joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002b19
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140002c8d
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x1409fbbc1]
jmp 0x140002b7f
mov byte [0x1409fbbc1], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x1409fbba0]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140002c8d
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x8d
mov byte [rsp + 0x21], 0x8c
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x23], 0x81
mov byte [rsp + 0x24], 0x76
mov byte [rsp + 0x25], 0x84
mov byte [rsp + 0x26], 0x7b
mov byte [rsp + 0x27], 0x8b
mov byte [rsp + 0x28], 0x82
mov byte [rsp + 0x29], 0x84
mov byte [rsp + 0x2a], 0x82
mov byte [rsp + 0x2b], 0x7f
mov byte [rsp + 0x2c], 0x82
mov byte [rsp + 0x2d], 0x7c
mov byte [rsp + 0x2e], 0x7d
mov byte [rsp + 0x2f], 0x83
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0x88
mov byte [rsp + 0x32], 0x8d
mov byte [rsp + 0x33], 0x79
mov byte [rsp + 0x34], 0x76
mov byte [rsp + 0x35], 0x86
mov byte [rsp + 0x36], 0x77
mov byte [rsp + 0x37], 0x8d
mov byte [rsp + 0x38], 0x77
mov byte [rsp + 0x39], 0x85
mov byte [rsp + 0x3a], 0x78
mov byte [rsp + 0x3b], 0x81
mov byte [rsp + 0x3c], 0x77
mov byte [rsp + 0x3d], 0x83
mov byte [rsp + 0x3e], 0x7e
mov byte [rsp + 0x3f], 0x7a
mov byte [rsp + 0x40], 0x13
cmp byte [0x1409fbb80], 0
jne 0x140002c68
mov byte [0x1409fbbc1], 1
mov eax, 0
lea rcx, [0x1409fbba0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140002c47
mov byte [0x1409fbb80], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x1409fbbc1], 0
je 0x140002b51
lea rax, [0x1409fbba0]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140002c7c
jmp 0x140002b4a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140008710
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x140008740
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000873f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140008745
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000873f
mov eax, 0
jmp 0x14000873f

Function at 0x140008dc0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140008d70
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400123e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14001af20
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14001af20
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140012450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1409fbf74]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400125e0
mov rax, qword [0x1409fbf78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14001249c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140012525
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140012480
mov rcx, rdi
call fcn.140012fb0
test rax, rax
mov r12, rax
je 0x140012632
mov rax, qword [0x1409fbf78]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.1400130f0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1409fbf78]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140012615
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14001251e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140012590
add dword [0x1409fbf74], 1
cmp ebx, 8
jae 0x140012551
test bl, 4
jne 0x1400125f0
test ebx, ebx
je 0x140012546
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x140012604
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140012546
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14001256a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x1409fbf78]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001251e
call qword [0x1409fd2c4]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400123e0
xor esi, esi
jmp 0x1400124a7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140012546
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140012546
mov rax, qword [0x1409fbf78]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.1400123e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.1400123e0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140012fb0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [sym.MZ__UECO_6__B6XT_E_KygNvw7C___f_i03_K_]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14001301f
mov rcx, r9
call fcn.140012e80
test eax, eax
je 0x14001301f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14001301d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140013014
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14001301f
add rdx, 0x28
cmp rdx, r9
jne 0x140013000
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001d4c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1409e4d60]
jmp 0x140013de0

Function at 0x14001d4d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1409e4d60]
jmp 0x140013de0

Function at 0x140a08540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x140a0856d
xor al, al
jmp 0x140a086cf
mov rax, qword [0x140a286c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x140a286c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x140a286d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x140a286d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140a286e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x140a286e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x140a286f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x140a286f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140a28700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140a086c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140a08619
mov r11d, 2
jmp 0x140a0863d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140a08633
mov r11d, 1
jmp 0x140a0863d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140a086e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140a08682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x140a0869a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x140a086aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140a086b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140a08600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x140a086ca
Function at 0x140002f10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140008ea0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140008ea0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002f80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000f0a4]
mov rbx, rcx
test esi, esi
jle 0x1400030b0
mov rax, qword [0x14000f0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002fcb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003055
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002fb0
mov rcx, rbx
call fcn.1400039d0
mov rdi, rax
test rax, rax
je 0x1400030d2
mov rax, qword [0x14000f0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003b10
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000f0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400030b7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000304e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003060
add dword [0x14000f0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000f0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000304e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002f10
nop dword [rax]
xor esi, esi
jmp 0x140002fd8
mov rax, qword [0x14000f0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002f10
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002f10
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003640
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000f100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000f0e0]
test rbx, rbx
je 0x14000369c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003693
test rsi, rsi
je 0x140003693
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003678
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400039d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000bda0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400039f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400039f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400039f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003a4d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003a44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400039f0
add rax, 0x28
cmp rax, r9
jne 0x140003a30
xor eax, eax
ret

Function at 0x140003a50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000bda0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003a6f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003a78
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003a6f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003b10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000bda0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003b2f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003b38
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140053c70]
mov dword [rax], 1
mov rax, qword [0x140053c80]
mov dword [rax], 1
mov rax, qword [0x140053c90]
mov dword [rax], 1
mov rax, qword [0x140053c60]
mov dword [rax], 1
mov rax, qword [0x140053ad0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002a40
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x140002a61
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sym.fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush

Function at 0x140002b80
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.fflush
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002bd0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r12d
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x140004440
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r13d, dword [0x1400707a8]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r12d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsi + 0x10]
lea rcx, [rbx + 0xa0]
call sym.rawAlloc__system_5138
mov r8, rsi
xor edx, edx
mov qword [rax + 8], 1
lea r9, [rax + 0x10]
mov rcx, r9
call sym.memset
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x1400044b0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rbx, [rdx*8]
mov qword [rcx], 0
mov r13d, dword [0x1400707a8]
mov rdi, rcx
mov qword [rcx + 8], rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r12d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rbx + 0x10]
lea rcx, [rsi + 0xa0]
call sym.rawAlloc__system_5138
mov r8, rbx
xor edx, edx
mov qword [rax + 8], 1
lea rcx, [rax + 0x10]
call sym.memset
mov qword [rdi + 0x10], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret

Function at 0x140004530
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rbx
sub rsp, 0x28
mov r13d, dword [0x1400707a8]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r12d
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rdi + 0xa0]
mov edx, 0x2010
call sym.rawAlloc__system_5138
movdqa xmm0, xmmword [0x14004e320]
lea rdx, [rax + 0x10]
lea rdi, [rax + 0x18]
mov qword [rax + 8], 1
and rdi, 0xfffffffffffffff8
mov rcx, rdx
mov qword [rax + 0x10], 0
mov qword [rax + 0x2008], 0
sub rcx, rdi
xor eax, eax
add ecx, 0x2000
shr ecx, 3
rep stosq qword [rdi], rax
mov qword [rbx + 0x18], rdx
mov qword [rbx + 0x10], 0
movups xmmword [rbx], xmm0
add rsp, 0x28
pop rbx
pop rdi
pop r12
pop r13
ret
Function at 0x1400048d0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r13d, dword [0x1400707a8]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r12d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsi + 0x10]
lea rcx, [rbx + 0xa0]
call sym.rawAlloc__system_5138
mov qword [rax + 8], 1
add rax, 0x10
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x1400053c0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r13d, dword [0x1400707a8]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r12d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsi - 0x10]
lea r11, [rbx + 0xa0]
mov r10, rdx
and r10, 0xfffffffffffff000
mov rax, qword [r10 + 8]
sub qword [rbx + 0x2138], rax
cmp rax, 0xfc0
jle 0x140005500
lea rax, [rbx + 0x2978]
cmp qword [rbx + 0x2978], 0
movq xmm0, rax
punpcklqdq xmm0, xmm0
je 0x1400055d0
mov qword [rbx + 0x2950], rax
lea r8, [r10 + 0x20]
lea rdx, [rbx + 0x2948]
mov rcx, r11
call sym.del__system_4736
mov r8, qword [r10 + 8]
cmp r8, 0x3f000000
jle 0x1400055b7
mov rdx, r10
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rbx + rax*8 + 0x2148]
test rax, rax
jne 0x140005488
jmp 0x1400054b2
mov rax, qword [rax]
test rax, rax
je 0x1400054b2
cmp rdx, qword [rax + 8]
jne 0x140005480
mov rcx, r10
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r9, rcx
shl rdx, cl
sar r9, 6
not rdx
and qword [rax + r9*8 + 0x10], rdx
mov rax, qword [rbx + 0x2120]
mov rdx, qword [rbx + 0x2128]
mov rcx, r10
mov rsi, rax
sub rsi, r8
cmp rax, rdx
mov r8d, 0x8000
cmovl rax, rdx
movq xmm0, rsi
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rbx + 0x2120], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140005551
call sym.osDeallocPages__system_4300.part.0
nop dword [rax]
mov qword [rdx + 8], 0
mov rcx, qword [r10 + 0x20]
mov qword [rsi - 0x10], rcx
mov qword [r10 + 0x20], rdx
mov rdx, qword [r10 + 0x28]
cmp rax, rdx
jle 0x140005560
test rax, rax
lea rdx, [rax + 0xf]
cmovns rdx, rax
sar rdx, 4
add rdx, 2
mov rcx, qword [rbx + rdx*8 + 0xa0]
mov qword [r10 + 0x10], rcx
test rcx, rcx
je 0x140005545
mov qword [rcx + 0x18], r10
mov qword [rbx + rdx*8 + 0xa0], r10
add qword [r10 + 0x28], rax
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
add rdx, rax
mov qword [r10 + 0x28], rdx
cmp rdx, 0xfc0
jne 0x140005551
lea rdx, [rax + 0xf]
test rax, rax
cmovs rax, rdx
mov rdx, qword [r10 + 0x10]
sar rax, 4
lea rcx, [rax + 2]
cmp r10, qword [rbx + rax*8 + 0xb0]
je 0x1400055e0
mov rax, qword [r10 + 0x18]
mov qword [rax + 0x10], rdx
test rdx, rdx
je 0x1400055a6
mov rax, qword [r10 + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r10 + 8], 0x1000
pxor xmm0, xmm0
movaps xmmword [r10 + 0x10], xmm0
mov rdx, r10
mov rcx, r11
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp sym.freeBigChunk__system_5073
movups xmmword [rbx + 0x2978], xmm0
jmp 0x14000543c
mov qword [rbx + rcx*8 + 0xa0], rdx
test rdx, rdx
je 0x1400055a6
mov qword [rdx + 0x18], 0
jmp 0x1400055a6
Function at 0x140005600
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r13d, dword [0x1400707a8]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r12d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsi - 0x10]
lea r11, [rbx + 0xa0]
mov r10, rdx
and r10, 0xfffffffffffff000
mov rax, qword [r10 + 8]
sub qword [rbx + 0x2138], rax
cmp rax, 0xfc0
jle 0x140005740
lea rax, [rbx + 0x2978]
cmp qword [rbx + 0x2978], 0
movq xmm0, rax
punpcklqdq xmm0, xmm0
je 0x140005810
mov qword [rbx + 0x2950], rax
lea r8, [r10 + 0x20]
lea rdx, [rbx + 0x2948]
mov rcx, r11
call sym.del__system_4736
mov r8, qword [r10 + 8]
cmp r8, 0x3f000000
jle 0x1400057f7
mov rdx, r10
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rbx + rax*8 + 0x2148]
test rax, rax
jne 0x1400056c8
jmp 0x1400056f2
mov rax, qword [rax]
test rax, rax
je 0x1400056f2
cmp rdx, qword [rax + 8]
jne 0x1400056c0
mov rcx, r10
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r9, rcx
shl rdx, cl
sar r9, 6
not rdx
and qword [rax + r9*8 + 0x10], rdx
mov rax, qword [rbx + 0x2120]
mov rdx, qword [rbx + 0x2128]
mov rcx, r10
mov rsi, rax
sub rsi, r8
cmp rax, rdx
mov r8d, 0x8000
cmovl rax, rdx
movq xmm0, rsi
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rbx + 0x2120], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140005791
call sym.osDeallocPages__system_4300.part.0
nop dword [rax]
mov qword [rdx + 8], 0
mov rcx, qword [r10 + 0x20]
mov qword [rsi - 0x10], rcx
mov qword [r10 + 0x20], rdx
mov rdx, qword [r10 + 0x28]
cmp rax, rdx
jle 0x1400057a0
test rax, rax
lea rdx, [rax + 0xf]
cmovns rdx, rax
sar rdx, 4
add rdx, 2
mov rcx, qword [rbx + rdx*8 + 0xa0]
mov qword [r10 + 0x10], rcx
test rcx, rcx
je 0x140005785
mov qword [rcx + 0x18], r10
mov qword [rbx + rdx*8 + 0xa0], r10
add qword [r10 + 0x28], rax
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
add rdx, rax
mov qword [r10 + 0x28], rdx
cmp rdx, 0xfc0
jne 0x140005791
lea rdx, [rax + 0xf]
test rax, rax
cmovs rax, rdx
mov rdx, qword [r10 + 0x10]
sar rax, 4
lea rcx, [rax + 2]
cmp r10, qword [rbx + rax*8 + 0xb0]
je 0x140005820
mov rax, qword [r10 + 0x18]
mov qword [rax + 0x10], rdx
test rdx, rdx
je 0x1400057e6
mov rax, qword [r10 + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r10 + 8], 0x1000
pxor xmm0, xmm0
movaps xmmword [r10 + 0x10], xmm0
mov rdx, r10
mov rcx, r11
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp sym.freeBigChunk__system_5073
movups xmmword [rbx + 0x2978], xmm0
jmp 0x14000567c
mov qword [rbx + rcx*8 + 0xa0], rdx
test rdx, rdx
je 0x1400057e6
mov qword [rdx + 0x18], 0
jmp 0x1400057e6