joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140878dc0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140878f47
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140878df1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140878dd7
add dl, dl
jne 0x140878dfe
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140878e5e
xor eax, eax
add dl, dl
jne 0x140878e0d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140878f15
add dl, dl
jne 0x140878e1e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140878e2b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140878e38
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140878e45
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140878e52
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140878de6
mov eax, 1
add dl, dl
jne 0x140878e6e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140878e7b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140878e63
sub eax, ebx
mov ebx, 1
jne 0x140878eb4
mov ecx, 1
add dl, dl
jne 0x140878e96
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140878ea3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140878e8b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140878de6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140878ed0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140878edd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140878ec5
cmp eax, 0x7d00
jae 0x140878f03
cmp eax, 0x500
jb 0x140878efe
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140878de6
cmp eax, 0x7f
ja 0x140878f06
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140878de6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140878f3a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140878de6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000e6f0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000e700]
mov dword [rax], 1
mov rax, qword [0x14000e710]
mov dword [rax], 1
mov rax, qword [0x14000e6e0]
mov dword [rax], 1
mov rax, qword [0x14000e5a0]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14000e6d0]
mov dword [0x140011020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14000e690]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14000e670]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14000e550]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001840
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x14000147f
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14000ce80]
mov dword [rax], 1
mov rax, qword [0x14000ce90]
mov dword [rax], 1
mov rax, qword [0x14000cea0]
mov dword [rax], 1
mov rax, qword [0x14000ce40]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d0
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400014fc
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001522
cmp eax, 0x20b
je 0x140001549
jmp 0x140001578
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001535
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001564
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x14000258a
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov rsi, rcx
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.ucrtbase.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp 0x14000a158
jmp qword [sym.imp.ucrtbase.dll_fflush]

Function at 0x1400025c9
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rdx
mov rsi, rdx
call sub.ucrtbase.dll_strlen
mov rcx, rsi
mov r9, rbx
mov edx, 1
mov r8, rax
call sub.ucrtbase.dll_fwrite
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp 0x14000a158

Function at 0x140002954
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rsi, [0x14000c0b2]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
mov ecx, 2
call rbx
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.1400025c9
test rbp, rbp
je 0x140002990
lea rsi, [rdi + 8]
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400025c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x1400029c5
mov ecx, 2
call rbx
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.1400025c9
mov ecx, 2
call rbx
lea rdx, [0x14000c1ba]
mov rcx, rax
call fcn.1400025c9
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
Function at 0x1400029e6
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x120
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rcx
mov rdi, rdx
call r12
test rax, rax
jne 0x140002b0d
lea r13, [rsp + 0x26]
mov edx, 0xfa
mov ebx, 1
mov rcx, r13
call fcn.1400017d0
mov byte [rsp + 0x26], 0x5f
mov al, byte [rdi + rbx - 1]
test al, al
je 0x140002a45
mov byte [r13 + rbx], al
inc rbx
cmp rbx, 0xf5
jne 0x140002a2c
mov byte [rsp + rbx + 0x26], 0x40
mov esi, 0x63
mov r14d, 0xa
lea rcx, [rsi - 0x63]
cmp rsi, 0xc6
jbe 0x140002a68
add rbx, 3
jmp 0x140002a7b
lea rax, [rsi - 0x5a]
cmp rax, 0x12
jbe 0x140002a78
add rbx, 2
jmp 0x140002a7b
inc rbx
mov byte [rsp + rbx + 0x27], 0
mov rax, rcx
xor edx, edx
div r14
mov rax, rcx
add edx, 0x30
mov byte [r13 + rbx], dl
cqo
dec rbx
idiv r14
mov rcx, rax
test rax, rax
jne 0x140002a80
mov rdx, r13
mov rcx, rbp
call r12
test rax, rax
jne 0x140002b0d
add rsi, 4
cmp rsi, 0x12f
jne 0x140002a55
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.1400025c9
mov ecx, 2
call rbx
mov rdx, rdi
mov rcx, rax
call fcn.1400025c9
mov ecx, 2
call rbx
lea rdx, [0x14000c1ba]
mov rcx, rax
call fcn.1400025c9
mov ecx, 1
call sub.ucrtbase.dll_exit
add rsp, 0x120
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140002b48
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, 0x20
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
dec rdx
mov edx, 0x10
mov rdi, rcx
cmove rax, rdx
xor esi, esi
mov qword [rsp + 0x28], rax
mov ecx, 1
call rbp
mov rbx, qword [rdi + rsi]
mov r12, qword [rdi + rsi + 8]
lea r8, [0x14000c0b2]
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x140002ba0
lea r8, [r12 + 8]
mov rcx, qword [rsp + 0x20]
lea rdx, [0x14000c1cf]
call fcn.140002b1f
movsxd rcx, eax
mov r13, rcx
cmp rbx, rcx
jle 0x140002c3b
mov r14d, 0x80000000
test ecx, ecx
jns 0x140002bf5
lea rdx, [rbx - 1]
call fcn.140002093
jmp 0x140002c3b
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call sub.ucrtbase.dll_fputc
test eax, eax
jne 0x140002c3b
cmp r13d, 0x7fffffff
je 0x140002c1c
inc r13d
mov eax, r13d
cmp rbx, rax
jle 0x140002c3b
movsxd r15, r13d
cmp byte [r12 + r15 + 8], 0
je 0x140002bd1
mov rcx, qword [rsp + 0x20]
lea r8, [r12 + r15 + 8]
lea rdx, [0x14000c1cf]
call fcn.140002b1f
test eax, eax
jg 0x140002c23
jmp 0x140002c3b
call fcn.140001c0e
jmp 0x140002c3b
cdqe
mov ecx, 0xffffffff
add rax, r15
lea rdx, [rax + r14]
cmp rcx, rdx
jb 0x140002c1c
mov r13d, eax
jmp 0x140002bf0
add rsi, 0x10
cmp byte [0x140011300], 0
jne 0x140002c93
cmp qword [rsp + 0x28], rsi
jne 0x140002b7a
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14000c1ba]
mov r9, rax
call sub.ucrtbase.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x14000a158
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002fe0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, [0x14000c8a0]
mov rcx, rax
call sub.ucrtbase.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.140009d40
call sub.ucrtbase.dll_abort
nop

Function at 0x140003cb2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140011428]
test eax, eax
je 0x140003d4a
lea rax, [0x140011400]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140011430]
mov qword [rbp - 8], rax
jmp 0x140003d2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140003d22
cmp qword [rbp - 0x10], 0
je 0x140003d22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140003ce8
lea rax, [0x140011400]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140003d4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140003e50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140003e78
mov eax, 0
jmp 0x140003ec6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140003ea1
mov eax, 0
jmp 0x140003ec6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140003ec1
mov eax, 0
jmp 0x140003ec6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140003ecc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140003f4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140003f41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140003f41
mov rax, qword [rbp - 8]
