
test edx, edx
jns 0x180199a15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov edx, 0xffffffff
mov rcx, rsi
mov r8, rax
call fcn.1801996e0
mov eax, 0xffffffff
jmp 0x180199a20
jne 0x180199a1e
mov dword [rsi + 0x50], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1801d1840
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov eax, dword [rcx]
cmp eax, 2
jne 0x1801d1a13
mov rdi, qword [rcx + 0x90]
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov edx, 1
test rdi, rdi
je 0x1801d1892
cmp qword [rdi + 0x30], 0
jne 0x1801d188d
cmp byte [rdi + 0x78], 0
je 0x1801d1892
mov rcx, rdx
jmp 0x1801d1894
xor ecx, ecx
or rcx, rdi
cmp rax, rcx
jne 0x1801d197a
mov rax, qword [rbx + 0x90]
mov r8, qword [rax + 0x148]
mov qword [rax + 0x150], rdx
mfence
mov rax, qword [rbx + 0x90]
mov rax, qword [rax + 0x180]
test rax, rax
je 0x1801d191c
mov rdi, qword [rbx + 0x90]
add rdi, 0x140
mov rcx, rdi
call fcn.1801d1270
nop
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov rax, qword [rbx + 0x90]
mov qword [rax + 0x150], 0
test rdi, rdi
je 0x1801d1a13
mov byte [rdi], 0
jmp 0x1801d1a13
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov rax, qword [rbx + 0x90]
mov qword [rax + 0x150], 0
cmp r8, qword [0x1806d4e60]
je 0x1801d1a13
mov rdi, qword [rbx + 0x90]
add rdi, 0x140
mov rcx, rdi
call fcn.1801d1270
nop
test rdi, rdi
je 0x1801d1a13
mov byte [rdi], 0
jmp 0x1801d1a13
mov eax, 4
xchg dword [rbx], eax
cmp eax, 3
jne 0x1801d199f
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
jmp 0x1801d1a13
mov rax, qword [rbx + 0x90]
lock xadd qword [rax + 0x180], rdx
mov rcx, qword [rbx + 0x90]
add rcx, 0x150
call fcn.1801d1e00
nop
mov rcx, qword [rbx + 0x90]
add rcx, 0x140
call fcn.1801d1270
nop
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov rax, qword [rbx + 0x90]
mov byte [rax + 0x140], 0
mov rcx, qword [rbx + 0x90]
mov rax, 0xffffffffffffffff
lock xadd qword [rcx + 0x180], rax
mov rdi, qword [rbx + 0x88]
test rdi, rdi
je 0x1801d1a38
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
nop
test rdi, rdi
je 0x1801d1a38
mov rcx, rdi
call qword [case.0x1801d165c.0]
nop
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1801d1a50
mov rax, qword [case.0x18021da19.1]
test rax, rax
je 0x1801d1a50
call rax
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1801d1c50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x78], 0
mov rdi, rcx
jne 0x1801d1d7a
mov ebx, 1
xor eax, eax
lock cmpxchg qword [rcx + 0x78], rbx
jne 0x1801d1d7a
mov ecx, dword [0x1806d4e68]
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1801d1c97
and rax, 0xfffffffffffffffe
jmp 0x1801d1ca9
call fcn.1801d2130
xor ecx, ecx
call fcn.18021f690
mov byte [rax + 0xac], bl
mov rbp, qword [rax + 0x88]
test byte [rdi + 0x98], bl
je 0x1801d1d68
lea rcx, [0x1806d5711]
call fcn.1801d1270
cmp qword [rdi + 0x78], rbx
je 0x1801d1ce7
mov rbp, qword [rsp + 0x38]
mov al, 1
mov byte [0x1806d5711], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x40], rsi
lock xadd qword [0x1806d4e60], rbx
mov eax, dword [rbp + 0x24]
test eax, eax
je 0x1801d1d1f
lea rbx, [rbp + 0xf8]
mov esi, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1801d1d15
mov r8, rdi
call fcn.1801d1e60
add rbx, 8
sub rsi, 1
jne 0x1801d1d05
mov rbx, qword [rbp + 0xe8]
lea rsi, [rbp + 0xe0]
cmp rbx, rsi
je 0x1801d1d5c
xor ebp, ebp
nop dword [rax]
nop dword [rax + rax]
test rbx, rbx
lea rcx, [rbx - 0x10]
mov r8, rdi
cmove rcx, rbp
call fcn.1801d1e60
mov rbx, qword [rbx + 8]
cmp rbx, rsi
jne 0x1801d1d40
mov rsi, qword [rsp + 0x40]
mov byte [0x1806d5711], 0
mov rbp, qword [rsp + 0x38]
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x1801d2060
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
je 0x1801d209b
cmp qword [rbx + 0x30], 0
jne 0x1801d2087
cmp byte [rbx + 0x78], 0
je 0x1801d209b
mov ecx, 1
or rcx, rbx
cmp rax, rcx
sete al
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
or rcx, rbx
cmp rax, rcx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x1801d20b0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1801d20d2
cmp qword [rcx + 0x30], 0
jne 0x1801d20cb
cmp byte [rcx + 0x78], 0
je 0x1801d20d2
mov edx, 1
jmp 0x1801d20d4
xor edx, edx
mov ecx, dword [0x1806d4e68]
or rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [0x1806d4e50]
test rax, rax
je 0x1801d2128
mov qword [rsp + 0x28], rbx
lea rcx, [0x1801d2320]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rbx + 0x188]
movdqa xmmword [rsp + 0x20], xmm0
call rax
test eax, eax
je 0x1801d2128
mov qword [rbx + 0x188], 0
add rsp, 0x30
pop rbx
ret
Function at 0x1801d21f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edi, r8b
mov ebx, ecx
call fcn.1801d2130
mov ecx, dword [0x1806d4e68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1801d22e5
mov rbx, rax
and rbx, 0xfffffffffffffffe
test al, 1
jne 0x1801d22cc
call fcn.1801d1f20
mov ecx, eax
call fcn.180221f70
xor edx, edx
mov qword [rbx + 0x30], rax
mov r9d, 1
mov qword [rbx + 0x20], rdx
mov r8, rax
mov word [rbx + 0x50], r9w
lea rcx, [rax + 0x180]
mov qword [rbx + 0x28], rcx
lea rcx, [rax - 0x80]
mov qword [rbx + 0x48], rcx
test rcx, rcx
je 0x1801d2273
cmp byte [rcx + 0x10], r9b
jne 0x1801d2273
test rcx, rcx
je 0x1801d2273
mov byte [rcx + 0x10], dl
add rax, 0x88
mov qword [rbx + 0x68], rax
lea rax, [r8 + 0x108]
mov qword [rbx + 0x70], rax
mov rax, qword [rax]
mov qword [rbx + 0x168], rax
mov rax, qword [rbx + 0x28]
mov qword [rax], rbx
mov rax, qword [rbx + 0xa0]
mov rcx, qword [rbx + 0x30]
mov rax, qword [rax - 0x38]
mov qword [rcx + 0x138], rax
cmp qword [rbx + 0x30], rdx
jne 0x1801d22ba
cmp byte [rbx + 0x78], dl
je 0x1801d22bd
mov rdx, r9
mov ecx, dword [0x1806d4e68]
or rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test dil, dil
jne 0x1801d22d7
inc dword [rbx + 0xa8]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ebx, 0xffffffff
jne 0x1801d22f1
call fcn.1801d1f20
mov ebx, eax
mov ecx, ebx
call fcn.180221f70
mov rcx, rax
