joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180093340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8d, 0x9e3779b9
xor r9d, r9d
mov ebx, edx
mov r11, rcx
mov edi, edx
mov r10d, r8d
cmp edx, 0xc
jb 0x180093416
mov eax, 0xaaaaaaab
mul ebx
shr edx, 3
add r9d, dword [r11 + 8]
add r8d, dword [r11 + 4]
mov ecx, dword [r11]
sub ecx, r9d
mov eax, r9d
add r11, 0xc
shr eax, 0xd
sub ecx, r8d
sub r8d, r9d
add r10d, ecx
add edi, 0xfffffff4
xor r10d, eax
sub r8d, r10d
mov eax, r10d
shl eax, 8
xor r8d, eax
sub r9d, r8d
mov eax, r8d
sub r9d, r10d
shr eax, 0xd
xor r9d, eax
sub r10d, r9d
mov eax, r9d
shr eax, 0xc
sub r10d, r8d
sub r8d, r9d
xor r10d, eax
sub r8d, r10d
mov eax, r10d
shl eax, 0x10
xor r8d, eax
sub r9d, r8d
mov eax, r8d
sub r9d, r10d
shr eax, 5
xor r9d, eax
sub r10d, r9d
mov eax, r9d
shr eax, 3
sub r10d, r8d
sub r8d, r9d
xor r10d, eax
sub r8d, r10d
mov eax, r10d
shl eax, 0xa
xor r8d, eax
sub r9d, r8d
mov eax, r8d
sub r9d, r10d
shr eax, 0xf
xor r9d, eax
sub rdx, 1
jne 0x180093370
lea eax, [rdi - 1]
add r9d, ebx
cmp eax, 0xa
ja case.default.0x180093436
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x93540]
add rcx, rdx
jmp rcx
movzx eax, byte [r11 + 0xa]
shl eax, 0x18
add r9d, eax
movzx eax, byte [r11 + 9]
shl eax, 0x10
add r9d, eax
movzx eax, byte [r11 + 8]
shl eax, 8
add r9d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 4]
add r8d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add r10d, eax
movzx eax, byte [r11]
add r10d, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
sub r10d, r9d
sub r10d, r8d
sub r8d, r9d
mov eax, r9d
shr eax, 0xd
xor r10d, eax
sub r8d, r10d
mov eax, r10d
shl eax, 8
xor r8d, eax
sub r9d, r8d
mov eax, r8d
sub r9d, r10d
shr eax, 0xd
xor r9d, eax
sub r10d, r9d
mov eax, r9d
sub r10d, r8d
sub r8d, r9d
shr eax, 0xc
xor r10d, eax
sub r8d, r10d
mov eax, r10d
shl eax, 0x10
xor r8d, eax
sub r9d, r8d
mov eax, r8d
sub r9d, r10d
shr eax, 5
xor r9d, eax
sub r10d, r9d
mov eax, r9d
sub r10d, r8d
sub r8d, r9d
shr eax, 3
xor r10d, eax
sub r8d, r10d
mov ecx, r10d
shl ecx, 0xa
xor r8d, ecx
sub r9d, r8d
shr r8d, 0xf
sub r9d, r10d
xor r9d, r8d
mov eax, r9d
ret
Function at 0x1800a2560
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x19560]
lea rax, [0x18003d620]
mov rdi, rcx
mov qword [rcx], rax
test rbx, rbx
je 0x1800a25a5
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800a2591
xor eax, eax
jmp 0x1800a2597
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rdi + 0x19580]
test rbx, rbx
je 0x1800a25d3
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800a25bf
xor eax, eax
jmp 0x1800a25c5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x19640]
test rcx, rcx
je 0x1800a25f0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi + 0x19640], 0
lea rcx, [rdi + 0x196c8]
call fcn.1800c6110
lea rcx, [rdi + 0x196a8]
call fcn.1800c6110
lea rcx, [rdi + 0x19688]
call fcn.1800c5f60
lea rcx, [rdi + 0x19668]
call fcn.1800c6090
lea rcx, [rdi + 0x19648]
call fcn.1800f0100
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18018e320
Function at 0x1800be230
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov r9d, dword [rcx + 0x1956c]
mov eax, dword [rcx + 0x19568]
mov ebx, 0x400
test r9d, r9d
lea r8d, [rdx + rax]
mov rsi, rcx
cmovne ebx, r9d
cmp r8d, ebx
jbe 0x1800be268
lea ecx, [rdx + rax]
add ebx, ebx
cmp ecx, ebx
ja 0x1800be262
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
cmp ebx, r9d
je 0x1800be320
mov ebp, ebx
movabs rax, 0x3fffffffffffffff
cmp rbp, rax
ja 0x1800be337
mov ecx, dword [0x18025e63c]
xor edi, edi
test ecx, ecx
jns 0x1800be2a1
mov rax, rdi
jmp 0x1800be2a7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
lea r8, [rbx*4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1800be337
mov r8d, dword [rsi + 0x19568]
mov rdx, qword [rsi + 0x19560]
mov rcx, rax
shl r8, 2
mov qword [rsp + 0x40], r12
call sub.msvcrt.dll_memcpy
mov r12, qword [rsi + 0x19560]
test r12, r12
je 0x1800be30e
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800be300
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [rdi]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x40]
mov qword [rsi + 0x19560], rbp
mov dword [rsi + 0x1956c], ebx
