joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000667c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov ebx, edx
mov ecx, dword [0x140101f94]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rcx, rax
mov r8d, dword [rax + 0x104]
mov edx, dword [rax + 0x100]
add r8d, ebx
add edx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [rax + 0xa8]

Function at 0x1400066d8
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x14000674d
call qword [rcx + 0xb0]
mov edx, dword [rbx + 0xf4]
mov rdi, rax
mov dword [rbx + 0x108], edx
mov edx, dword [rbx + 0xf8]
mov dword [rbx + 0x10c], edx
test rax, rax
jne 0x14000674d
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140006725
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x140101548]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [0x140101f94]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
and qword [0x140101f98], 0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x14000675c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x140101f94]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400067bd
mov rcx, rax
call qword [rax + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140006795
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x140101548]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [0x140101f94]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
and qword [0x140101f98], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140008ea0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x30
mov ebp, r9d
mov rbx, rcx
test r8, r8
je 0x140008f99
movzx r12d, word [r8]
test r12w, r12w
je 0x140008f99
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x28], r14
mov eax, r13d
mov qword [rsp + 0x20], r15
cmovns eax, edx
test rcx, rcx
je 0x140008f19
cmp word [rcx], r13w
je 0x140008f19
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x140008f00
cmp edi, eax
mov esi, r13d
cmovg edi, eax
sub eax, edi
cmovns esi, eax
jmp 0x140008f1e
mov edi, r13d
mov esi, eax
call fcn.140026d90
lea ecx, [rdi + rsi]
mov edx, ebp
mov r15d, eax
call fcn.140021080
mov r14, rax
test r15d, r15d
je 0x140008f43
mov ecx, r15d
call fcn.140026dd0
mov rbx, rax
movsxd r15, edi
test edi, edi
je 0x140008f5d
movsxd rcx, esi
lea r8, [r15 + r15]
mov rdx, rbx
lea rcx, [r14 + rcx*2]
call fcn.14000af70
test esi, esi
je 0x140008f72
mov rdi, r14
mov edx, esi
mov rax, r12
mov ecx, esi
rep stosw word [rdi], ax
lea r14, [r14 + rdx*2]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov word [r14 + r15*2], r13w
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rbp
pop rbx
ret
mov ecx, ebp
add rsp, 0x30
pop r12
pop rbp
pop rbx
jmp fcn.14000a7b0
Function at 0x140009400
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.140021080
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140026f5c
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140009433
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140021130

Function at 0x1400095d8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140102130]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140009659
mov r8, qword [0x140102128]
lea edx, [rax + 8]
mov rcx, qword [0x140101548]
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [0x140102130]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov rbx, qword [0x140102120]
jmp 0x140009645
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140009642
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140009630
mov rdx, rdi
lea rcx, [0x140009774]
call fcn.140027068
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140009670
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbp, r8
mov rsi, rdx
and ecx, 7
je 0x14000969a
mov eax, 8
sub eax, ecx
add edi, eax
mov rbx, qword [0x140102128]
test rbx, rbx
jne 0x1400096e0
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov rcx, qword [0x140101548]
lea edx, [rbx + 8]
movsxd rdi, edi
mov r8, rdi
mov dword [0x140102130], eax
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [0x140102130]
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov rbx, qword [0x140102128]
jmp 0x1400096e3
movsxd rdi, edi
mov ecx, dword [0x140102130]
lea rax, [rdi + rbx]
mov qword [0x140102128], rax
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov r9, qword [0x140102128]
mov edx, 8
mov rcx, qword [0x140101548]
mov r8, rax
call qword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov ecx, dword [0x140102130]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test rsi, rsi
jne 0x140009732
test rbp, rbp
je 0x140009759
mov edx, 0x28
lea rcx, [0x140102120]
call fcn.14000a0e0
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
test rsi, rsi
je 0x140009759
lea rcx, [rdi + rbx]
call rsi
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400097f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
movsxd rbx, edx
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rcx, qword [0x140102138]
xor edx, edx
mov rsi, rax
mov rax, qword [r14]
mov r8d, dword [rsi + 0x10]
sub r8d, ebx
movsxd rdi, r8d
lea r9, [rdi + 0xa]
test rax, rax
jne 0x140009844
mov r8, r9
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
jmp 0x14000984d
mov r8, rax
call qword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov qword [r14], rax
mov rcx, rax
mov rdx, qword [rsi]
shr rdi, 1
add rdx, rbx
mov r8d, edi
call fcn.140026e00
mov rdi, qword [rsp + 0x40]
mov qword [rsi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x1400098c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401005d8]
cmp ecx, 0xffffffff
jne 0x1400098d6
call fcn.140009ac0
jmp 0x1400098e6
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
jne 0x140009905
call fcn.1400272a0
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rdx, rax
lea rcx, [0x140009880]
add rsp, 0x28
jmp fcn.140027068
add rsp, 0x28
ret

Function at 0x140009ac0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_HeapCreate]
mov qword [0x140102138], rax
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov dword [0x1401005d8], eax
add rsp, 0x28
jmp fcn.1400272a0

Function at 0x140009b20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rax, qword [rax]
add rsp, 0x28
ret

Function at 0x140009b40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [0x1401005d8]
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, edi
mov rbx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009b80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
add qword [rax + 0x10], 2
add rsp, 0x28
ret

Function at 0x140009ba0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov qword [rax + 0x10], rbx
mov rax, qword [rax]
add rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14000a1b0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x14000a22c
movsxd rdx, ecx
lea rcx, [0x14000a2b4]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140102150]
test rbx, rbx
je 0x14000a29f
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000a222
cmp byte [rbx + 0x20], 0
je 0x14000a222
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x14000a1e8
jmp 0x14000a29f
mov rbx, qword [0x140102150]
test rbx, rbx
je 0x14000a29f
mov rsi, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000a297
cmp byte [rbx + 0x21], 0
je 0x14000a25b
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14000a287
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
or rdx, 0xffffffffffffffff
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140102150]
call fcn.14000a124
mov rbx, rsi
test rsi, rsi
jne 0x14000a238
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000a750
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000a796
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a765
mov ecx, eax
call fcn.140021080
sub rax, rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x14000a780
add rsp, 0x20
pop rbx
ret
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.14000a7b0

Function at 0x14000a7b0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
xor edx, edx
mov qword [rax + 0x10], rbx
mov rax, qword [rax]
mov word [rbx + rax], dx
add rsp, 0x20
pop rbx
ret
Function at 0x14001d440
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12d, ecx
mov rsi, r9
mov rcx, qword [0x1401016a0]
mov rbp, r8
mov r14, rdx
xor ebx, ebx
call fcn.1400095d8
mov r15, rax
test r14, r14
je 0x14001d579
mov rcx, qword [0x140101548]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rcx, r14
mov rdi, rax
or dword [rax + 4], 0xffffffff
mov dword [rax], 1
call fcn.140026e38
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call fcn.140026e38
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], r12d
mov qword [rdi + 0x88], rsi
test cl, 1
je 0x14001d56a
test rsi, rsi
je 0x14001d525
mov rcx, qword [0x140101548]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x14001d51f
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.14000af70
cmp qword [rdi + 0x70], rbx
je 0x14001d560
lea rax, [rsp + 0x68]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14001db2c]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
test rax, rax
je 0x14001d55a
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14001d576
cmp dword [rsp + 0x68], ebx
jne 0x14001d576
mov rcx, rdi
call fcn.140002048
jmp 0x14001d579
mov rcx, rdi
mov qword [rdi + 0x70], rbp
call fcn.14001d6ac
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001f770
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, str.PB_WindowID
mov rcx, r14
mov rdi, rax
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetPropW]
lea r12d, [rbx + 9]
mov rsi, rax
test rax, rax
je 0x14001f821
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14001f821
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
jne 0x14001f821
mov rcx, qword [0x1401021d0]
lea rdx, [rsi - 1]
call fcn.14000a468
mov rbx, rax
lea ebp, [r12 - 8]
cmp dword [rax + 0x20], 0
jle 0x14001f821
mov rcx, qword [rax + 8]
xor edx, edx
movsxd rax, dword [rax + 0x20]
add rcx, 4
cmp word [rcx - 2], r12w
jne 0x14001f811
mov r8d, 0xfa01
cmp word [rcx], r8w
je 0x14001f81f
inc rdx
add rcx, 6
cmp rdx, rax
jge 0x14001f821
jmp 0x14001f7fe
xor ebp, ebp
mov sil, 0x80
test rdi, rdi
je 0x14001f8f1
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14001f8f1
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001f8f1
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001f8f1
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001f8f1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x14001f8f1
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x20]
call fcn.140026ebc
test eax, eax
je 0x14001f8c1
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x20]
call fcn.140026ebc
test eax, eax
jne 0x14001f8dc
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x14001f958
lea rdx, str.Scintilla
lea rcx, [rsp + 0x20]
call fcn.14003ed58
test eax, eax
je 0x14001f958
test r14, r14
je 0x14001f933
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001f926
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001f926
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14001f933
mov edx, 1
mov rcx, r14
call fcn.14001fae8
test rdi, rdi
je 0x14001f94d
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x14001f958
test rbx, rbx
je 0x14001f958
mov rax, qword [rbx + 0x10]
jmp 0x14001f95a
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x1400201b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x1400202aa
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x14002020b
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x14002026c
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x140020264
sub edx, 1
je 0x14002025b
cmp edx, 2
je 0x140020254
mov r8, rbx
mov rdx, r14
call fcn.14000af70
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x14002023a
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x14002023a
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x14002023a
mov rcx, rsi
call fcn.1400053e0
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x14002029b
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x140020240
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x140020235
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x140021080
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, ecx
mov esi, edx
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rbx, rax
cmp esi, 0xffffffff
jne 0x1400210b0
mov esi, dword [rax + 0x10]
mov eax, dword [rax + 0x10]
mov r8, qword [rbx + 8]
lea edx, [rax + rbp*2]
movsxd rax, edx
lea rcx, [r8 - 4]
cmp rax, rcx
jl 0x1400210d1
lea eax, [rdx + 0x4000]
movsxd r9, eax
jmp 0x1400210e3
mov eax, 0x100000
cmp r8, rax
jle 0x140021100
cmp edx, eax
cmovl edx, eax
mov r9d, edx
mov r8, qword [rbx]
xor edx, edx
mov qword [rbx + 8], r9
add r9, 0xa
mov rcx, qword [0x140102138]
call qword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov qword [rbx], rax
mov rax, qword [rbx]
movsxd rdx, esi
mov rsi, qword [rsp + 0x40]
add rax, rdx
lea rcx, [rdx + rbp*2]
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140021130
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
lea ecx, [rbx + rbx]
movsxd rdx, ecx
sub qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
ret
Function at 0x140022d4c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov edx, 8
mov rcx, qword [0x140101548]
mov r8d, 0x258
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [0x140101f94]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov qword [0x140101f98], rdi
or eax, 0xffffffff
and dword [rdi + 0x11c], 0
mov edx, ebx
mov rcx, rdi
mov dword [rdi + 0x120], eax
mov dword [rdi + 0x124], eax
mov dword [rdi + 0x118], 0xffffff
mov dword [rdi + 0xe8], 2
mov dword [rdi + 0xec], 0x3f
call fcn.1400406b4
mov rbx, qword [rsp + 0x30]
lea rax, [0x140024330]
mov qword [rdi + 0xb0], rax
lea rax, [0x140024394]
mov qword [rdi + 0xb8], rax
lea rax, [fcn.140022f5c]
mov qword [rdi + 0x20], rax
lea rax, [0x140023134]
mov qword [rdi + 0x60], rax
lea rax, [0x14002337c]
mov qword [rdi + 0xc8], rax
lea rax, [0x1400233e4]
mov qword [rdi + 0xc0], rax
lea rax, [0x140023c6c]
mov qword [rdi + 0x68], rax
lea rax, [0x140023aac]
mov qword [rdi + 0x48], rax
lea rax, [0x140023ad8]
mov qword [rdi + 0x50], rax
lea rax, [0x140023b08]
mov qword [rdi + 0x58], rax
lea rax, [0x140024108]
mov qword [rdi + 0x88], rax
lea rax, [0x140022ebc]
mov qword [rdi + 0xd0], rax
lea rax, [0x140022f40]
mov qword [rdi + 0xd8], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140025e10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140049720
sub rsp, rax
mov rax, qword [0x140100a10]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002c08c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140025e5f
mov rax, rbp
jmp 0x140025f67
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1027e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140048edc
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x1027e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140025f63
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x140025f63
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140048edc
test rax, rax
js 0x140025f63
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140025f63
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140025f55
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140025f55
cmp byte [rcx], 0xd
jne 0x140025f3b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140025f4a
cmp byte [rcx + 1], 0xa
jne 0x140025f4a
inc rcx
jmp 0x140025f4a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x100740]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140025f1d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140025f67
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14003b8c0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140026d90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x140026dc4
mov rdx, qword [rax + 0x10]
add rdx, rcx
cmp rbx, rdx
ja 0x140026dc4
sub ebx, ecx
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140026dd0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x1401005d8]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
dec rbx
mov rax, qword [rax]
add rax, rbx
add rsp, 0x20
pop rbx
ret