jmp 0x140003f5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140003f14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800011c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
push rax
mov eax, dword [0x18008d8e8]
lea r8d, [rax + 1]
imul r8d, eax
test r8b, 1
sete al
cmp dword [0x18008d8ec], 0xa
setge r9b
setl r10b
xor r10b, al
or r9b, r8b
not r9b
or r9b, r10b
test r9b, 1
mov eax, 0xbe86441d
mov r9d, 0xa2fac182
cmove eax, r9d
mov r8d, 0xd719bb34
cmove r8d, r9d
mov r9d, 0x35db05ae
mov r11d, 0x8e574a3f
cmove r9d, r11d
mov r10d, 0x1c457eec
cmove r10d, r11d
mov ebx, 0x4c4a16a8
mov r11d, 0xaad1643d
mov esi, 0x54099c1b
jmp 0x180001250
mov ebx, 0x1c457eec
nop word cs:[rax + rax]
mov ebp, ebx
cmp ebx, 0xd719bb33
jle 0x180001290
cmp ebp, 0x35db05ad
jg 0x1800012c0
cmp ebp, 0xd719bb34
je 0x18000131b
mov ebx, r8d
cmp ebp, 0xeba3e8d6
je 0x180001250
mov ebx, ebp
cmp ebp, 0x1c457eec
jne 0x180001250
cmp byte [rcx], 0
setne byte [rsp + 3]
mov ebx, r9d
jmp 0x180001250
cmp ebp, 0xaad1643c
jg 0x1800012f9
cmp ebp, 0x8e574a3f
je 0x18000123e
cmp ebp, 0x96c6f234
je 0x18000132e
mov ebx, ebp
cmp ebp, 0xa2fac182
jne 0x180001250
mov ebx, 0xd719bb34
jmp 0x180001250
cmp ebp, 0x35db05ae
je 0x18000133e
mov ebx, r10d
cmp ebp, 0x54099c1b
je 0x180001250
mov ebx, ebp
cmp ebp, 0x4c4a16a8
jne 0x180001250
movzx ebx, byte [rcx]
cmp bl, byte [rdx]
mov ebx, 0xb32204a6
cmove ebx, esi
xor edi, edi
jmp 0x180001250
cmp ebp, 0xaad1643d
je 0x18000134d
cmp ebp, 0xb32204a6
jne 0x180001357
test dil, 1
mov ebx, 0xeba3e8d6
cmovne ebx, r11d
jmp 0x180001250
movzx ebx, byte [rcx]
movzx ebp, byte [rdx]
sub ebx, ebp
mov dword [rsp + 4], ebx
mov ebx, eax
jmp 0x180001250
inc rcx
inc rdx
mov ebx, 0x4c4a16a8
jmp 0x180001250
mov ebx, 0xb32204a6
movzx edi, byte [rsp + 3]
jmp 0x180001250
mov ebx, 0x96c6f234
jmp 0x180001250
mov ebx, ebp
cmp ebp, 0xbe86441d
jne 0x180001250
mov eax, dword [rsp + 4]
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1800258f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180025918
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180025918
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180029d58
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180029d88
xor eax, eax
jmp 0x180029e4b
mov rbp, rbx
cmp word [rax], si
je 0x180029dad
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180029d94
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180029d90
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180029c78
movsxd r14, eax
test eax, eax
jne 0x180029deb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180029d81
mov rcx, r14
call fcn.18002a1a4
mov rdi, rax
test rax, rax
jne 0x180029e04
xor ecx, ecx
call fcn.180027874
jmp 0x180029de0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180029c78
test eax, eax
jne 0x180029e35
mov rcx, rdi
call fcn.180027874
jmp 0x180029e3f
xor ecx, ecx
call fcn.180027874
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14003e7d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x828
mov ecx, dword [0x14010e018]
test ecx, ecx
je 0x14003e803
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14003e81c
cmp qword [rax + 8], 0
je 0x14003e81c
add rax, 0x10
jmp 0x14003ea17
lea rcx, section..data
call fcn.1400e0490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14003e7f3
mov ecx, dword [0x14010e018]
test ecx, ecx
je 0x14003e9f8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14003ea15
mov rsi, rax
test rax, rax
jne 0x14003e88c
movzx eax, byte [0x141936118]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dee70
test rax, rax
je 0x14003ea3a
mov rsi, rax
lea rax, section..data
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14010e018]
test ecx, ecx
je 0x14003ea3c
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [0x141936030]
cmp rax, 3
jne 0x14003ea24
mov rdi, qword [0x141936038]
lock inc qword [rdi]
jle 0x14003ea3a
mov eax, 0x60
movups xmm0, xmmword [0x1418d2668]
movups xmm1, xmmword [0x1418d2658]
nop word cs:[rax + rax]
movups xmmword [rsp + rax - 0x30], xmm0
movups xmmword [rsp + rax - 0x40], xmm1
movups xmmword [rsp + rax - 0x20], xmm1