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov eax, 0x8007000e
jmp 0x1800be322
Function at 0x1800c4930
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x1800c494a
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
xor r12d, r12d
test rdx, rdx
je 0x1800c4a25
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800c49a8
cmp rbx, 0x10
jae 0x1800c4986
mov ebx, 0x20
jmp 0x1800c4994
cmp rbx, rax
ja 0x1800c4990
add rbx, rbx
jmp 0x1800c4994
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800c4973
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
jbe 0x1800c49b2
mov eax, 0x80070216
jmp 0x1800c4a7c
test rbx, rbx
je 0x1800c4a28
mov ecx, dword [0x18025e63c]
lea rsi, [rbx*4]
test ecx, ecx
jns 0x1800c49ce
mov rax, r12
jmp 0x1800c49d4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800c49f4
mov eax, 0x8007000e
jmp 0x1800c4a7c
mov rax, qword [rdi + 0x10]
mov r8, rbx
mov rdx, r12
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800c4a2b
nop word [rax + rax]
mov rax, qword [rdi]
inc rdx
mov ecx, dword [rax + rdx*4 - 4]
mov dword [rsi + rdx*4 - 4], ecx
cmp rdx, r8
jb 0x1800c4a10
jmp 0x1800c4a2b
mov rbx, r12
mov rsi, r12
cmp byte [rdi + 0x18], 0
je 0x1800c4a65
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdi]
test rbp, rbp
je 0x1800c4a60
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800c4a51
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rcx, qword [r12]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800c4a76
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c4aa0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rax, rdx
mov rdi, rcx
jne 0x1800c4abd
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
test rax, rax
je 0x1800c4bc8
mov rbx, qword [rcx + 8]
movabs rcx, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800c4bb3
cmp rbx, 0x10
jae 0x1800c4af7
mov ebx, 0x20
jmp 0x1800c4b05
cmp rbx, rcx
ja 0x1800c4b01
add rbx, rbx
jmp 0x1800c4b05
or rbx, 0xffffffffffffffff
cmp rbx, rax
jb 0x1800c4ae0
movabs rax, 0xfffffffffffffff
cmp rbx, rax
ja 0x1800c4bb3
test rbx, rbx
je 0x1800c4bcb
mov ecx, dword [0x18025e63c]
mov rsi, rbx
shl rsi, 4
test ecx, ecx
js 0x1800c4b4a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1800c4b4a
mov rax, qword [rax]
test rax, rax
jne 0x1800c4b50
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800c4b7b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov eax, 0x8007000e
add rsp, 0x20
pop rdi
ret
mov rax, qword [rdi + 0x10]
mov r8, rbx
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800c4bce
xor edx, edx
mov rcx, qword [rdi]
add rdx, 0x10
sub r8, 1
mov rax, qword [rdx + rcx - 0x10]
mov qword [rdx + rsi - 0x10], rax
mov rax, qword [rdx + rcx - 8]
mov qword [rdx + rsi - 8], rax
jne 0x1800c4b90
jmp 0x1800c4bce
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov eax, 0x80070216
add rsp, 0x20
pop rdi
ret
mov rbx, rdx
mov rsi, rdx
cmp byte [rdi + 0x18], 0
je 0x1800c4c17
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdi]
test rbp, rbp
je 0x1800c4c12
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800c4bfe
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1800c4bfe
mov rax, qword [rax]
test rax, rax
jne 0x1800c4c04
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800c4c28
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov byte [rdi + 0x18], 1
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1800c4d70
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x1800c4d8a
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
xor r12d, r12d
test rdx, rdx
je 0x1800c4e67
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800c4de8
cmp rbx, 0x10
jae 0x1800c4dc6
mov ebx, 0x20
jmp 0x1800c4dd4
cmp rbx, rax
ja 0x1800c4dd0
add rbx, rbx
jmp 0x1800c4dd4
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800c4db3
movabs rax, 0x1fffffffffffffff
cmp rbx, rax
jbe 0x1800c4df2
mov eax, 0x80070216
jmp 0x1800c4ebe
test rbx, rbx
je 0x1800c4e6a
mov ecx, dword [0x18025e63c]
lea rsi, [rbx*8]
test ecx, ecx
jns 0x1800c4e0e
mov rax, r12
jmp 0x1800c4e14
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800c4e34
mov eax, 0x8007000e
jmp 0x1800c4ebe
mov rax, qword [rdi + 0x10]
mov r8, rbx
mov rdx, r12
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800c4e6d
nop word [rax + rax]
mov rax, qword [rdi]
inc rdx
mov rcx, qword [rax + rdx*8 - 8]
mov qword [rsi + rdx*8 - 8], rcx
cmp rdx, r8
jb 0x1800c4e50
jmp 0x1800c4e6d
mov rbx, r12
mov rsi, r12
cmp byte [rdi + 0x18], 0
je 0x1800c4ea7
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdi]
test rbp, rbp
je 0x1800c4ea2
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800c4e93
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rcx, qword [r12]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800c4eb8
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800c4ee0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movabs rax, 0x555555555555555
mov rbx, rcx
cmp rcx, rax
jbe 0x1800c4f00
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c4f0e
xor eax, eax
jmp 0x1800c4f14
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
lea r8, [rbx + rbx*2]
xor edx, edx
shl r8, 4
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_HeapAlloc]
Function at 0x1800c56f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
je 0x1800c578d
mov rax, qword [rdx + 0x10]
cmp qword [rbx + 0x10], rax
jb 0x1800c5766
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c5742
xor eax, eax
mov r8, rdx
xor edx, edx
mov rcx, qword [rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x1800c578d
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c5779
xor eax, eax
jmp 0x1800c577f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 8], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800c57b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 8]
mov rbx, rcx
test r8, r8
je 0x1800c57dc
mov rdi, qword [r8 + 0x10]
cmp rdi, rdx
jb 0x1800c57dc
mov qword [rcx + 8], 0
jmp 0x1800c5876
mov rax, qword [rcx + 0x10]
cmp rax, rdx
cmova rdx, rax
cmp rdx, 0xffffffffffffffff
je 0x1800c5898
cmp rdx, 0xffffffffffffcfff
ja 0x1800c5898
lea rdi, [rdx + 0x3000]
cmp rdi, 0xffffffffffffffe7
ja 0x1800c5898
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x30], rsi
test ecx, ecx
jns 0x1800c5822
xor eax, eax
jmp 0x1800c5828
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
lea r8, [rdi + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, qword [rsp + 0x30]
mov r8, rax
test rax, rax
jne 0x1800c5854
mov eax, 0x8007000e
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx]
mov rcx, rdi
test rax, rax
je 0x1800c586c
nop
add rcx, qword [rax + 0x10]
mov rax, qword [rax]
test rax, rax
jne 0x1800c5860
cmp rcx, qword [rbx + 0x10]
jbe 0x1800c5876
mov qword [rbx + 0x10], rcx
mov rax, qword [rbx]
mov qword [r8 + 8], 0
mov qword [r8 + 0x10], rdi
mov qword [r8], rax
mov qword [rbx], r8
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0x80070216
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c5e00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
cmp qword [rcx], 0
mov rsi, rcx
je 0x1800c5f4b
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], r12
xor r12d, r12d
mov qword [rsp + 0x40], rdi
nop word [rax + rax]
mov rbx, qword [rsi]
mov rbp, qword [rbx]
test rbx, rbx
je 0x1800c5f2b
cmp word [rbx + 0x7c], r12w
je 0x1800c5e94
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c5e55
mov rax, r12
jmp 0x1800c5e5b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, word [rbx + 0x7c]
cmp ecx, dword [rax + 0x250]
ja 0x1800c5e8b
mov r8, qword [rbx + 0x18]
dec ecx
movsxd rdx, ecx
shl rdx, 5
add rdx, qword [rax + 0x248]
test r8, r8
je 0x1800c5e8b
mov rax, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r8
mov word [rbx + 0x7c], r12w
mov qword [rbx + 0x18], r12
cmp word [rbx + 0x7e], r12w
je 0x1800c5ee9
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c5eaa
mov rax, r12
jmp 0x1800c5eb0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, word [rbx + 0x7e]
cmp ecx, dword [rax + 0x250]
ja 0x1800c5ee0
mov r8, qword [rbx + 0x28]
dec ecx
movsxd rdx, ecx
shl rdx, 5
add rdx, qword [rax + 0x248]
test r8, r8
je 0x1800c5ee0
mov rax, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r8
mov word [rbx + 0x7e], r12w
mov qword [rbx + 0x28], r12
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800c5f2b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x1800c5f2b
mov edx, 0xfe
mov rcx, rbx
lea r8d, [rdx - 0x7e]
call fcn.18024adb8
mov qword [rbx], r12
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x1800c5f23
mov qword [rax], rbx
jmp 0x1800c5f27
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
mov qword [rsi], rbp
cmp rbp, r12
jne 0x1800c5e30
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret

Function at 0x1800c5f60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
mov rcx, qword [rcx]
xor edx, edx
call fcn.1800c6190
xor esi, esi
mov qword [rbx + 0x10], rsi
cmp byte [rbx + 0x18], sil
je 0x1800c5fc0
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800c5fb7
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c5fa3
mov rax, rsi
jmp 0x1800c5fa9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 0x18], sil
mov qword [rbx + 8], rsi
mov qword [rbx], rsi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1800c5fe0
Capabilities:
Get thread local storage value

Disassembly:
cmp rdx, r8
jae 0x1800c6086
push rdi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
lea rax, [rdx + rdx*8]
mov rdi, r8
mov qword [rsp + 0x40], rsi
lea rbx, [rcx + rax*8 + 0x40]
sub rdi, rdx
xor ebp, ebp
nop
lea rax, [rbx - 0x40]
test rax, rax
je 0x1800c6068
mov r8, qword [rbx - 8]
mov rcx, qword [rbx - 0x18]
xor edx, edx
call fcn.1800c6190
mov qword [rbx - 8], rbp
cmp byte [rbx], bpl
je 0x1800c6060
mov rsi, qword [rbx - 0x18]
test rsi, rsi
je 0x1800c605d
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c6049
mov rax, rbp
jmp 0x1800c604f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [rbx], bpl
mov qword [rbx - 0x18], rbp
mov qword [rbx - 0x10], rbp
add rbx, 0x48
sub rdi, 1
jne 0x1800c6010
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
repz ret

Function at 0x1800c6090
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
mov rcx, qword [rcx]
xor edx, edx
call fcn.1800c5fe0
xor esi, esi
mov qword [rbx + 0x10], rsi
cmp byte [rbx + 0x18], sil
je 0x1800c60f0
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800c60e7
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c60d3
mov rax, rsi
jmp 0x1800c60d9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 0x18], sil
mov qword [rbx + 8], rsi
mov qword [rbx], rsi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x1800c6110
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 0x10], rsi
cmp byte [rcx + 0x18], sil
je 0x1800c6174
mov qword [rsp + 0x30], rdi
mov rdi, qword [rcx]
test rdi, rdi
je 0x1800c6159
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c6145
mov rax, rsi
jmp 0x1800c614b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 0x18], sil
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
add rsp, 0x20
pop rsi
ret
Function at 0x1800c6190
Capabilities:
Get thread local storage value

Disassembly:
cmp rdx, r8
jae 0x1800c6227
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
lea rax, [rdx + rdx*4]
mov rsi, r8
mov qword [rsp + 0x40], rdi
lea rbx, [rcx + rax*8 + 0x20]
sub rsi, rdx
xor ebp, ebp
nop
lea rax, [rbx - 0x20]
test rax, rax
je 0x1800c6209
mov qword [rbx - 8], rbp
cmp byte [rbx], bpl
je 0x1800c6201
mov rdi, qword [rbx - 0x18]
test rdi, rdi
je 0x1800c61fe
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c61ea
mov rax, rbp
jmp 0x1800c61f0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [rbx], bpl
mov qword [rbx - 0x18], rbp
mov qword [rbx - 0x10], rbp
add rbx, 0x28
sub rsi, 1
jne 0x1800c61c0
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
repz ret

Function at 0x1800c63b0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800c63c7
xor eax, eax
jmp 0x1800c63cd
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_HeapAlloc]
Function at 0x1800f0100
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rdi, rcx
test rsi, rsi
je 0x1800f0138
nop
test rbx, rbx
je 0x1800f012e
lea rcx, [rbx + 8]
call fcn.1800c5e00
add rbx, 0x20
sub rsi, 1
jne 0x1800f0120
xor esi, esi
mov qword [rdi + 0x10], rsi
cmp byte [rdi + 0x18], sil
je 0x1800f0173
mov rbx, qword [rdi]
test rbx, rbx
je 0x1800f016f
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800f015b
mov rax, rsi
jmp 0x1800f0161
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [rdi + 0x18], sil
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], rsi
mov qword [rdi], rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret