joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c5c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.14004f9f0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140106a74
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14004c5f0
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14004fb30

Function at 0x14004c620
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r15
sub rsp, 0x28
mov ebp, r9d
mov edi, edx
mov rsi, rcx
test r8, r8
je 0x14004c70a
movzx r15d, word [r8]
test r15w, r15w
je 0x14004c70a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x20], r14
cmovs edi, r13d
test rcx, rcx
je 0x14004c68d
cmp word [rcx], r13w
je 0x14004c68d
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], r13w
jne 0x14004c675
cmp ebx, edi
cmovg ebx, edi
sub edi, ebx
jns 0x14004c690
mov edi, r13d
jmp 0x14004c690
mov ebx, r13d
call fcn.14004fbb0
lea ecx, [rbx + rdi]
mov edx, ebp
mov r12d, eax
call fcn.14004f9f0
mov r14, rax
test r12d, r12d
je 0x14004c6b5
mov ecx, r12d
call fcn.14004fc20
mov rsi, rax
mov r12, qword [rsp + 0x58]
test ebx, ebx
je 0x14004c6d3
movsxd rcx, edi
movsxd r8, ebx
mov rdx, rsi
lea rcx, [r14 + rcx*2]
add r8, r8
call sub.msvcrt.dll_memmove
test edi, edi
je 0x14004c6e9
mov edx, edi
mov rdi, r14
movzx eax, r15w
mov ecx, edx
lea r14, [r14 + rdx*2]
rep stosw word [rdi], ax
movsxd rax, ebx
mov rbx, qword [rsp + 0x50]
mov word [r14 + rax*2], r13w
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
add rsp, 0x28
pop r15
pop rdi
pop rsi
pop rbp
ret
mov ecx, r9d
add rsp, 0x28
pop r15
pop rdi
pop rsi
pop rbp
jmp fcn.14004fb70

Function at 0x14004c880
Capabilities:
Get thread local storage value

Disassembly:
mov r10, rcx
test rcx, rcx
je 0x14004c8b1
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004c890
mov ecx, 1
mov r9d, r8d
sub ecx, edx
add eax, ecx
mov rcx, r10
mov r8d, eax
jmp fcn.14004c8c0
mov ecx, r8d
jmp fcn.14004fb70
Function at 0x14004c980
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x14004cae4
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x140122208]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x14004cab0
cmp word [r14 + 2], di
je 0x14004cab0
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x14004c9f0
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14004ca1d
cmp word [rbx], bp
je 0x14004ca1d
add rbx, 2
jmp 0x14004ca00
inc edi
cmp edi, r12d
je 0x14004ca32
cmp word [rbx], bp
je 0x14004ca3b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x14004ca00
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.14004fbb0
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x14004ca6a
mov ecx, r13d
call fcn.14004fcd0
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.14004f9f0
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x14004ca8e
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14004cabd
test ax, ax
jne 0x14004cad0
inc edi
cmp edi, edx
je 0x14004cad6
test ax, ax
je 0x14004ca3e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x14004cab0
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14004ca3e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.14004fb70

Function at 0x14004df94
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14017d198]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14004e015
mov r8, qword [0x14017d190]
mov rcx, qword [0x14017aba8]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x14017d198]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x14017d188]
jmp 0x14004e001
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14004dffe
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14004dfec
lea rcx, [0x14004def8]
mov rdx, rdi
call fcn.140106e24
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004e02c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x14004e056
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x14017d190]
test rcx, rcx
jne 0x14004e099
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x14017aba8]
movsxd r8, ebx
mov edx, 8
mov dword [0x14017d198], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x14017d198]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x14017d190]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x14017d190], rcx
mov ecx, dword [0x14017d198]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x14017d190]
mov rcx, qword [0x14017aba8]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x14017d198]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x14004e0ed
test rbp, rbp
je 0x14004e114
lea rcx, [0x14017d188]
mov edx, 0x28
call fcn.14004ec00
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x14004e114
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004f2c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x140176500], 0xffffffff
jne 0x14004f2ef
call fcn.14004f980
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x14004f270]
call fcn.140106e24
jmp 0x14004f320
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004f320
call fcn.140050010
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x14004f270]
call fcn.140106e24
add rsp, 0x28
ret

Function at 0x14004f330
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 0x10]
mov qword [rcx + rax*8 + 0x18], rdx
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
inc rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
add rsp, 0x38
ret
Function at 0x14004f390
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + rax*8 + 0x18]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14004f400
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rax*8 + 0x18]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rsp, 0x38
ret

Function at 0x14004f470
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rax*8 + 0x18]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
add rsp, 0x38
ret

Function at 0x14004f4e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x20]
add rcx, qword [rdx + rax*8 + 0x18]
mov rax, rcx
add rsp, 0x38
ret

Function at 0x14004f570
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret
Function at 0x14004f5a0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x14004f606
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x14017e0e0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x14004f631
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x14017e0e0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14004fc50
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14004f8e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x38
ret

Function at 0x14004f930
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14004f980
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x14017e0e0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140176500], eax
call fcn.140050010
add rsp, 0x28
ret
Function at 0x14004f9f0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x14004fa20
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x14004fa92
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x14017e0e0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x14004faf0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x14004faf0
cmp dword [rsp + 0x20], 0x100000
jge 0x14004fab3
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x14017e0e0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14004fb30
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14004fb70
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret
Function at 0x14004fbb0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x14004fc0b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x14004fc0b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x14004fc0d
xor eax, eax
add rsp, 0x38
ret

Function at 0x14004fc20
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x14004fcd0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx]
add rsp, 0x38
ret

Function at 0x140050010
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x340
xor edx, edx
mov rcx, qword [0x14017e0e0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rcx, qword [0x14017e0e0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x338], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x140176500]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140061600
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov r12, r9
mov ebp, r8d
mov r9d, r8d
lea r8, [rsp + 0x30]
mov rsi, rdx
mov rbx, rcx
call fcn.140064460
mov edi, eax
test eax, eax
je 0x140061674
movzx edx, word [rsi]
mov rcx, rbx
call fcn.14005c060
test rax, rax
je 0x14006164d
mov r9, qword [rax + 0x20]
jmp 0x140061654
lea r9, str.unknown_tagname
lea r8, str.TIFFFetchStripThing
mov edx, edi
mov rcx, rbx
mov dword [rsp + 0x20], 0
call fcn.140064bb0
xor eax, eax
jmp 0x14006176e
cmp qword [rsi + 8], rbp
jae 0x140061760
movzx edx, word [rsi]
mov rcx, rbx
mov qword [rsp + 0x60], r14
call fcn.14005c060
lea rcx, str.LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT
mov r14, rax
call qword [sym.imp.msvcrt.dll_getenv]
mov edi, 0xf4240
test rax, rax
je 0x1400616b3
mov rcx, rax
call qword [sym.imp.msvcrt.dll_atoi]
mov edi, eax
test r14, r14
je 0x1400616be
mov r9, qword [r14 + 0x20]
jmp 0x1400616c5
lea r9, str.unknown_tagname
mov r14, qword [rsp + 0x60]
mov rcx, qword [rbx + 0x438]
lea rdx, str.TIFFFetchStripThing
cmp ebp, edi
jbe 0x1400616ea
lea r8, str.Incorrect_count_for___s_
call fcn.14005be80
jmp 0x1400616f6
lea r8, str.Incorrect_count_for___s___tag_ignored
call fcn.14005b5a0
cmp ebp, edi
jbe 0x140061708
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x14006176e
lea r9, str.for_strip_array
mov r8d, 8
mov rdx, rbp
mov rcx, rbx
call fcn.14005dcb0
mov rdi, rax
test rax, rax
je 0x1400616fa
mov r8d, dword [rsi + 8]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
shl r8, 3
call fcn.1400504e0
mov eax, dword [rsi + 8]
xor edx, edx
sub ebp, eax
lea rcx, [rdi + rax*8]
mov r8d, ebp
shl r8, 3
call fcn.1400504f0
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
jmp 0x140061765
mov rdi, qword [rsp + 0x30]
mov qword [r12], rdi
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret

Function at 0x14006cb80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
lea rax, [rcx + 0x430]
mov rbx, rcx
mov qword [rcx + 0x10], rax
lea rcx, [0x14006c920]
mov dword [rbx + 0x55c], 0x64
mov qword [rax], rcx
lea rcx, str.LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER
call qword [sym.imp.msvcrt.dll_getenv]
test rax, rax
je 0x14006cbcd
mov rcx, rax
call qword [sym.imp.msvcrt.dll_atoi]
mov dword [rbx + 0x55c], eax
lea rcx, [rbx + 0x330]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
test eax, eax
je 0x14006cbe8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x30]
call fcn.14009ea60
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14009d5ac
Capabilities:
Compress data via zlib inflate or deflate
Resolve function by parsing pe exports

Disassembly:
xor r9d, r9d
cmp byte [rcx + 0x290], r9b
je 0x14009d5ef
cmp dword [rcx + 0x180], r9d
jbe 0x14009d5ef
mov rax, qword [rcx + 0x178]
mov r8b, byte [rax]
and r8b, 0xf0
cmp r8b, 0x70
jbe 0x14009d5e8
lea rax, str.invalid_window_size__libpng_
mov qword [rcx + 0x198], rax
lea eax, [r9 - 3]
ret
mov byte [rcx + 0x290], r9b
add rcx, 0x178
jmp fcn.14010aa20
Function at 0x14009ea60
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x14009ea93
call fcn.14009ed20
cmp byte [rbx + 0x58], 0
je 0x14009ea8c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x14009eb25
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x14009eb0c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14009eabe
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x14009eb04
cmp eax, 2
je 0x14009eb0c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009eab0
dec eax
test eax, 0xfffffffd
jne 0x14009eab0
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x14009eab0
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x14009eab0
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x14009ebe0
cmp eax, 0xcc
je 0x14009eb47
mov rax, qword [rbx]
mov dword [rax + 0x28], reloc.WS2_32.dll_setsockopt
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14009ebe0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14009ec0e
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x14009ecbd
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x14009ec8d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009ec5f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x228]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x14009ece5
cmp eax, dword [rbx + 0x78]
jb 0x14009ec40
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], bpl
jne 0x14009ec30
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x14009ecd0