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax], xmm1
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax + 0x20], xmm1
movups xmmword [rsp + rax + 0x30], xmm0
sub rax, 0xffffffffffffff80
cmp rax, 0x860
jne 0x14003e8d0
movzx eax, byte [0x141936118]
mov edx, 0x980
xor ecx, ecx
call fcn.1400dee70
test rax, rax
je 0x14003ea3a
mov r14, rax
and r14, 0xffffffffffffff80
lea rbx, [r14 + 0x80]
mov qword [r14 + 0x78], rax
mov qword [r14 + 0x80], 0
mov qword [r14 + 0x88], rdi
lea rcx, [r14 + 0x90]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
call sub.msvcrt.dll_memcpy
xorps xmm0, xmm0
movaps xmmword [r14 + 0x890], xmm0
mov qword [r14 + 0x8a0], 1
mov qword [r14 + 0x8a8], 0
mov qword [r14 + 0x900], 0
mov rcx, qword [0x141936038]
mov rax, qword [rcx + 0x200]
nop word cs:[rax + rax]
mov qword [rbx], rax
lock cmpxchg qword [rcx + 0x200], rbx
jne 0x14003e9a0
lea rax, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rbx
je 0x14003ea17
mov rdx, qword [rcx + 0x820]
lea r8, [rdx - 1]
mov qword [rcx + 0x820], r8
cmp qword [rcx + 0x818], 0
jne 0x14003ea17
cmp rdx, 1
jne 0x14003ea17
mov rsi, rax
call fcn.14003dd00
mov rax, rsi
jmp 0x14003ea17
lea rcx, section..data
call fcn.1400e0490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14003e83b
xor eax, eax
add rsp, 0x828
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14003e130
mov rdi, qword [0x141936038]
lock inc qword [rdi]
jg 0x14003e8ae
ud2
lea rcx, section..data
call fcn.1400e0490
mov ecx, eax
jmp 0x14003e884
Function at 0x14004bd70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x14010e168]
test ecx, ecx
je 0x14004bda0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14004bdb9
cmp qword [rax + 8], 0
je 0x14004bdb9
add rax, 0x10
jmp 0x14004be75
lea rcx, [0x14010e150]
call fcn.1400e0490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14004bd90
mov ecx, dword [0x14010e168]
test ecx, ecx
je 0x14004be56
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14004be73
test rax, rax
jne 0x14004be25
movzx eax, byte [0x141936118]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dee70
test rax, rax
je 0x14004be92
lea rcx, [0x14010e150]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14010e168]
test ecx, ecx
je 0x14004be7c
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
test rsi, rsi
je 0x14004be3f
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x14004be41
mov rcx, qword [rsi + 8]
jmp 0x14004be41
xor ecx, ecx
lea rdx, [rax + 0x10]
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
mov rax, rdx
jmp 0x14004be75
lea rcx, [0x14010e150]
call fcn.1400e0490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14004bdd8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14010e150]
mov rdi, rax
call fcn.1400e0490
mov ecx, eax
mov rax, rdi
jmp 0x14004be17
ud2
Function at 0x14009fb40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x14010e098]
test ecx, ecx
je 0x14009fb70
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14009fb89
cmp qword [rax + 8], 0
je 0x14009fb89
add rax, 0x10
jmp 0x14009fc52
lea rcx, [0x14010e080]
call fcn.1400e0490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14009fb60
mov ecx, dword [0x14010e098]
test ecx, ecx
je 0x14009fc33
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14009fc50
test rax, rax
jne 0x14009fbf5
movzx eax, byte [0x141936118]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dee70
test rax, rax
je 0x14009fc72
lea rcx, [0x14010e080]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14010e098]
test ecx, ecx
je 0x14009fc59
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
test rsi, rsi
je 0x14009fc0b
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x14009fc1e
mov ecx, 1
lock xadd qword [0x14010e0a0], rcx
test rcx, rcx
je 0x14009fc72
lea rdx, [rax + 0x10]
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
mov rax, rdx
jmp 0x14009fc52
lea rcx, [0x14010e080]
call fcn.1400e0490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14009fba8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14010e080]
mov rdi, rax
call fcn.1400e0490
mov ecx, eax
mov rax, rdi
jmp 0x14009fbe7
ud2