joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014b58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140014b7a
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x140014ba9
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x140014b8b
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140014be1
cmp qword [rcx + rdx*8], r8
jne 0x140014bd6
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140014bda
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140014bee
cmp qword [rcx + rdx*8], r8
jne 0x140014bee
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.140014c08
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140021670
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400219dc
push rbx
sub rsp, 0x20
mov ecx, dword [0x1403b92f8]
xor ebx, ebx
cmp byte [0x1403b92fc], bl
je 0x1400219f9
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400219ff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140021a07
mov ebx, dword [rax + 0x10]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400216a8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 4], 0
mov rdi, rcx
mov ecx, dword [rcx]
je 0x1400216c5
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400216cb
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140021715
lea edx, [rax + 1]
lea ecx, [rax + 0x18]
call fcn.140070918
mov rbx, rax
test rax, rax
je 0x140021723
and qword [rax], 0
mov rdx, rax
and qword [rax + 8], 0
and dword [rax + 0x10], 0
cmp byte [rdi + 4], 0
mov ecx, dword [rdi]
je 0x140021706
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x14002170c
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021715
lea ecx, [rax + 7]
int 0x29
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1401ee6e8
int3
Function at 0x14002187c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
and dword [rsp + 0x50], 0
mov rsi, rcx
cmp byte [0x1403b92fc], 0
mov ecx, dword [0x1403b92f8]
je 0x1400218b0
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400218b6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xorps xmm0, xmm0
test rax, rax
jne 0x1400218ce
lea edi, [rax + 1]
lea rax, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
jmp 0x1400218f9
mov r8, qword [rax + 8]
mov edi, 2
mov rdx, qword [rax]
movdqu xmmword [rsp + 0x20], xmm0
test r8, r8
je 0x1400218ea
lock inc dword [r8 + 8]
lea rcx, [rsp + 0x20]
call fcn.14025dfc0
lea rax, [rsp + 0x20]
and qword [rsi], 0
and qword [rsi + 8], 0
mov r8, qword [rax + 8]
test r8, r8
je 0x140021910
lock inc dword [r8 + 8]
mov rdx, qword [rax]
mov rcx, rsi
call fcn.14025dfc0
or r14d, 0xffffffff
test dil, 2
je 0x140021972
mov rcx, qword [rsp + 0x28]
and edi, 0xfffffffd
test rcx, rcx
je 0x140021972
mov eax, r14d
lock xadd dword [rcx + 8], eax
add eax, r14d
jne 0x140021972
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax]
call qword [case.0x14002a211.0]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140021972
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002a211.0]
test dil, 1
je 0x1400219c2
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400219c2
mov eax, r14d
lock xadd dword [rcx + 8], eax
add eax, r14d
jne 0x1400219c2
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax]
call qword [case.0x14002a211.0]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1400219c2
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002a211.0]
mov rbx, qword [rsp + 0x58]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400219dc
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400219dc
push rbx
sub rsp, 0x20
mov ecx, dword [0x1403b92f8]
xor ebx, ebx
cmp byte [0x1403b92fc], bl
je 0x1400219f9
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400219ff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140021a07
mov ebx, dword [rax + 0x10]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140021ac4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rax - 0x18], ebx
call fcn.14002187c
mov dword [rsp + 0x20], 1
cmp qword [rsi], rbx
jne 0x140021b54
mov ecx, dword [0x1403b92f8]
cmp byte [0x1403b92fc], bl
je 0x140021b13
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140021b19
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140021b80
mov edx, 1
mov rcx, rax
call fcn.1400483a8
xor edx, edx
mov ecx, dword [0x1403b92f8]
cmp byte [0x1403b92fc], bl
je 0x140021b43
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140021b49
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140021b80
lea ecx, [rax + 7]
int 0x29
jmp 0x140021b80
lea rcx, [0x1403b92f8]
call fcn.1400216a8
mov rbx, rax
mov rdx, rsi
mov rcx, rax
call fcn.1400c9bec
mov rcx, qword [rsi]
mov rdx, qword [rcx]
mov rax, qword [rdx]
call qword [case.0x14002a211.0]
mov dword [rbx + 0x10], eax
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140023b18
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
cmp byte [rcx + 4], 0
mov ecx, dword [rcx]
je 0x140023b3e
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140023b44
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140023ba5
lea edx, [rax + 1]
lea ecx, [rax + 0x58]
call fcn.140070918
mov rbx, rax
test rax, rax
jne 0x140023b65
call fcn.1401ee6e8
int3
mov qword [rsp + 0x40], rbx
xor edx, edx
lea r8d, [rdx + 0x58]
mov rcx, rbx
call fcn.1402108c0
mov rcx, rbx
call fcn.140023ffc
mov rbx, rax
mov rdx, rax
mov ecx, dword [rdi]
cmp byte [rdi + 4], 0
je 0x140023b96
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140023b9c
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140023ba5
lea ecx, [rax + 7]
int 0x29
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400242a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1403bb59c], 0
mov ecx, dword [0x1403bb598]
je 0x1400242bc
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400242c2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14002435e
cmp qword [rax + 0x20], 0
je 0x14002435e
mov edx, 0xae
lea r9, str.Ending_current_correlation.
mov ecx, 0x71e400
lea r8d, [rdx - 0x4a]
call fcn.140026554
mov rcx, rbx
call fcn.1400244d0
cmp qword [rbx + 0x20], 0
jne 0x140024368
cmp byte [0x1403bb59c], 0
mov ecx, dword [0x1403bb598]
je 0x140024319
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14002431f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140024368
mov edx, 1
mov rcx, rax
call fcn.140024120
mov ecx, dword [0x1403bb598]
xor edx, edx
cmp byte [0x1403bb59c], dl
je 0x140024356
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
test eax, eax
jne 0x140024368
lea ecx, [rax + 7]
int 0x29
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140024347
mov ecx, 0x71e3e3
call fcn.1401e41d8
add rsp, 0x20
pop rbx
ret

Function at 0x140024370
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp byte [0x1403bb59c], bl
mov ecx, dword [0x1403bb598]
je 0x140024395
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14002439b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400243f9
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x1400243f9
mov rdx, qword [rax]
mov r8, qword [rax + 0x18]
mov rax, rbx
test rdx, rdx
je 0x1400243c3
mov rdx, qword [rdx]
test rdx, rdx
je 0x1400243c3
mov rax, qword [rdx]
lea rdx, [r8 - 1]
add rdx, rcx
test rax, rax
je 0x1400243e2
mov rax, qword [rax]
test rax, rax
je 0x1400243e2
mov rax, qword [rax]
test rax, rax
je 0x1400243e2
mov rbx, qword [rax]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
dec rcx
and rcx, rdx
mov rcx, qword [rax + rcx*8]
movups xmm0, xmmword [rcx]
jmp 0x14002440a
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
movdqu xmmword [rdi], xmm0
add rsp, 0x30
pop rdi
ret

Function at 0x14002441c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp byte [0x1403bb59c], dil
mov ecx, dword [0x1403bb598]
je 0x140024442
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140024448
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140024460
cmp qword [rax + 0x20], rdi
je 0x140024460
mov rdx, rbx
mov rcx, rax
call fcn.140024480
jmp 0x14002446f
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140026a84
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
cmp byte [rcx + 4], 0
mov ecx, dword [rcx]
je 0x140026aaa
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140026ab0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140026b30
lea edx, [rax + 1]
lea ecx, [rax + 0x28]
call fcn.140070918
mov rbx, rax
test rax, rax
jne 0x140026ad1
call fcn.1401ee6e8
int3
mov qword [rsp + 0x40], rbx
and qword [rax], 0
and qword [rax + 8], 0
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
mov r8b, 1
mov edx, 0x10
lea ecx, [rdx - 0xf]
call fcn.14000c5c0
mov qword [rbx], rax
xorps xmm0, xmm0
movdqu xmmword [rax], xmm0
mov rax, qword [rbx]
mov qword [rax], rbx
mov rdx, rbx
mov ecx, dword [rdi]
cmp byte [rdi + 4], 0
je 0x140026b21
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026b27
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026b30
lea ecx, [rax + 7]
int 0x29
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140026b40
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x1403bc778]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x1403bc778]
mov edx, edi
cmp byte [0x1403bc77c], 0
je 0x140026b85
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026b8b
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
test al, al
jne 0x140026b9b
mov ecx, 7
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
call fcn.140025780
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140026be6
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x140026bd5
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026bdb
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026bae
lea ecx, [rax + 7]
int 0x29
jmp 0x140026bae
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140026bf4
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x1403bc778]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x1403bc778]
mov edx, edi
cmp byte [0x1403bc77c], 0
je 0x140026c39
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026c3f
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
test al, al
jne 0x140026c4f
mov ecx, 7
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
mov rdx, qword [rsi + 8]
call fcn.140025ca0
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140026c9e
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x140026c8d
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026c93
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026c66
lea ecx, [rax + 7]
int 0x29
jmp 0x140026c66
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140026cc4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rdi, rcx
mov ecx, dword [0x1403bc778]
cmp byte [0x1403bc77c], 0
je 0x140026cf6
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140026cfc
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140026e7a
mov ecx, dword [0x1403bc768]
cmp byte [0x1403bc76c], al
je 0x140026d1b
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140026d21
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140026db6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov r9, qword [rdi + 0x18]
mov rax, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
mov r9, qword [r9]
mov r8b, byte [rax]
mov edx, dword [rdx]
mov ecx, dword [rcx]
call fcn.140027a44
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140026e7a
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
add eax, edi
jne 0x140026e7a
mov rbx, qword [rsp + 0x50]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14002a211.0]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x140026e7a
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002a211.0]
jmp 0x140026e7a
lea rax, [0x1403bc768]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x40], 0
mov esi, 1
mov ecx, dword [0x1403bc768]
mov edx, esi
cmp byte [0x1403bc76c], 0
je 0x140026df7
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
test eax, eax
setne al
mov ebx, 7
test al, al
jne 0x140026dff
mov ecx, ebx
int 0x29
jmp 0x140026dff
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140026de3
lock xadd dword [rsp + 0x40], esi
mov rax, qword [rdi + 0x18]