call fcn.18021f690
mov rbx, qword [rsp + 0x30]
mov byte [rax + 0xac], dil
add rsp, 0x20
pop rdi
ret
Function at 0x1801da2e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1801da314
lea rcx, str._have_cleartype_quality
call fcn.180234000
xor eax, eax
add rsp, 0x148
ret
cmp dword [rsp + 0x24], 5
ja 0x1801da324
jne 0x1801da30a
cmp dword [rsp + 0x28], 1
jb 0x1801da30a
mov eax, 1
add rsp, 0x148
ret
Function at 0x1801e9e50
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r10d, dword [0x1806d4c38]
mov ebp, r9d
mov rax, qword gs:[0x58]
mov ebx, r8d
mov r14d, dword [rsp + 0x60]
mov edi, edx
mov r9d, dword [rsp + 0x58]
mov r8, rcx
mov r15d, dword [rsp + 0x50]
mov esi, dword [rsp + 0x48]
mov r12d, 0x30
add r12, qword [rax + r10*8]
xor r11d, r11d
mov r10d, r11d
lea rax, [r12 + 0x14]
nop
cmp dword [rax - 0xc], edi
jne 0x1801e9ee0
cmp dword [rax - 8], ebx
jne 0x1801e9ee0
cmp dword [rax], esi
jne 0x1801e9ee0
cmp dword [rax + 8], r9d
jne 0x1801e9ee0
cmp dword [rax - 4], ebp
jne 0x1801e9ee0
cmp dword [rax + 4], r15d
jne 0x1801e9ee0
cmp dword [rax + 0xc], r14d
jne 0x1801e9ee0
cmp qword [rax + 0x14], 0
jne 0x1801e9f8b
inc r11d
inc r10
add rax, 0x30
cmp r10, 8
jl 0x1801e9eb0
test rcx, rcx
je 0x1801e9f6c
mov rax, qword [r8 + 0x10]
mov ecx, dword [rax]
cmp ecx, 0x3f
je 0x1801e9f63
cmp ecx, edi
je 0x1801e9f09
cmp ecx, 0x40
jne 0x1801e9f57
mov ecx, dword [rax + 4]
cmp ecx, ebx
je 0x1801e9f18
cmp ecx, 0x50000
jne 0x1801e9f57
mov ecx, dword [rax + 0xc]
cmp ecx, esi
je 0x1801e9f27
cmp ecx, 0x50000
jne 0x1801e9f57
mov ecx, dword [rax + 0x14]
cmp ecx, r9d
je 0x1801e9f37
cmp ecx, 0x50000
jne 0x1801e9f57
mov ecx, dword [rax + 8]
and ecx, ebp
cmp ecx, dword [rax + 8]
jne 0x1801e9f57
mov ecx, dword [rax + 0x10]
and ecx, r15d
cmp ecx, dword [rax + 0x10]
jne 0x1801e9f57
mov ecx, dword [rax + 0x18]
and ecx, r14d
cmp ecx, dword [rax + 0x18]
je 0x1801e9fa8
mov ecx, dword [rax + 0x28]
add rax, 0x28
cmp ecx, 0x3f
jne 0x1801e9f00
mov r8, qword [r8 + 8]
test r8, r8
jne 0x1801e9ef5
xor eax, eax
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov rdx, qword [rsp + 0x68]
movsxd rax, r11d
lea rcx, [rax + rax*2]
add rcx, rcx
mov rax, qword [r12 + rcx*8]
mov qword [rdx], rax
mov rax, qword [r12 + rcx*8 + 0x28]
jmp 0x1801e9fba
mov rdx, qword [rsp + 0x68]
mov r11d, 7
mov qword [rdx], r8
mov rax, qword [rax + 0x20]
mov r8, qword [rsp + 0x70]
mov qword [r8], rax
test r11d, r11d
je 0x1801ea033
movsxd rcx, r11d
lea rax, [rcx + rcx*2]
shl rax, 4
add rax, r12
nop word [rax + rax]
lea rax, [rax - 0x30]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rax + 0x40], xmm1
movups xmmword [rax + 0x50], xmm0
sub rcx, 1
jne 0x1801e9fe0
mov rax, qword [rdx]
mov qword [r12], rax
mov rax, qword [r8]
mov qword [r12 + 0x28], rax
mov dword [r12 + 8], edi
mov dword [r12 + 0xc], ebx
mov dword [r12 + 0x10], ebp
mov dword [r12 + 0x14], esi
mov dword [r12 + 0x18], r15d
mov dword [r12 + 0x1c], r9d
mov dword [r12 + 0x20], r14d
mov eax, 1
jmp 0x1801e9f6e