joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092b50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x140092c4a
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x140092bab
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x140092c0c
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x140092c04
sub edx, 1
je 0x140092bfb
cmp edx, 2
je 0x140092bf4
mov r8, rbx
mov rdx, r14
call fcn.140052f00
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x140092bda
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x140092bda
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x140092bda
mov rcx, rsi
call fcn.1400927b0
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x140092c3b
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x140092be0
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x140092bd5
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x140092c60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov rdi, r8
mov r15, rdx
mov r14, rcx
cmp dword [rcx + 0x1c], ebp
jne 0x140092c97
call fcn.1400927b0
mov dword [r14 + 0x1c], 1
mov dword [r14 + 0x14], ebp
movsxd r12, dword [r14 + 0x14]
mov eax, dword [r14 + 0x18]
mov rbx, r12
sub eax, r12d
movsxd rdx, eax
add rdx, qword [r14 + 8]
cmp r12, rdi
jl 0x140092d10
mov rax, rdi
sub rax, 1
je 0x140092d01
sub rax, 1
je 0x140092cee
cmp rax, 2
je 0x140092cdd
mov r8, rdi
mov rcx, r15
call fcn.140052f00
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140092d8a
mov eax, dword [rdx]
mov dword [r15], eax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140092d8a
movzx eax, word [rdx]
mov word [r15], ax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140092d8a
movzx eax, byte [rdx]
mov byte [r15], al
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140092d8a
mov r8, rbx
mov rcx, r15
call fcn.140052f00
movsxd r8, dword [r14 + 0x10]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
add r15, rbx
sub rdi, rbx
mov qword [rsp + 0x20], rbp
cmp rdi, r8
jl 0x140092d50
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
add eax, r12d
mov dword [r14 + 0x14], ebp
jmp 0x140092d88
mov rdx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x60]
mov rcx, r15
mov rdx, qword [r14 + 8]
cmp rdi, rax
mov rbx, rax
mov dword [r14 + 0x14], eax
cmovle rbx, rdi
mov dword [r14 + 0x18], eax
mov r8, rbx
call fcn.140052f00
sub dword [r14 + 0x14], ebx
lea eax, [rbx + r12]
cdqe
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140093aa4
Capabilities:
Set console window title

Disassembly:
mov edx, 2
jmp 0x140093ab0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1402a7080], 0
mov edi, edx
mov rbx, rcx
jne 0x140093ace
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff6
mov dword [reloc.OLEAUT32.dll_SysReAllocString], edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
mov qword [0x1402afb20], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff4
mov qword [0x1402afae0], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [0x1402afae0]
lea rdx, [0x1402afb00]
mov qword [0x1402afb40], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov edi, 1
lea rcx, [0x140093a8c]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test rbx, rbx
je 0x140093b40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rcx, [0x1402afb60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1402afba0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140093c8c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
test r9d, r9d
je 0x140093d03
mov rcx, qword [0x1402a74e8]
add esi, 2
xor edx, edx
lea eax, [rsi + 1]
movsxd r8, eax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140093d03
mov rcx, rax
test rbx, rbx
je 0x140093cf4
mov rdx, rbx
call fcn.1401a11bc
lea rdx, [0x140226cf8]
mov rcx, rdi
call fcn.1401a11d8
jmp 0x140093d00
lea rdx, [0x140226cf8]
call fcn.1401a11bc
mov rbx, rdi
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x140093d8d
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
cmp eax, 2
je 0x140093d58
cmp eax, 0x18
je 0x140093d4e
and qword [rsp + 0x20], 0
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x58]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140093d8d
mov rcx, rbx
call fcn.14017f7c0
jmp 0x140093d60
mov rcx, rbx
call fcn.14017f210
mov rcx, rax
mov rbx, rax
call fcn.14019f7d0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8, rax
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.14017f7b0
test rdi, rdi
je 0x140093da4
mov rcx, qword [0x1402a74e8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400964b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r14d, dword [rsp + 0x48]
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r14b, 0x10
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov esi, r9d
mov r11d, edx
cmove rbx, rax
mov r10, rcx
mov r12, r8
mov r15, r8
test edx, edx
jle 0x1400965a1
lea eax, [r9 - 4]
mov r13d, 0x3d3d
movsxd rdi, eax
nop dword [rax + rax]
mov rdx, r8
sub rdx, r15
cmp r11d, 3
jae 0x140096618
mov r9d, r14d
and r9d, 0x20
cmp r11d, 2
jne 0x1400965c8
test r9d, r9d
je 0x140096541
lea eax, [rsi - 3]
movsxd rcx, eax
cmp rdx, rcx
jmp 0x140096544
cmp rdx, rdi
jge 0x140096694
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10]
add r10, 2
shl rcx, 8
or rcx, rax
shl rcx, 2
mov rax, rcx
shr rax, 0xc
movzx eax, byte [rax + rbx]
mov byte [r8], al
mov rax, rcx
shr rax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r8 + 1], al
movzx eax, byte [rcx + rbx]
mov byte [r8 + 2], al
add r8, 3
test r9d, r9d
jne 0x140096682
mov byte [r8], 0x3d
inc r8
mov byte [r8], 0
sub r8, r12
mov rax, r8
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
test r9d, r9d
je 0x1400965d8
lea eax, [rsi - 2]
movsxd rcx, eax
cmp rdx, rcx
jmp 0x1400965db
cmp rdx, rdi
jge 0x140096694
movzx ecx, byte [r10]
inc r10
shl rcx, 4
mov rax, rcx
and ecx, 0x3f
shr rax, 6
movzx eax, byte [rax + rbx]
mov byte [r8], al
movzx eax, byte [rcx + rbx]
mov byte [r8 + 1], al
add r8, 2
test r9d, r9d
jne 0x140096682
mov word [r8], r13w
add r8, 2
jmp 0x140096682
cmp rdx, rdi
jge 0x140096694
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10 + 2]
movzx r9d, byte [r10]
add r10, 3
shl r9, 8
or r9, rax
shl r9, 8
or r9, rcx
mov rax, r9
shr rax, 6
and eax, 0x3f
movsx edx, byte [rax + rbx]
mov rax, r9
and eax, 0x3f
movsx ecx, byte [rax + rbx]
mov rax, r9
shr rax, 0xc
and eax, 0x3f
shl ecx, 8
or edx, ecx
shr r9, 0x12
shl edx, 8
movsx eax, byte [rax + rbx]
or edx, eax
movsx eax, byte [r9 + rbx]
shl edx, 8
or edx, eax
mov dword [r8], edx
add r8, 4
sub r11d, 3
test r11d, r11d
jg 0x140096510
jmp 0x1400965a1
xor eax, eax
jmp 0x1400965ab
Function at 0x140097150
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
bt r8d, 0x10
jae 0x14009735f
mov r11, rsp
push r12
push r14
sub rsp, 0xe8
mov rax, qword [0x14029fd68]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, rdx
mov r14, rcx
test rcx, rcx
je 0x140097344
mov eax, dword [rcx]
mov qword [r11 + 0x18], rbx
cdq
mov qword [r11 - 0x18], rbp
and edx, 7
mov ebp, dword [rsp + 0x120]
add eax, edx
sar eax, 3
mov qword [r11 - 0x20], rsi
test r9, r9
mov qword [r11 - 0x28], rdi
lea rdi, [0x14020cfd0]
mov qword [r11 - 0x30], r13
cmovne rdi, r9
mov qword [r11 - 0x38], r15
movsxd r15, dword [rcx + 4]
movsxd r13, eax
cmp ebp, 0x18
jne 0x1400971eb
mov rcx, rdi
call fcn.14017f7c0
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400971e0
jmp 0x14009722a
cmp ebp, 0x19
jne 0x14009720f
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140097200
add rbx, rbx
jmp 0x14009722a
mov rcx, rdi
call fcn.14017f210
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140097221
mov rdx, rdi
cmp rbx, r15
jle 0x14009727d
mov r8d, ebx
mov rcx, r14
call qword [r12 + SafeArrayPutElement]
mov rcx, r14
call qword [r12 + 0x20]
lea rdx, [r14 + 8]
mov r8, r13
lea rcx, [rsp + 0x20]
call fcn.140052f00
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, r13d
add rcx, r13
movsxd r8, eax
xor edx, edx
call fcn.1400539f0
mov edx, 1
mov rcx, r14
call qword [r12 + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x1400972a1
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.140052f00
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, ebx
add rcx, rbx
movsxd r8, eax
xor edx, edx
call fcn.1400539f0
lea rcx, [r14 + 0x48]
mov r8, r15
lea rdx, [rsp + 0x20]
call fcn.140052f00
mov r13, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x110]
test r15d, r15d
jle 0x1400972f8
xor r9d, r9d
lea rcx, [rsp + 0x20]
mov rax, r14
sub rax, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, r9
inc r9
xor byte [rdx], 0x36
xor byte [rax + rdx + 0x48], 0x5c
cmp r9, r15
jl 0x1400972e0
mov r8d, r15d
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [r12 + SafeArrayPutElement]
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xd8]
cmp ebp, 0x18
jne 0x140097327
mov rcx, rdi
call fcn.14017f7b0
jmp 0x140097334
cmp ebp, 0x19
je 0x140097334
mov rcx, rdi
call fcn.14017f200
mov rbp, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14017f910
add rsp, 0xe8
pop r14
pop r12
ret
Function at 0x1400980c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140098310
mov r11d, eax
lea edx, [rax*4]
movsxd r9, edx
test edx, edx
jle 0x14009813d
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rcx, [rbx + 8]
nop
mov edx, dword [rcx - 8]
add r10, 4
mov eax, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rcx - 8], eax
lea rcx, [rcx + 0x10]
mov eax, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rcx - 0x14]
mov dword [rcx - 0x14], eax
mov eax, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rcx - 0x10]
mov dword [rcx - 0x10], eax
mov eax, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rcx - 0xc]
mov dword [rcx - 0xc], eax
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x1400980f0
cmp r11d, 1
jle 0x1400982f9
mov qword [rsp + 0x30], rdi
lea r10d, [r11 - 1]
lea rdi, [0x140000000]
add rbx, 4
nop dword [rax + rax]
mov r9d, dword [rbx + 0x10]
lea rbx, [rbx + 0x10]
mov edx, dword [rbx - 4]
movzx eax, byte [rbx - 3]
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x228fc0]
movzx eax, byte [rdi + rax*4 + 0x2283c0]
xor r8d, dword [rdi + rax*4 + 0x2287c0]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
movzx eax, byte [rbx - 2]
xor r8d, dword [rdi + rcx*4 + 0x2293c0]
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x228bc0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x2283c0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x228bc0]
movzx eax, byte [rdi + rcx*4 + 0x2283c0]
xor r8d, dword [rdi + rax*4 + 0x228fc0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
movzx eax, r9b
mov r9d, dword [rbx + 4]
xor r8d, dword [rdi + rcx*4 + 0x2287c0]
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x2293c0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx], r8d
movzx edx, byte [rdi + rcx*4 + 0x2283c0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x228bc0]
movzx eax, byte [rdi + rcx*4 + 0x2283c0]
xor r8d, dword [rdi + rax*4 + 0x228fc0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
movzx eax, r9b
mov r9d, dword [rbx + 8]
xor r8d, dword [rdi + rcx*4 + 0x2287c0]
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x2293c0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x2283c0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x228bc0]
movzx eax, byte [rdi + rcx*4 + 0x2283c0]
xor r8d, dword [rdi + rax*4 + 0x228fc0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x2287c0]
movzx ecx, byte [rdi + rax*4 + 0x2283c0]
xor r8d, dword [rdi + rcx*4 + 0x2293c0]
mov dword [rbx + 8], r8d
sub r10, 1
jne 0x140098160
mov rdi, qword [rsp + 0x30]
mov eax, r11d
add rsp, 0x20
pop rbx
ret
Function at 0x140099e20
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1402afbe0]
call fcn.1400a4c6c
mov ecx, dword [0x1402afc00]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [rbx], 0
jne 0x140099e60
lea r8, [0x140229be8]
lea rdx, str.StartDrawing__
lea rcx, str.CallNeededLib
call fcn.1400a92f0
add rsp, 0x20
pop rbx
ret

Function at 0x14009a2bc
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1402afbe0]
call fcn.1400a4c6c
mov ecx, dword [0x1402afc00]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [0x1402aa018], 0
and dword [rbx], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14009a324
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x14009a399
call qword [rcx + 0xb0]
mov edx, dword [rbx + 0xf4]
mov rdi, rax
mov dword [rbx + 0x108], edx
mov edx, dword [rbx + 0xf8]
mov dword [rbx + 0x10c], edx
test rax, rax
jne 0x14009a399
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x14009a371
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x1402a74e8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1402afc00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1402afc20], 0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x14009a3a8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ebx, r8d
mov ecx, dword [0x1402afc00]
mov edi, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rsi
mov rcx, rax
mov r9d, dword [rax + 0x104]
mov r8d, dword [rax + 0x100]
add r9d, ebx
add r8d, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x48]

Function at 0x14009a42c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1402afc00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14009a48d
mov rcx, rax
call qword [rax + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x14009a465
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x1402a74e8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1402afc00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1402afc20], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14009a494
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402afc00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x14009a4b7
mov rcx, rax
add rsp, 0x28
jmp rdx
xor eax, eax
add rsp, 0x28
ret

Function at 0x14009a4c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402afc00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rax + 0x28]
test rdx, rdx
je 0x14009a4e3
mov rcx, rax
add rsp, 0x28
jmp rdx
xor eax, eax
add rsp, 0x28
ret
Function at 0x14009a4ec
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1402afc00], eax
add rsp, 0x28
ret

Function at 0x1400a1710
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x30
mov ebp, r9d
mov rbx, rcx
test r8, r8
je 0x1400a1809
movzx r12d, word [r8]
test r12w, r12w
je 0x1400a1809
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x28], r14
mov eax, r13d
mov qword [rsp + 0x20], r15
cmovns eax, edx
test rcx, rcx
je 0x1400a1789
cmp word [rcx], r13w
je 0x1400a1789
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x1400a1770
cmp edi, eax
mov esi, r13d
cmovg edi, eax
sub eax, edi
cmovns esi, eax
jmp 0x1400a178e
mov edi, r13d
mov esi, eax
call fcn.1400a6340
lea ecx, [rdi + rsi]
mov edx, ebp
mov r15d, eax
call fcn.1400a61d0
mov r14, rax
test r15d, r15d
je 0x1400a17b3
mov ecx, r15d
call fcn.1400a6380
mov rbx, rax
movsxd r15, edi
test edi, edi
je 0x1400a17cd
movsxd rcx, esi
lea r8, [r15 + r15]
mov rdx, rbx
lea rcx, [r14 + rcx*2]
call fcn.140052f00
test esi, esi
je 0x1400a17e2
mov rdi, r14
mov edx, esi
mov rax, r12
mov ecx, esi
rep stosw word [rdi], ax
lea r14, [r14 + rdx*2]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov word [r14 + r15*2], r13w
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rbp
pop rbx
ret
mov ecx, ebp
add rsp, 0x30
pop r12
pop rbp
pop rbx
jmp fcn.1400a62b0

Function at 0x1400a1820
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.1400a61d0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14017eac4
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x1400a1853
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400a6280
Function at 0x1400a1920
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x1400a19f2
mov qword [rsp + 0x40], rbp
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
nop
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x1400a1950
mov eax, 1
xor r15d, r15d
sub eax, esi
mov ebp, r15d
add ecx, eax
cmovns ebp, ecx
mov rcx, rbx
call fcn.1400a6340
mov edx, edi
mov ecx, ebp
mov r14d, eax
call fcn.1400a61d0
mov rdi, rax
test r14d, r14d
je 0x1400a1993
mov ecx, r14d
call fcn.1400a6380
mov rbx, rax
mov r14, qword [rsp + 0x48]
mov ecx, ebp
test rbx, rbx
je 0x1400a19d7
cmp esi, 1
jle 0x1400a19b5
cmp word [rbx], r15w
je 0x1400a19b5
add rbx, 2
dec esi
cmp esi, 1
jg 0x1400a19a4
movzx eax, word [rbx]
test ax, ax
je 0x1400a19d7
sub rbx, rdi
test ecx, ecx
je 0x1400a19d7
mov word [rdi], ax
dec ecx
movzx eax, word [rbx + rdi + 2]
add rdi, 2
test ax, ax
jne 0x1400a19c0
call fcn.1400a6280
mov rbp, qword [rsp + 0x40]
mov word [rdi], r15w
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov ecx, edi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.1400a62b0

Function at 0x1400a1e20
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14d, r9d
mov rsi, r8
mov rbx, rcx
test r8, r8
je 0x1400a1f1f
cmp word [r8], 0
je 0x1400a1f1f
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x20], r15
mov eax, r13d
cmovns eax, edx
test rcx, rcx
je 0x1400a1e99
cmp word [rcx], r13w
je 0x1400a1e99
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x1400a1e80
cmp edi, eax
mov ebp, r13d
cmovg edi, eax
sub eax, edi
cmovns ebp, eax
jmp 0x1400a1e9e
mov edi, r13d
mov ebp, eax
call fcn.1400a6340
movzx r12d, word [rsi]
lea ecx, [rdi + rbp]
mov edx, r14d
mov r15d, eax
call fcn.1400a61d0
mov rsi, rax
test r15d, r15d
je 0x1400a1ec8
mov ecx, r15d
call fcn.1400a6380
mov rbx, rax
mov r15, qword [rsp + 0x20]
test edi, edi
movsxd rax, edi
lea rdi, [rax + rax]
jle 0x1400a1ee6
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.140052f00
add rsi, rdi
test ebp, ebp
je 0x1400a1efe
mov rdi, rsi
mov edx, ebp
mov rax, r12
mov ecx, ebp
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov word [rsi], r13w
mov r13, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov ecx, r14d
add rsp, 0x30
pop r14
pop rsi
pop rbx
jmp fcn.1400a62b0