mov r9, qword [rdi + 0x10]
mov r8, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, qword [rdi + 0x20]
add rcx, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9b, byte [r9]
mov r8d, dword [r8]
mov edx, dword [rdx]
call fcn.140025660
mov rcx, qword [rdi + 0x20]
call fcn.140027c64
nop
nop dword [rax + rax]
or edi, 0xffffffff
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140026e7a
mov eax, edi
lock xadd dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x38]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x140026e69
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026e6f
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026e43
mov rcx, rbx
int 0x29
jmp 0x140026e43
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140026e8c
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x1403bc778]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x1403bc778]
mov edx, edi
cmp byte [0x1403bc77c], 0
je 0x140026ed1
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026ed7
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
test al, al
jne 0x140026ee7
mov ecx, 7
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
call fcn.1400254b0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140026f31
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x140026f20
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026f26
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026ef9
lea ecx, [rax + 7]
int 0x29
jmp 0x140026ef9
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140026f40
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x1403bc778]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x1403bc778]
mov edx, edi
cmp byte [0x1403bc77c], 0
je 0x140026f85
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026f8b
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
test al, al
jne 0x140026f9b
mov ecx, 7
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
mov rdx, qword [rsi + 8]
call fcn.140025be0
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140026fea
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x140026fd9
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140026fdf
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140026fb2
lea ecx, [rax + 7]
int 0x29
jmp 0x140026fb2
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140026ff8
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, [0x1403bc778]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x30], 0
mov edi, 1
mov ecx, dword [0x1403bc778]
mov edx, edi
cmp byte [0x1403bc77c], 0
je 0x14002703d
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140027043
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
test al, al
jne 0x140027053
mov ecx, 7
int 0x29
lock xadd dword [rsp + 0x30], edi
mov rcx, qword [rsi]
add rcx, 8
mov rdx, qword [rsi + 8]
call fcn.140025810
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400270a2
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], dl
mov ecx, dword [rcx]
je 0x140027091
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140027097
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14002706a
lea ecx, [rax + 7]
int 0x29
jmp 0x14002706a
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400270b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r14, rcx
xor ebx, ebx
mov ecx, dword [0x1403bc778]
cmp byte [0x1403bc77c], bl
je 0x1400270e4
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400270ea
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400271c1
mov ecx, dword [0x1403bc768]
cmp byte [0x1403bc76c], bl
je 0x140027109
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14002710f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14002711e
mov ebx, 1
jmp 0x1400271c1
lea rax, [0x1403bc778]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov esi, 1
mov ecx, dword [0x1403bc778]
mov edx, esi
cmp byte [0x1403bc77c], bl
je 0x14002714b
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140027151
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
test al, al
jne 0x140027161
mov ecx, 7
int 0x29
lock xadd dword [rsp + 0x30], esi
mov rax, qword [r14]
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
add rcx, 8
mov r8b, byte [r8]
mov edx, dword [rdx]
call fcn.1400259b0
mov sil, al
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400271be
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], bl
mov ecx, dword [rcx]
je 0x1400271ad
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x1400271b3
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140027186
lea ecx, [rax + 7]
int 0x29
jmp 0x140027186
mov bl, sil
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret
Function at 0x1400271d4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r14, rcx
xor ebx, ebx
mov ecx, dword [0x1403bc778]
cmp byte [0x1403bc77c], bl
je 0x140027208
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14002720e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400272ec
mov ecx, dword [0x1403bc768]
cmp byte [0x1403bc76c], bl
je 0x14002722d
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140027233
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140027242
mov ebx, 1
jmp 0x1400272ec
lea rax, [0x1403bc778]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov esi, 1
mov ecx, dword [0x1403bc778]
mov edx, esi
cmp byte [0x1403bc77c], bl
je 0x14002726f
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140027275
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
test al, al
jne 0x140027285
mov ecx, 7
int 0x29
lock xadd dword [rsp + 0x30], esi
mov rax, qword [r14]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
add rcx, 8
mov r9b, byte [r9]
mov r8d, dword [r8]
mov edx, dword [rdx]
call fcn.140025a70
mov sil, al
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400272e9
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], bl
mov ecx, dword [rcx]
je 0x1400272d8
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x1400272de
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400272b1
lea ecx, [rax + 7]
int 0x29
jmp 0x1400272b1
mov bl, sil
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret