joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f690
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx]
mov rbx, rcx
mov rsi, rdx
test rdx, rdx
je 0x43f7c8
cmp eax, 1
je 0x43f6e9
call dbg.enterOnceObject
lea r13, [rax + 8]
mov r12, rax
mov rcx, r13
call dbg.pthread_mutex_lock
mov edi, dword [rbx]
test edi, edi
je 0x43f700
cmp edi, 1
jne 0x43f7a0
mov rcx, r13
call dbg.pthread_mutex_unlock
test r12, r12
je 0x43f6e9
mov rcx, r12
call sym.leaveOnceObject.part.0
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rax, [dbg._pthread_once_cleanup]
cmp dword [0x00540e60], 1
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
je 0x43f71f
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rdi
test rax, rax
je 0x43f808
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
mfence
cmp dword [0x00540e60], 1
je 0x43f751
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call rdi
test rax, rax
je 0x43f7f0
lea rdx, [rsp + 0x20]
mov qword [rax + 0x18], rdx
mfence
call rsi
cmp dword [0x00540e60], 1
je 0x43f77e
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call rdi
test rax, rax
je 0x43f7e0
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov dword [rbx], 1
jmp 0x43f6d4
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r9d, edi
mov r8, rbx
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sym.fprintf
jmp 0x43f6d4
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x43f78b
jmp sym.pthread_once.cold
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x43f762
jmp 0x4f89fe
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x43f737
jmp 0x4f89f4
mov rax, qword [class.std::exception]
ud2
lea rax, [rsp + 0x20]
mov qword [0], rax
ud2

Function at 0x43faa0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x00540e60], 1
mov r12d, eax
je 0x43fac5
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x43fb20
lea r13, [rbx + 0x68]
xor r14d, r14d
mov rcx, r13
call dbg.pthread_spin_lock
cmp dword [rbx + 0x48], esi
jbe 0x43faff
mov rax, qword [rbx + 0x58]
cmp byte [rax + rsi], 0
je 0x43faff
mov rax, qword [rbx + 0x50]
mov r14, qword [rax + rsi*8]
mov rcx, r13
call dbg.pthread_spin_unlock
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r14
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x43fad9
Function at 0x43fb30
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x00540e60], 1
mov r12d, eax
je 0x43fb5c
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x43fc38
lea r13, [rbx + 0x68]
mov rcx, r13
call dbg.pthread_spin_lock
cmp dword [rbx + 0x48], esi
jbe 0x43fbc0
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], rbp
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call dbg.pthread_spin_unlock
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sym.realloc
mov rdi, rax
test rax, rax
je 0x43fc45
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sym.realloc
mov r14, rax
test rax, rax
je 0x43fc45
mov eax, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
sub r8d, eax
lea rcx, [rdi + rax*8]
shl r8, 3
call sym.memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sym.memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x43fb89
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x43fb74
mov rcx, r13
call dbg.pthread_spin_unlock
mov eax, 0xc
jmp 0x43fba8

Function at 0x43fc80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x00540e60], 1
je 0x43fc92
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x43fcb8
mov r8, qword [rax + 0x1d8]
mov rax, r8
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
xor r8d, r8d
test rax, rax
jne 0x43fca3
mov rax, r8
add rsp, 0x28
ret

Function at 0x43fcd0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x00540e60], 1
je 0x43fce2
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x43fd00
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x43fcf3
add rsp, 0x28
ret

Function at 0x43fd70
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x00540e60], 1
je 0x43fd82
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x43fda0
add rax, 0x18
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x43fd93
jmp 0x43fd97
Function at 0x43fec0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00540e68]
test eax, eax
jne 0x43fed8
xor eax, eax
add rsp, 0x28
ret
cmp dword [0x00540e60], 1
je 0x43fee6
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x43ff10
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x43fece
test byte [rax + 0x40], 3
je 0x43fece
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x43fed0
call sym.__pthread_self_lite.part.0
test rax, rax
je 0x43fece
jmp 0x43fef7

Function at 0x43ff20
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x00540e60], 1
mov ebx, ecx
je 0x43ff35
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x43ff70
add rax, 0x20
test ebx, ebx
jle 0x43ff60
lock add dword [rax], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax], 1
add rsp, 0x20
pop rbx
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x43ff46
add rsp, 0x20
pop rbx
ret

Function at 0x440070
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
cmp dword [0x00540e60], 1
je 0x440085
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x4400f0
test byte [rbx + 0x40], 0xc
jne 0x4400a9
mov eax, dword [0x00540e68]
test eax, eax
jne 0x4400b8
add rsp, 0x28
pop rbx
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x4400db
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x4400db
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x440105
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp dbg.pthread_mutex_unlock
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x440099
add rsp, 0x28
pop rbx
pop r12
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x440123
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r12
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x440140
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
xor r12d, r12d
test rcx, rcx
je 0x440166
call sym._pthread_time_in_ms_from_timespec
mov edx, 0xfffffffe
mov r12d, 0xffffffff
cmp rax, rdx
cmovbe r12d, eax
cmp dword [0x00540e60], 1
je 0x440174
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x4401d8
test r12d, r12d
je 0x4401b8
call dbg.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x4401e8
mov edx, r12d
call dbg._pthread_wait_for_single_object
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call dbg.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x440188
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4401a3

Function at 0x440200
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
cmp dword [0x00540e60], 1
mov r12d, ecx
je 0x440218
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x440280
test r12d, r12d
je 0x440260
call dbg.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x440290
mov edx, r12d
call dbg._pthread_wait_for_single_object
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call dbg.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x44022c
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x440247
Function at 0x4402a0
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x4403ae
lea rcx, [0x004f9328]
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
lea rcx, [0x004f9328]
mov rbx, rax
call dbg.pthread_mutex_unlock
test rbx, rbx
je 0x4403ae
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x4403ae
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4403ae
lea r13, [rbx + 0x38]
mov rcx, r13
call dbg.pthread_mutex_lock
cmp dword [0x00540e60], 1
je 0x440327
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x4404c0
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x4403c8
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x440420
and edx, 3
jne 0x4403a0
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x00540e68], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x440381
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r13
call dbg.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x440389
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
test dl, 3
jne 0x4403a0
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x00540e68], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x4403ed
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x440381
and eax, 0xfffffffe
mov rcx, r13
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop word [rax + rax]
test dl, 0xc
jne 0x4403a0
and edx, 0xf
jne 0x4403ae
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x440381
mov rcx, qword [rbx + 0x28]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [dbg._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, r12
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x00540e68], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x4404a8
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x440381
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x44033c
movzx edx, byte [rbx + 0x40]
jmp 0x440349
Function at 0x4404e0
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x004f9328]
mov ebx, edx
call dbg.pthread_mutex_lock
mov rcx, r12
call dbg.__pthread_get_pointer
test rax, rax
je 0x440558
cmp qword [rax + 0x1d8], r12
jne 0x440558
test byte [rax + 0x40], 0xc
jne 0x440558
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x440558
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x440558
lea rcx, [0x004f9328]
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x440578
lea edx, [rbx - 2]
cmp edx, 0x15
ja 0x440580
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp dbg.pthread_cancel
lea rcx, [0x004f9328]
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x28
pop rbx
pop r12
ret
xor eax, eax
jmp 0x440569
mov eax, 0x16
jmp 0x440569

Function at 0x440700
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x00540e60], 1
mov esi, ecx
mov rdi, rdx
je 0x44071c
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x440798
test esi, 0xfffffffe
je 0x440750
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
test rdi, rdi
je 0x440769
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov ecx, dword [rbx + 0x44]
and ecx, 0xfffffffe
or esi, ecx
mov rcx, qword [rbx + 0x1d8]
mov dword [rbx + 0x44], esi
call dbg.test_cancel_locked
mov rcx, r12
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x440730
jmp 0x440738

Function at 0x4407b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x00540e60], 1
mov esi, ecx
mov rdi, rdx
je 0x4407cc
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x440848
test esi, 0xfffffffd
je 0x440800
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
test rdi, rdi
je 0x440819
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov ecx, dword [rbx + 0x44]
and ecx, 0xfffffffd
or esi, ecx
mov rcx, qword [rbx + 0x1d8]
mov dword [rbx + 0x44], esi
call dbg.test_cancel_locked
mov rcx, r12
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x4407e0
jmp 0x4407e8
Function at 0x440b40
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x440c80
lea rcx, [0x004f9328]
call dbg.pthread_mutex_lock
mov rcx, rbx
call dbg.__pthread_get_pointer
lea rcx, [0x004f9328]
mov r12, rax
call dbg.pthread_mutex_unlock
test r12, r12
je 0x440c80
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x440c80
lea rdx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x440c80
test byte [r12 + 0x44], 4
jne 0x440c90
cmp dword [0x00540e60], 1
je 0x440bbe
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x440ca0
cmp rbx, qword [rax + 0x1d8]
je 0x440cb8
mov eax, dword [r12 + 0xbc]
mov rcx, qword [r12 + 0x28]
test eax, eax
je 0x440bfb
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x440c0b
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x440c20
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x440c36
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x440cbf
mov qword [r12 + 0x68], 0xffffffffffffffff
xor eax, eax
cmp qword [r12 + 0x1d0], 0
jne 0x440c85
mov rcx, r12
mov dword [rsp + 0x2c], eax
call sym.push_pthread_mem.part.0
mov eax, dword [rsp + 0x2c]
jmp 0x440c85
mov eax, 3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
call sym.__pthread_self_lite.part.0
test rax, rax
je 0x440be0
jmp 0x440bd3
mov eax, 0x24
jmp 0x440c85
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x440cd0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x004f9328]
mov rsi, rdx
call dbg.pthread_mutex_lock
mov rcx, rbx
call dbg.__pthread_get_pointer
mov r12, rax
test rax, rax
je 0x440e00
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x440e00
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x440e00
test byte [r12 + 0x44], 4
jne 0x440e20
cmp dword [0x00540e60], 1
je 0x440d38
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004f9338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x440e68
mov rdx, qword [rax + 0x1d8]
cmp rbx, rdx
je 0x440e90
mov edx, dword [r12 + 0xbc]
mov rcx, qword [r12 + 0x28]
test edx, edx
jne 0x440d83
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x440e40
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x440d98
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x440dae
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x440ea6
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x440e80
lea rcx, [0x004f9328]
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x004f9328]
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x004f9328]
call dbg.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov eax, dword [r12 + 0xbc]
test eax, eax
jne 0x440d7e
lea rcx, [0x004f9328]
call dbg.pthread_mutex_unlock
mov eax, 0x10
jmp 0x440df1
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
je 0x440d54
jmp 0x440d4d
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x440de3
lea rcx, [0x004f9328]
call dbg.pthread_mutex_unlock
mov eax, 0x24
jmp 0x440df1
call sym.replace_spin_keys.part.0
nop
nop dword [rax]

Function at 0x44f5c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x44f5ec
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x450250
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x004fc0b0], 0
jne 0x45035a
mov byte [0x004fc0b0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x450330
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x450321
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x00506971]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x45031c
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x4502eb
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x4503ef
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x450355
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x450355

Function at 0x4b0400
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x4b0427
call rbp
cmp dword [rax], 4
jne 0x4b0444
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x4b0420
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4c3be0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x4c3c08
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x4c3c50
cdqe
add rsi, rax
sub rbx, rax
jne 0x4c3c20
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x4c3c5c
call rbp
cmp dword [rax], 4
je 0x4c3c20
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop