joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a870
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x14006a960
mov r14, rcx
mov rcx, qword [rdx]
xor edi, edi
xor esi, esi
or rsi, qword [rcx + rdi*8]
inc rdi
cmp rax, rdi
jne 0x14006a890
test rsi, rsi
je 0x14006a960
test eax, eax
jle 0x14006a985
test byte [rcx], 1
je 0x14006a985
cmp dword [rdx + 0x10], 0
jne 0x14006a9be
lea rdi, [r14 + 0x18]
mov rcx, rdi
call fcn.1400cd3b0
test rax, rax
je 0x14006a9de
mov eax, dword [r14 + 0x20]
test eax, eax
jle 0x14006a9a5
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
mov rax, rcx
je 0x14006a8d9
inc ecx
mov dword [r14 + 0x20], ecx
mov rax, qword [rdi]
mov r9, qword [rax]
mov ebx, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov esi, ebx
and esi, 1
neg rsi
mov rax, r9
and rax, rsi
mov rdi, rax
xor rdi, rbx
shr rdi, 1
and rax, rbx
add rax, rdi
and rsi, r8
shr rcx, 1
or rcx, rsi
mov rbx, rax
dec rdx
jne 0x14006a915
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dword [rsp + 0x20], 0xa5
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1400cc8a0
jmp 0x14006a954
mov dword [rsp + 0x20], 0xa9
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14006a97e
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14006a8f9
mov dword [r14 + 0x28], 0
jmp 0x14006a8f9
mov dword [rsp + 0x20], 0xad
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14006a97e
mov dword [rsp + 0x20], 0xb3
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14006a97e

Function at 0x14006bfd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x14006c03e
xor r11d, r11d
mov r14, qword [r8 + r11*8]
mov r15, qword [rcx + r11*8]
mov rbx, r15
xor rbx, r14
mov edi, eax
lea rax, [rbx - 1]
mov rsi, r15
sub rsi, r14
xor rsi, r15
or rsi, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor rsi, r15
sar rsi, 0x3f
mov rbx, rsi
not rsi
and esi, 1
or rsi, rbx
mov rbx, rax
and edi, ebx
not rax
and rax, rsi
or rax, rdi
inc r11
cmp r10, r11
jne 0x14006bfeb
cmp rdx, r9
jb 0x14006c077
cmp r9, rdx
jae 0x14006c0a1
xor esi, esi
or rsi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14006c04a
mov rcx, rsi
not rcx
dec rsi
and rsi, rcx
sar rsi, 0x3f
mov rcx, rsi
and ecx, eax
not rsi
and esi, 1
or esi, ecx
mov eax, esi
jmp 0x14006c0a1
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x14006c079
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400703c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140184610]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007041c
movzx eax, word [0x1401845e0]
cmp ax, 9
jne 0x14007047e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140184610]
call fcn.14008d354
cmp dword [0x140184610], 0xffffffff
jne 0x1400703f5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x140184600], xmm2
movups xmmword [0x1401845f0], xmm1
movups xmmword [0x1401845e0], xmm0
lea rcx, [0x140184610]
call fcn.14008d2f4
jmp 0x1400703f5
cmp ax, 5
jg 0x14007049f
xor esi, esi
test ax, ax
je 0x140070407
cmp ax, 5
jne 0x1400704bf
mov esi, 3
jmp 0x140070407
cmp ax, 6
jne 0x1400704af
mov esi, 2
jmp 0x140070407
cmp ax, 0xc
jne 0x1400704bf
mov esi, 4
jmp 0x140070407
mov esi, 5
jmp 0x140070407

Function at 0x1400704d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x14014bd30]
mov qword [rsp + 0x20], rax
lea rcx, [0x14018a268]
lea rdx, [0x14014bd20]
lea r8, [rsp + 0x20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140070564
cmp dword [0x14018a270], 0
jne 0x140070560
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x14018a274]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140070560
movsxd rax, esi
mov rsi, qword [rdi + rax*8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008fec0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x140070548
call fcn.14008d5e0
int3
Function at 0x140086fc0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x14008700d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
add rax, 1
cmp rax, 2
jae 0x140087018
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140086ffb
mov qword [rdi], rsi
call fcn.140041560
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140041560
mov r14, qword [rdi]
mov rcx, qword [0x140184a28]
test rcx, rcx
je 0x14008703d
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rdi], 0
jmp 0x140086fe9
call fcn.1400c7320
mov rcx, qword [0x140184a28]
jmp 0x14008702c

Function at 0x140087820
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov edi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x50], r13
movaps xmm6, xmmword [0x14015c320]
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x88
call fcn.140048d60
xor esi, esi
mov rcx, rbx
mov rdx, r12
xor r8d, r8d
call fcn.140048d80
test edi, edi
js 0x14008796a
lea rbx, [rsp + 0x40]
mov dword [rbx], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, edi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rbx]
test byte [0x14017ff80], 0x19
jne 0x140087928
lea rcx, [rsp + 0x60]
call fcn.140046d50
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x14017ff80]
lea r9, [0x1401639a1]
mov rcx, rdi
mov dl, 0x45
call fcn.14003a350
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400878f1
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400878f1
mov esi, 0xffffffff
jmp 0x1400878e8
Function at 0x1400879d0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jae 0x140087a4d
cmp qword [rsi], rbx
je 0x140087a27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140087a54
cmp rbp, 2
jb 0x140087a1e
mov qword [rsi], rbx
call fcn.140041560
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140087a87
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140041560
jmp 0x1400879f6
call fcn.140041560
mov r14, qword [rsi]
mov rcx, qword [0x140184a28]
test rcx, rcx
je 0x140087a79
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140087a10
call fcn.1400c7320
mov rcx, qword [0x140184a28]
jmp 0x140087a68
call fcn.140041560
mov rbx, qword [rdi]
mov rcx, qword [0x140184a28]
test rcx, rcx
je 0x140087aac
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rdi], 0
jmp 0x140087a3d
call fcn.1400c7320
mov rcx, qword [0x140184a28]
jmp 0x140087a9b

Function at 0x140087cc6
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
test edx, edx
jne 0x140087d75
mov ecx, pe_nt_image_headers64
call fcn.14008d2b8
mov rdi, rax
lea rax, [0x14015b050]
mov qword [rdi], rax
lea rax, [0x1400d3450]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14018a260]
lea rdx, [0x14014bd20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140087d79
xorps xmm0, xmm0
movups xmmword [rdi + 0x64], xmm0
movups xmmword [rdi + 0x58], xmm0
movups xmmword [rdi + 0x48], xmm0
movups xmmword [rdi + 0x38], xmm0
movups xmmword [rdi + 0x28], xmm0
movaps xmm0, xmmword [0x140167aa0]
movups xmmword [rdi + 8], xmm0
movaps xmm0, xmmword [0x140167ab0]
movups xmmword [rdi + 0x18], xmm0
mov dword [rdi + 0x74], 0x20
mov qword [rsi], rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008fec0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x140087d5b
call fcn.14008d5e0
int3
Function at 0x140089bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x140089c5f
mov rax, r8
shr rax, 2
mov rdx, r9
not rdx
add rdx, r10
jne 0x140089bf7
xor edx, edx
jmp 0x140089c3c
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x1401702b0]
nop word [rax + rax]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x140089c10
test r8b, 1
je 0x140089c59
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x1401702b0]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140089c59

Function at 0x140089e00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
mov rdi, qword [0x1401882e8]
cmp rdi, 1
jbe 0x140089e50
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140089e96
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401882e8]
call fcn.140055e00
test al, al
je 0x140089ea2
mov qword [0x1401882f0], 0
lea rbx, [0x1401882e8]
lea rdi, [0x1401882f0]
mov rcx, rdi
xor edx, edx
call fcn.1400421b0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140055de0
jmp 0x140089e1a
test rsi, rsi
je 0x140089e45
call fcn.1400074b0
jmp 0x140089e2c
mov rdi, qword [0x1401882e8]
jmp 0x140089e1a

Function at 0x140089f00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x140188314]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x140089f2d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140089f23
Function at 0x140089f40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x14014bd30]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14018a268]
lea rdx, [0x14014bd20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14008a019
cmp dword [0x14018a270], 0
jne 0x140089fde
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [0x14018a274]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x140089fde
mov rsi, qword [rsi]
test rsi, rsi
je 0x140089fde
mov eax, dword [rsi + 0x204]
xor edi, edi
cmp eax, dword [rsi + 0x200]
jne 0x14008a01e
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008fec0
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 0x210
call fcn.14006b210
test rax, rax
je 0x14008a02d
mov rsi, rax
xor edi, edi
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.1400924f0
lea r8, [0x14014b7f0]
xor ecx, ecx
mov rdx, rsi
call fcn.1400c3ab0
test eax, eax
jne 0x140089fb8
jmp 0x140089fc8
call fcn.14008d5e0
inc eax
and eax, 0xf
shl rax, 5
mov edi, dword [rsi + rax + 0x10]
jmp 0x140089fc8
xor edi, edi
jmp 0x140089fc8

Function at 0x14008a040
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x140189d10]
cmp rdi, 1
jbe 0x14008a08f
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008a0d5
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140189d10]
call fcn.140055e00
test al, al
je 0x14008a0e1
mov qword [0x140189d18], 0
lea rbx, [0x140189d10]
lea rdi, [0x140189d18]
mov rcx, rdi
xor edx, edx
call fcn.1400421b0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140055de0
jmp 0x14008a059
test rsi, rsi
je 0x14008a084
call fcn.1400074b0
jmp 0x14008a06b
mov rdi, qword [0x140189d10]
jmp 0x14008a059

Function at 0x14008a0f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140189d10]
cmp rsi, 1
jbe 0x14008a139
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008a132
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140189d10]
call fcn.140055e00
test al, al
je 0x14008a17f
mov qword [0x140189d18], 0
lea rdi, [0x140189d10]
lea rsi, [0x140189d18]
mov rcx, rsi
xor edx, edx
call fcn.1400421b0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140055de0
jmp 0x14008a103
mov rsi, qword [0x140189d10]
jmp 0x14008a103
Function at 0x14008b270
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14018a318]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008b2d5
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008b311
movsxd rcx, dword [0x14018a310]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14018a314]
movsxd rdx, dword [0x14018a310]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14018a318]
call fcn.14008d354
cmp dword [0x14018a318], 0xffffffff
jne 0x14008b299
mov qword [0x14018a310], 0
lea rcx, [0x14018a310]
xor edx, edx
call fcn.1400421b0
lea rcx, [0x14018a318]
call fcn.14008d2f4
jmp 0x14008b299
test rsi, rsi
je 0x14008b2cf
call fcn.1400074b0
jmp 0x14008b2ab

Function at 0x14008b340
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x14018a2ec], eax
mov dword [rcx + 4], eax
mov eax, dword [0x14018a2e8]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008b429
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008b4af
movsxd rcx, dword [0x14018a2e0]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14018a2e4]
movsxd rdx, dword [0x14018a2e0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14018a2f8]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008b46c
lea rdi, [rsi + 4]
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008b4c2
movsxd rcx, dword [0x14018a2f0]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x14018a2f4]
movsxd rdx, dword [0x14018a2f0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14018a2e8]
call fcn.14008d354
cmp dword [0x14018a2e8], 0xffffffff
jne 0x14008b382
mov qword [0x14018a2e0], 0
lea rcx, [0x14018a2e0]
xor edx, edx
call fcn.1400421b0
lea rcx, [0x14018a2e8]
call fcn.14008d2f4
jmp 0x14008b382
lea rcx, [0x14018a2f8]
call fcn.14008d354
cmp dword [0x14018a2f8], 0xffffffff
jne 0x14008b3e1
mov qword [0x14018a2f0], 0
lea rcx, [0x14018a2f0]
xor edx, edx
call fcn.1400421b0
lea rcx, [0x14018a2f8]
call fcn.14008d2f4
jmp 0x14008b3e1
test rsi, rsi
je 0x14008b3bc
call fcn.1400074b0
jmp 0x14008b398
test rdi, rdi
je 0x14008b41f
call fcn.1400074b0
jmp 0x14008b3fb
Function at 0x14008b4e0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x14018a300]
cmp rbx, 1
jbe 0x14008b534
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008b57a
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14018a300]
call fcn.140055e00
test al, al
je 0x14008b586
mov qword [0x14018a308], 0
lea r14, [0x14018a300]
lea rbx, [0x14018a308]
mov rcx, rbx
xor edx, edx
call fcn.1400421b0
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.140055de0
jmp 0x14008b4fc
test rdi, rdi
je 0x14008b527
call fcn.1400074b0
jmp 0x14008b50e
mov rbx, qword [0x14018a300]
jmp 0x14008b4fc

Function at 0x14008b5a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14018a300]
cmp rsi, 1
jbe 0x14008b5e9
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008b5e2
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14018a300]
call fcn.140055e00
test al, al
je 0x14008b62f
mov qword [0x14018a308], 0
lea rdi, [0x14018a300]
lea rsi, [0x14018a308]
mov rcx, rsi
xor edx, edx
call fcn.1400421b0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140055de0
jmp 0x14008b5b3
mov rsi, qword [0x14018a300]
jmp 0x14008b5b3

Function at 0x14008b6a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14018a2e8]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008b767
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008b703
movsxd rcx, dword [0x14018a2e0]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14018a2e4]
movsxd rdx, dword [0x14018a2e0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14018a2f8]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008b7aa
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14008b762
movsxd rcx, dword [0x14018a2f0]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14018a2f4]
movsxd rdx, dword [0x14018a2f0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
ret
lea rcx, [0x14018a2e8]
call fcn.14008d354
cmp dword [0x14018a2e8], 0xffffffff
jne 0x14008b6c9
mov qword [0x14018a2e0], 0
lea rcx, [0x14018a2e0]
xor edx, edx
call fcn.1400421b0
lea rcx, [0x14018a2e8]
call fcn.14008d2f4
jmp 0x14008b6c9
lea rcx, [0x14018a2f8]
call fcn.14008d354
cmp dword [0x14018a2f8], 0xffffffff
jne 0x14008b728
mov qword [0x14018a2f0], 0
lea rcx, [0x14018a2f0]
xor edx, edx
call fcn.1400421b0
lea rcx, [0x14018a2f8]
call fcn.14008d2f4
jmp 0x14008b728
Function at 0x14009ad7c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14009aea0
Function at 0x1400ba3c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, dword [0x140188314]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test edi, edi
jne 0x1400ba3f7
cmp rsi, 2
jb 0x1400ba401
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140042d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400ba3e3
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400bad50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140188278]
cmp rdi, 1
jbe 0x1400badb5
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bad96
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
lea rcx, [rsi + 8]
call fcn.140041f90
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400badad
lock dec dword [rcx + 8]
je 0x1400bae0a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140188278]
call fcn.140055e00
test al, al
je 0x1400badfe
mov qword [0x140188280], 0
lea rbx, [0x140188278]
lea rdi, [0x140188280]
mov rcx, rdi
xor edx, edx
call fcn.1400421b0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140055de0
jmp 0x1400bad67
mov rdi, qword [0x140188278]
jmp 0x1400bad67
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140042060

Function at 0x1400bae30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400bae45
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret