joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a8c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
movabs rax, 0xbe7a6eaac5203d68
movabs r8, 0xbe7a6eaac5203d79
xor rax, r8
cmp rdx, rax
mov qword [rsp + 0x40], rcx
jl 0x14001ab09
mov eax, dword [0x1402a8b78]
xor eax, 0x7ba8dfae
mov r8d, dword [0x1402a8b7c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x731d3320
xor ecx, 0x411e5877
xor edx, edx
div ecx
mov ecx, 0x567ff678
xor ecx, 0xb647cb7a
xor edx, edx
div ecx
mov r8d, eax
mov ecx, r8d
xor ecx, 0xffffffff
mov eax, 0xb0394082
xor eax, 0x12551871
and eax, ecx
mov edx, 0xffffffff
xor edx, 0xa26c58f3
and r8d, edx
mov ecx, 0x5355fe8
xor ecx, 0x35d78c96
mov r9d, 0x8ad7e7fa
xor r9d, 0x75281805
xor ecx, r9d
and ecx, 0xa26c58f3
and edx, 0x30e2d37e
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0xf2a3c9c8
ja 0x14001ab37
mov r8, qword [rsp + 0x38]
mov ecx, dword [0x1402a8b80]
mov r9d, dword [0x1402a8b84]
mov r10d, r9d
xor r10d, 0xffffffff
mov edx, ecx
and edx, r10d
mov eax, ecx
or eax, r10d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r9d
or ecx, r9d
imul ecx, edx
add ecx, eax
mov edx, 0xd8fe10e0
xor edx, 0x2701ef1f
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x757b3ebc
xor ecx, 0xcbad611a
mov edx, 0xd68cf97a
xor edx, 0x29730685
xor ecx, edx
mov edx, 0x44e89f56
xor edx, 0xfa3ec0f0
mov r9d, 0x38a88122
xor r9d, 0xc7577edd
xor edx, r9d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xe77e79dd
xor ecx, 0x5dc36c77
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xa89629e1
xor edx, 0x5769d61e
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
mov edx, 0xbae9296b
xor edx, 0x4516d694
xor eax, edx
mov edx, 0x4acca12b
xor edx, 0xdd544a31
mov r9d, 0xde2bf7bc
xor r9d, 0x21d40843
xor edx, r9d
or eax, edx
mov edx, 0x9798eb1a
and edx, 0x9798eb1a
mov r9d, 0x68a44dde
xor r9d, 0x975bb221
xor edx, r9d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
movabs rdx, 0x82d4bbf05d482497
mov rcx, r8
add rcx, rdx
add rcx, 0xfffffffffffffffe
movabs rdx, 0x82d4bbf05d482497
sub rcx, rdx
movzx ecx, word [rcx]
mov rdx, r8
xor rdx, rcx
xor rcx, 0xffffffffffffffff
and r8, rcx
movabs rcx, 0xeeffbac1196ad380
movabs r9, 0xeeffbac1196ad382
xor rcx, r9
imul rcx, r8
sub rcx, rdx
mov qword [rsp + 0x30], rcx
cmp eax, 0xb47c04ca
ja 0x14001ab37
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
jmp 0x14001ab09
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
add rsp, 0x48
jmp fcn.140017ba0
pop rbp
je 0x14001ab6c
jmp 0x14001a99e
invalid
Function at 0x14001d8a6
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x3f], cl
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x3f]
mov rax, qword [rdx + 8]
mov qword [rsp + 0x40], rax
test cl, 1
jne 0x14001d8e4
jmp 0x14001d902
mov rax, qword [rsp + 0x40]
cmp rax, 0
jle 0x14001d967
mov rcx, qword [rsp + 0x30]
call fcn.140015de0
jmp 0x14001d967
mov rax, qword [rsp + 0x40]
movabs rcx, 0xcecc415d52f7c7fd
movabs rdx, 0xcecc415d52f7c7fd
xor rcx, rdx
cmp rax, rcx
jne 0x14001d967
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
and rax, 1
cmp rax, 0
jne 0x14001d967
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rcx]
mov r9, 0xffffffffffffffff
xor r9, 0xfffffffffffffffc
mov rax, r8
xor rax, r9
and rax, r8
mov qword [rcx], rax
call fcn.14001cfd0
nop
add rsp, 0x48
ret
Function at 0x14001ddb1
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x60], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x68], rax
mov rcx, qword [rcx + 8]
mov r8, 0xffffffffffffffff
xor r8, 3
mov rax, rcx
and rax, r8
mov rdx, rcx
or rdx, r8
xor rdx, 0xffffffffffffffff
imul rdx, rax
mov r8, rcx
and r8, 3
mov rax, rcx
or rax, 3
imul rax, r8
add rax, rdx
mov qword [rsp + 0x70], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x1402ba748]
mulsd xmm0, xmm1
movsd qword [rsp + 0x78], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x80], xmm1
ucomisd xmm0, xmm1
jne 0x14001de40
jp 0x14001de40
jmp 0x14001de92
movsd xmm1, qword [rsp + 0x78]
movsd xmm0, qword [rsp + 0x80]
subsd xmm0, xmm1
call fcn.1402a7e80
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x78]
movsd qword [rsp + 0x58], xmm1
call fcn.1402a7e80
movsd xmm1, qword [rsp + 0x58]
movsd xmm2, qword [0x1402ba750]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x14001de92
call fcn.14000ee80
jmp 0x14001dfc5
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
movabs r8, 0x78d4f8dcf9bc9e05
movabs rdx, 0x78d4f8dcf9bc9e07
xor r8, rdx
cqo
idiv r8
mov qword [rsp + 0x38], rax
mov qword [rcx], rax
movabs rcx, 0x162d900c7bcda580
movabs rdx, 0x162d900c7bcda584
xor rcx, rdx
shl rax, cl
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x1402ba758]
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x14001df1b
jp 0x14001df1b
jmp 0x14001df6a
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
subsd xmm0, xmm1
call fcn.1402a7e80
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x30], xmm1
call fcn.1402a7e80
movsd xmm1, qword [rsp + 0x30]
movsd xmm2, qword [0x1402ba750]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x14001df6a
call fcn.14000ee80
jmp 0x14001dfc5
mov rax, qword [rsp + 0x40]
cmp rax, 0
jge 0x14001df89
mov rcx, r8
mov rdx, r8
call fcn.140018506
jmp 0x14001dfc5
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x68
call fcn.1400180e0
mov rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
add rsp, 0x88
ret
Function at 0x1400255e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov qword [rcx], rdx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x40]
cmp rax, 0
Function at 0x140025e55
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140025b10
mov rcx, rax
mov rax, qword [0x1402c5da0]
mov qword [rcx], rax
lea rax, [0x1402baeee]
mov qword [rcx + 0x10], rax
movabs rax, 0x9ac0bb5deb59afc1
movabs rdx, 0x9ac0bb5deb59afc1
xor rax, rdx
mov qword [rcx + 0x18], rax
lea rax, [0x1402baeb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x772dcb76
lea rdx, [0x1402baeee]
lea r8, [0x1402baecc]
lea r9, [0x1402baed5]
call fcn.140025a43
nop
add rsp, 0x28
ret
Function at 0x140027220
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [rcx]
mov qword [rsp + 0x48], rax
mov qword [rcx], rdx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x48]
cmp rax, 0
je 0x1400274b9
mov rax, qword [rsp + 0x48]
mov rcx, rax
and rcx, 0xfffffffffffffff0
shl rcx, 1
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
movabs rcx, 0x3deda3ebef86bb30
movabs rdx, 0x3deda3ebef86bb20
xor rcx, rdx
cmp rax, rcx
jb 0x140027498
mov rcx, qword [rsp + 0x40]
xor eax, eax
mov edx, eax
sub rdx, 0xfffffffffffffff0
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x30], rax
mov r8, rax
xor r8, rcx
xor r8, 0xffffffffffffffff
mov rdx, rcx
and rdx, r8
shl rdx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0xcf16348130be2c10
movabs r8, 0x30e9cb7ecf41d3ef
xor rcx, r8
cmp rax, rcx
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x140027300
jmp 0x14002730a
call fcn.14000ee80
jmp 0x1400274b9
mov ecx, dword [0x1402a9058]
mov r8d, dword [0x1402a905c]
mov edx, r8d
xor edx, 0xffffffff
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, r8d
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x15369eee
xor edx, 0xeac96111
xor ecx, edx
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xaca49ac5
mov edx, 0xc9a9f4f8
xor edx, 0x650d6e3d
mov r8d, 0x33773ad3
xor r8d, 0xcc88c52c
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xb2916ec4
xor ecx, 0xe2240b23
sub eax, ecx
sub eax, 0xfbb6b97
add eax, 0x50b565e7
mov ecx, 0x65af5f26
xor edx, edx
div ecx
cmp eax, 0x32e1668
je 0x1400274c0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r9d, dword [0x1402a9060]
mov r10d, dword [0x1402a9064]
mov r8d, 0x66e7e01f
xor r8d, 0x2930686a
xor r10d, r8d
mov r8d, r9d
or r8d, r8d
xor r8d, 0xffffffff
mov esi, 0x698758b0
xor esi, 0x9678a74f
mov r11d, r10d
xor r11d, esi
mov esi, r10d
xor esi, 0xffffffff
and r11d, esi
mov esi, 0xd3276a51
xor esi, 0x2cd895ae
xor r8d, esi
xor r11d, 0xffffffff
and r8d, r11d
or r9d, r10d
mov r10d, 0x1b934e9f
xor r10d, 0xe46cb160
xor r9d, r10d
xor r8d, 0xffffffff
mov r10d, 0x2e30d274
xor r10d, 0xd1cf2d8b
xor r9d, r10d
and r8d, r9d
mov r9d, 0x87ede64d
xor r9d, 0x13a0cb94
sub r8d, r9d
mov r9d, 0x60474954
xor r9d, 0xbb0da412
add r8d, r9d
add r8d, 0x944d2dd9
sub r8d, 0x1c43237d
mov r9d, 0x86b803c2
xor r9d, 0xf574e33b
sub r8d, r9d
add r8d, 0x466c75c0
add r8d, 0x73cce0f9
mov dword [rsp + 0x2c], r8d
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14001d8a6
mov eax, dword [rsp + 0x2c]
cmp eax, 0xf4b16899
je 0x1400274c0
jmp 0x1400274b9
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rax]
mov ecx, 1
call fcn.14001d8a6
mov rcx, qword [rsp + 0x48]
call fcn.14001d970
nop
add rsp, 0x50
pop rsi
ret
nop
fidiv word [rbp - 7]
jmp 0x140027396
Function at 0x140027c30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x140027e21
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov rdx, 0xffffffffffffffff
movabs rax, 0x4000000000000000
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jne 0x140027e21
mov eax, dword [0x1402a90b8]
mov edx, dword [0x1402a90bc]
xor edx, 0xffffffff
mov ecx, eax
xor ecx, edx
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
and eax, 0x442347f2
mov edx, 0x1e985a76
xor edx, 0xe167a589
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x442347f2
mov r8d, 0xffffffff
xor r8d, 0x442347f2
or edx, r8d
and ecx, edx
mov edx, 0x7884679c
xor edx, 0x877b9863
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x48575170
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xa7ef2d8f
xor r8d, 0xefb87cff
mov edx, eax
and edx, r8d
or eax, 0x48575170
imul eax, edx
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x68e5a017
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x68e5a017
or eax, 0x68e5a017
imul eax, edx
add eax, ecx
cmp eax, 0xf5c6f0d9
jae 0x140027e3e
mov eax, dword [0x1402a90c0]
mov r8d, dword [0x1402a90c4]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov edx, 0xffffffff
xor edx, 0x4ce8714
mov ecx, eax
and ecx, edx
mov r8d, 0xbc9caa27
xor r8d, 0xb8522d33
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0xd2f0b3e0
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xef2a5356
mov edx, 0xe2462d8d
xor edx, 0x1db9d272
xor ecx, edx
and ecx, 0xef2a5356
shl ecx, 1
sub ecx, 0xef2a5356
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, 0x3a78cf3d
xor eax, 0xc6b79f82
mov dword [rsp + 0x28], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x140027e3e
jmp 0x140027e21
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rcx, qword [rcx + 8]
mov qword [rax + 8], rcx
add rsp, 0x48
ret
test dword [rsi], ecx
iretd
Function at 0x14002dac0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x14002dc30
mov eax, dword [0x1402a9308]
mov edx, dword [0x1402a930c]
mov ecx, eax
xor ecx, edx
mov r8d, 0xf0a147ca
xor r8d, 0xf5eb835
xor ecx, r8d
or eax, edx
and eax, ecx
and eax, 0xbfa2f953
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xb32b7df3
xor ecx, 0xd2c52d61
mov edx, 0x366cb335
xor edx, 0xc9934cca
xor ecx, edx
mov edx, 0xaf97215f
xor edx, 0xce7971cd
mov r8d, 0x549825d5
xor r8d, 0xab67da2a
xor edx, r8d
and ecx, edx
xor eax, 0xffffffff
mov edx, 0xd08d580e
xor edx, 0x2f72a7f1
xor ecx, edx
and eax, ecx
mov ecx, 0x1b171ae5
xor ecx, 0xde9f4011
xor eax, ecx
cmp eax, 0xa4093d44
jb 0x14002dc60
mov eax, dword [0x1402a9310]
imul eax, dword [0x1402a9314]
sub eax, 0xc9a7cbc7
mov ecx, 0x9642ea4e
xor ecx, 0xd5967922
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x40]
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x6d53040c
mov r8d, 0xa933392
xor r8d, 0x67c0379e
mov r9d, 0xf0474b41
xor r9d, 0xfb8b4be
xor r8d, r9d
and ecx, r8d
or eax, ecx
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
movabs rdx, 0x687dd6eeb418dc51
movabs r8, 0x687dd6eeb418dc51
xor rdx, r8
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x8b3d62aa
je 0x14002dc60
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14002dc13
jmp 0x14002dc30
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
movabs rdx, 0xc673c8a129de8bc6
movabs r8, 0xc673c8a129de8bc6
xor rdx, r8
mov qword [rcx], rdx
mov qword [rax], 0
add rsp, 0x48
ret
pand mm6, qword [rdx]
invalid
Function at 0x14002eeec
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x30]
add rcx, 0x60
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x14002ef53
mov rax, qword [0x1402d1090]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x14002ef53
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x38]
mov al, byte [rax]
mov cl, 0xe0
xor cl, 0xe0
cmp al, cl
je 0x14002ef86
mov rax, qword [rsp + 0x38]
mov cl, 0x62
xor cl, 0x62
mov byte [rax], cl
call fcn.14002ef97
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x14002ef91
mov ecx, 1
call qword [0x1402d10a0]
nop
add rsp, 0x48
ret

Function at 0x14002ef97
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x14002f3dd
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14006b3a0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002f41a
mov rcx, qword [rsp + 0x28]
call fcn.14006b448
nop
add rsp, 0x38
ret
Function at 0x1400300d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1402a9448]
mov edx, dword [0x1402a944c]
mov ecx, 0xb16a9c61
xor ecx, 0x4e95639e
xor eax, ecx
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xa17d7e44
or eax, edx
or ecx, 0xa17d7e44
xor eax, 0xffffffff
and eax, ecx
add eax, 0xe7d45e7d
or eax, 0x427ae76a
mov ecx, 0xd1fa44e7
xor ecx, 0x6f9886b1
xor edx, edx
div ecx
cmp eax, 0x710e315f
jae 0x14003024c
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov eax, dword [0x1402a9450]
mov r8d, dword [str.DZ3]
xor r8d, 0xfd3bec9b
or eax, r8d
add eax, 0x749285f6
mov r8d, eax
not r8d
mov r9d, eax
and r9d, 0x40b25dad
and r8d, 0xbf4da252
imul r8d, r9d
mov r9d, eax
and r9d, 0xbf4da252
or eax, 0xbf4da252
imul eax, r9d
add eax, r8d
imul rax, rax, 0x5f58b161
shr rax, 0x3e
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.1402a7dd0
sub rsp, rax
mov eax, dword [rbp - 0x3c]
mov r8, rsp
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x6a08ae31
je 0x14003013a
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x48], rax
jne 0x14003022e
jmp 0x140030200
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14002fc40
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x48]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
cmp eax, 0xe9b2079e
in eax, 0xfe
invalid
Function at 0x140030260
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x140030477
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
movabs rcx, 0x8bb1722657faabc3
movabs rdx, 0x8bb1722657faabd3
xor rcx, rdx
cmp rax, rcx
jb 0x140030456
mov r8, qword [rsp + 0x38]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
movabs rdx, 0x9dfcc70b69b4fba6
movabs rcx, 0x620338f4964b0459
xor rdx, rcx
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xffc07c95b9f6934e
and rcx, rdx
movabs r10, 0xf1285845c14dacd
movabs rdx, 0xf0d2f911e5e24983
xor r10, rdx
movabs rdx, 0x71b6d66068a1ea58
movabs r9, 0x8e49299f975e15a7
xor rdx, r9
xor r10, rdx
mov r9, rax
and r9, r10
movabs r11, 0xa83f46b78f9ec08c
movabs rdx, 0x57c0b94870613f73
xor r11, rdx
mov rdx, r8
xor rdx, r11
movabs r11, 0xffc07c95b9f6934e
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140030383
jmp 0x14003042f
mov eax, dword [0x1402a9458]
mov ecx, dword [0x1402a945c]
xor ecx, 0x789d5ec2
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0xb5ad83e3
mov eax, ecx
xor eax, edx
and eax, ecx
or eax, 0x1465351d
mov ecx, 0xdb1fd64f
xor ecx, 0xa4e7dcd7
xor eax, ecx
cmp eax, 0xa2379c61
ja 0x14003047d
mov eax, dword [0x1402a9460]
mov ecx, dword [0x1402a9464]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, 0xd7fc017f
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0xf1a6dbe7
xor eax, 0x88faf7ae
imul ecx, eax
mov edx, 0x3bbc0dff
xor edx, 0xff903ba
mov eax, 0x4f8b09c1
xor eax, 0xb074f63e
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [rsp + 0x24], eax
call fcn.14000ee80
mov eax, dword [rsp + 0x24]
cmp eax, 0x4fb4d502
jae 0x1400303c9
jmp 0x140030477
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
mov cl, 1
xor cl, 1
and cl, 1
call fcn.14001d8a6
jmp 0x140030477
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.14001d8a6
mov rcx, qword [rsp + 0x40]
call fcn.14001d970
nop
add rsp, 0x48
ret
adc eax, ecx
stc
invalid
Function at 0x140033d00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
call fcn.140117530
mov rax, qword [rsp + 0x28]
cmp byte [rax + 0x60], 0
jne 0x140033e8b
mov eax, dword [0x1402a95b8]
and eax, dword [0x1402a95bc]
mov ecx, 0x95d66db8
xor ecx, 0x33065f41
and eax, ecx
mov ecx, 0x848f3749
xor ecx, 0x7cbce824
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x943192c
add eax, ecx
mov ecx, 0x81e13cd8
xor ecx, 0x81e13cd9
add eax, ecx
mov ecx, 0x4933100c
xor ecx, 0x98998fd0
cmp eax, ecx
jb 0x140033e91
mov rdx, qword [rsp + 0x20]
mov esi, dword [0x1402a95c0]
xor esi, 0xeba7e82c
mov r11d, dword [0x1402a95c4]
mov eax, 0xd3bc3ba8
xor eax, 0x2c43c457
mov ecx, esi
xor ecx, eax
mov r9d, r11d
xor r9d, 0xffffffff
mov r8d, 0x14d0539
xor r8d, 0xf38af072
mov eax, 0x5ed33b61
xor eax, 0xa12cc49e
xor r8d, eax
mov r10d, 0x6bb65e8c
xor r10d, 0x9971abc7
mov eax, ecx
and eax, r10d
and esi, r8d
mov r10d, r9d
and r10d, 0xf2c7f54b
and r11d, r8d
or eax, esi
or r10d, r11d
xor eax, r10d
or ecx, r9d
xor ecx, 0xffffffff
or r8d, 0xf2c7f54b
and ecx, r8d
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x880d4280
mov ecx, eax
and ecx, r8d
mov r8d, eax
xor r8d, 0x880d4280
add eax, r8d
sub eax, ecx
sub eax, 0x6d872a5e
mov ecx, 0x2b6e5888
xor ecx, 0x42dac851
add eax, ecx
add eax, 0x6d872a5e
and eax, eax
mov ecx, 0xc6b04941
xor ecx, 0x394fb6be
xor eax, ecx
mov ecx, 0x9c3952d
and ecx, 0x9c3952d
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x5cbe52fc
xor ecx, 0xa788d03
mov qword [rdx], 0
cmp eax, ecx
je 0x140033d8c
jmp 0x140033e8b
add rsp, 0x30
pop rsi
ret
ret 0x798c