joyce8/EMBER2024-capa huggingface dataset:
Function at 0x115c560
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x115c570
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rax, qword [0x039f4f20]
cmp byte [rax + 0x18], 0
jne 0x140d83b
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x115c595
mov rbx, qword [rax]
cmp byte [rax + 0x10], 0
jne 0x115c595
cmp byte [rax + 0x11], 0
jne 0x115c595
test rbx, rbx
je 0x115c595
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rbx + 0x38], 0
je 0x140d88f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x140d8e9
mov ecx, dword [rbx + 0x28]
test ecx, ecx
je 0x140d8de
sub ecx, 1
je 0x140d8c9
cmp ecx, 1
je 0x140d8b2
call fcn.0179a6f0
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140d8e9
mov ecx, 0xc10c0031
call fcn.0179ab40
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140d8e9
mov ecx, dword [rbx + 0x58]
call fcn.0179ab40
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140d8e9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
mov eax, edi
jmp 0x115c597

Function at 0x115c5b0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x40], 0
mov rax, qword [0x039f1180]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1413422
lea rbx, [rax + 0x20]
jmp 0x115c5e7
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x115c600
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
mov qword [rsp + 0x48], rax
test rbx, rbx
je 0x1413429
mov qword [rsp + 0x28], 0
cmp qword [rbx + 0x48], 0
jne 0x12223dd
jmp 0x115c61f
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x48]
call qword [rax + 0x78]
mov rax, qword [rsp + 0x28]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x60], 0
mov r8d, 0x138a
mov rdx, qword [rbx + 0x48]
lea rcx, [rsp + 0x60]
call fcn.0124d7c0
test eax, eax
js 0x1413435
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx + 0x50]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
jmp 0x115c61f
xor ebx, ebx
jmp 0x115c5e7
mov rax, 0xffffffffc1030001
jmp 0x115c633
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1413446
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
jmp 0x115c61f
Function at 0x115c640
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rdi, rcx
cmp byte [rcx + 0xb98], 0
jne 0x141293d
xor ebx, ebx
mov dword [rsp + 0x34], ebx
jmp 0x115c675
mov eax, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.0179a0b0
test al, al
jne 0x115c66d
cmp byte [rdi + 0xb99], al
je 0x1412979
xor ebx, ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], 0x5000000f
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov ecx, 0xc11c0003
call fcn.0124e580
mov dword [rsp + 0x34], eax
jmp 0x14129b0
xor ebx, ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], 0x5000000f
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov ecx, 0xc11c0001
call fcn.0124e580
mov dword [rsp + 0x34], eax
jmp 0x14129b0
call fcn.01348e60
test eax, eax
je 0x115c675
mov rax, qword [0x039f1180]
mov ecx, dword [rax + 8]
cmp ecx, 0xffffffff
je 0x115c675
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x115c675
mov rax, qword [rdi + 0x130]
test rax, rax
je 0x14129f2
lea rbx, [rax + 0x30]
test rbx, rbx
je 0x1412a00
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1412a0f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsi + 0x68], rbx
jmp 0x115c675

Function at 0x116c130
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x039f1188]
mov rbx, rcx
mov rdx, rcx
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140e4bd
mov rcx, rbx
call fcn.0116c190
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0xb8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0xc0], rax
add rsp, 0x30
pop rbx
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010000
mov qword [rsp + 0x20], 0x1000000f
call fcn.0124e580
nop
jmp 0x116c154
Function at 0x116c230
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov r12, rcx
mov ecx, dword [rcx + 8]
mov rdi, r9
cmp ecx, 0xffffffff
movzx ebp, r8b
mov rsi, rdx
je 0x140e882
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
mov qword [rsp + 0x40], rax
jne 0x140e8b8
test rdi, rdi
jne 0x140e8a7
test bpl, bpl
je 0x140e8ae
movzx r8d, byte [rsp + 0x60]
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.0116c2e0
test eax, eax
js 0x116c2be
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, rbx
call fcn.0116c130
jmp 0x116c2b3
test rsi, rsi
jne 0x140e8c9
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
lea r8, [0x0140e8e0]
lea rcx, [0x015807d0]
mov edx, 0x2b4
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
jmp fcn.017eea00
mov byte [rdi], al
jmp 0x116c27b
mov eax, 1
jmp 0x116c2be
test rdi, rdi
je 0x116c2b3
mov byte [rdi], 1
jmp 0x116c2b3
mov qword [rsi], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
nop
jmp 0x116c2bc

Function at 0x116df40
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x039f11b0]
xor ebx, ebx
cmp byte [rax + 0xbb5], bl
jne 0x141123d
mov dword [rsp + 0x20], 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x48
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x141125e
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
cmova rax, rcx
add rsp, 0x70
pop rbx
ret
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_VarI4FromDisp
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x141125e
mov rbx, qword [rsp + 0x48]
sub rbx, qword [rsp + 0x50]
mov rax, rbx
add rsp, 0x70
pop rbx
ret

Function at 0x116f7a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x039f4f20]
mov rdi, rcx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140d654
movzx ecx, byte [rbx + 0x10]
lea rax, [rbx + 0x10]
mov rbx, qword [rsp + 0x30]
mov byte [rdi], cl
mov byte [rax], 1
add rsp, 0x20
pop rdi
ret
mov rcx, qword [0x039f4f20]
add rcx, 0x48
call fcn.012d6670
mov rbx, rax
mov rdx, rax
mov rax, qword [0x039f4f20]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
jmp 0x116f7c8
Function at 0x1171470
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x039f1188]
test rax, rax
je 0x13dbe56
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x13dbe56
mov rax, qword [rax + 0xd8]
test rax, rax
je 0x13dbe56
mov rcx, qword [rax + 0xe8]
test rcx, rcx
je 0x13dbe56
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax + 0xc0]
mov rax, qword [0x039f11b0]
cmp qword [rax + 0x168], 0
jne 0x140e509
mov rax, qword [rax + 0x2058]
add rsp, 0x28
ret
mov rax, qword [rax + 0x168]
jmp 0x13dbe6b

Function at 0x1171f10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rax, [0x01171f00]
mov qword [rcx], rax
lea rax, [0x01171ca0]
mov qword [rcx], rax
cmp qword [rcx + 0x58], 0
je 0x1171f50
xor edx, edx
call fcn.01171d00
mov qword [rbx + 0x58], 0
mov rbx, qword [rbx + 0x60]
mov rax, qword [0x039f1188]
test rax, rax
je 0x1171f79
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1171f79
add rax, 0xe8
je 0x1171f79
mov qword [rax], rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1172300
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r13d, r9d
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
lea rax, [0x01171ca0]
mov qword [rcx], rax
add rcx, 8
xor edx, edx
lea r8d, [rdx + 0x50]
call sub.MSVCR80.dll_memset
mov rax, qword [0x039f1188]
test rax, rax
je 0x14199ac
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14199ac
add rax, 0xe8
je 0x14199ac
mov rcx, qword [rax]
jmp 0x117237c
mov qword [rdi + 0x60], rcx
mov r8, rbx
mov rdx, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.011724a0
nop
lea rax, [0x01171f00]
mov qword [rdi], rax
cmp qword [rdi + 0x58], 0
je 0x125b3c9
mov rax, qword [rdi + 0x68]
test rax, rax
je 0x1190329
mov rsi, qword [rax + 0x88]
test rsi, rsi
je 0x1419a3d
mov rax, qword [0x039f1180]
test rax, rax
je 0x14199c0
mov ecx, dword [rax + 8]
cmp ecx, 0xffffffff
je 0x14199c0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14199c0
call fcn.0115c5b0
mov rbp, rax
test rbx, rbx
je 0x14199b3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0xc0]
mov r12, rax
test rax, rax
je 0x14199b3
mov qword [rsp + 0x30], 0
lea rbx, [rsi + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.0109bfe0
nop
lea rcx, [rsi + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8d, r14d
mov rdx, r12
call fcn.01171a90
mov esi, eax
mov rcx, qword [rsp + 0x38]
add rcx, 0x10
mov qword [rdi + 0x78], rcx
test rbx, rbx
je 0x117246e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x14199b3
mov rax, rdi
jmp 0x117247b
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rax, rdi
jmp 0x117247b
mov rax, rdi
jmp 0x117247b
xor ecx, ecx
jmp 0x117237c
mov rcx, rbp
call fcn.0109c0c0
jmp 0x1172476
test rbx, rbx
je 0x1172476
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc0]
mov rbp, rax
test rax, rax
je 0x1172476
mov qword [rsp + 0x38], 0
lea rbx, [rsi + 0x18]
mov qword [rsp + 0x38], rbx
mov rcx, rbx
call fcn.0109bfe0
nop
lea rcx, [rsi + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8d, r14d
mov rdx, rbp
call fcn.01171a90
mov r11, qword [rsp + 0x30]
add r11, 0x10
mov qword [rdi + 0x78], r11
test rbx, rbx
je 0x1172476
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x1172476
mov rax, rdi
jmp 0x117247b
Function at 0x11724a0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx + 0x58], rdx
xor edx, edx
test r8, r8
mov rbx, rcx
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x78], rdx
je 0x11724d5
mov rax, qword [rcx + 0x60]
test rax, rax
je 0x11724d5
cmp r8, qword [rax + 0x80]
je 0x125b3c0
mov rcx, qword [rcx + 0x60]
test rcx, rcx
je 0x14196cc
mov rax, qword [rcx + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rcx + 0x70]
mov qword [rbx + 0x70], rax
cmp qword [rbx + 0x58], rdx
je 0x117252e
test rcx, rcx
je 0x14196d9
mov rdx, rbx
call fcn.01171d00
mov rax, qword [0x039f1188]
test rax, rax
je 0x117252e
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x117252e
add rax, 0xe8
je 0x117252e
mov qword [rax], rbx
add rsp, 0x30
pop rbx
ret
mov qword [rcx + 0x58], rdx
jmp 0x11724d5
mov qword [rbx + 0x68], rdx
mov qword [rbx + 0x70], rdx
jmp 0x11724f2
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
test eax, eax
jne 0x141972d
mov rcx, qword [rbx + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rax]
mov qword [rbx + 8], rcx
mov rcx, qword [rbx + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rax + 8]
mov qword [rbx + 0x10], rcx
jmp 0x1172509
mov rax, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
jmp 0x1172509
Function at 0x1174ef0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm6
mov rdi, r9
mov rbx, r8
mov rsi, rdx
movsd xmm6, xmm0
mov dword [rsp + 0x30], reloc.OLEAUT32.dll_VarI4FromDisp
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1411267
comisd xmm6, xmmword [0x0116a980]
mov rdx, qword [rsp + 0x58]
movsd xmm0, qword [0x01174e80]
jb 0x14112bb
comisd xmm0, xmm6
jb 0x14112bb
mov rax, qword [rsp + 0x38]
mov rcx, rdx
cmp rax, rdx
cmovb rcx, rax
test rcx, rcx
cvtsi2sd xmm0, rcx
js 0x1411287
mulsd xmm6, qword [0x0116a978]
movsd xmm1, qword [0x0116c6b8]
xor ecx, ecx
mulsd xmm0, xmm6
comisd xmm0, xmm1
ja 0x1411294
cvttsd2si rax, xmm0
add rax, rcx
jmp 0x1174f9b
sub rdx, rdi
cmp rax, rdx
cmova rax, rdx
cmp rax, rbx
cmovb rax, rbx
mov qword [rsi], rax
xor eax, eax
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010014
mov qword [rsp + 0x20], 0x1000000f
call fcn.0124e580
jmp 0x1174fb1
addsd xmm0, qword [0x01276eb8]
jmp 0x1174f71
subsd xmm0, xmm1
movabs rax, 0x7fffffffffffffff
mov rcx, rax
comisd xmm0, xmm1
jbe 0x1174f91
subsd xmm0, xmm1
add rcx, rax
jmp 0x1174f91
comisd xmm6, xmm0
jbe 0x14112fc
movsd xmm0, qword [0x0116c6b8]
xor ecx, ecx
comisd xmm6, xmm0
jbe 0x14112ef
subsd xmm6, xmm0
movabs rax, 0x7fffffffffffffff
mov rcx, rax
comisd xmm6, xmm0
jbe 0x14112ef
subsd xmm6, xmm0
add rcx, rax
cvttsd2si rax, xmm6
add rax, rcx
jmp 0x1174f9b
xor eax, eax
jmp 0x1174f9b
Function at 0x11784d0
Capabilities:
Get memory capacity
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x039f11b0]
xor ebx, ebx
mov edi, ecx
cmp byte [rax + 0xbb5], bl
jne 0x141141a
mov dword [rsp + 0x20], 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x48
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x1178527
mov rbx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x30]
cmp rax, rbx
cmova rbx, rax
cmp rbx, qword [0x039f4f10]
jae 0x1411444
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_VarI4FromDisp
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1178527
mov rbx, qword [rsp + 0x48]
sub rbx, qword [rsp + 0x50]
jmp 0x1178527
xor edx, edx
mov ecx, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
jmp fcn.01820a10

Function at 0x1179b20
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x039f1188]
mov rbx, rcx
test rax, rax
je 0x1179b5c
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1179b5c
add rax, 0xe8
je 0x1179b5c
mov rax, qword [rax]
test rax, rax
je 0x1179b5c
add qword [rax + 0x28], 1
add qword [rax + 0x18], rbx
add rsp, 0x20
pop rbx
ret
Function at 0x11920a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbx, rcx
mov rdi, qword [rcx + 0x248]
test rdi, rdi
jne 0x134f9dd
mov rdi, qword [rbx + 0x98]
mov rcx, qword [rbx + 0x238]
test rcx, rcx
je 0x1192104
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov rax, qword [rdi]
mov rdx, qword [rbx + 0x238]
mov rcx, rdi
call qword [rax + 0x28]
mov qword [rbx + 0x238], 0
mov rsi, qword [rbx + 0x88]
mov rax, qword [rbx + 0x270]
test rax, rax
jne 0x1534fdb
lea rcx, [rbx + 0x248]
call fcn.01192180
lea rcx, [rbx + 0x3b8]
call fcn.0116d9d0
lea rcx, [rbx + 0x3c0]
call fcn.0116d9d0
mov rcx, qword [rbx + 0x240]
test rcx, rcx
jne 0x13909ef
lea rcx, [rbx + 0x110]
call fcn.011726c0
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rdi, qword [rdi + 0x68]
test rdi, rdi
je 0x11920cf
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0xd8]
cmp eax, 0x29812
jne 0x11920cf
mov rax, qword [0x039f1188]
test rax, rax
je 0x134fa56
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x134fa56
mov rcx, rax
call fcn.01173310
mov rbp, rax
mov rcx, rsi
call fcn.011732b0
mov rcx, rbp
lock xadd qword [rbx + 0x2f0], rcx
mov rcx, qword [rbx + 0xe8]
test rcx, rcx
je 0x134fa56
mov r8, qword [rcx]
mov rdx, rbp
call qword [r8 + 0x3d0]
mov rax, qword [rbx + 0x2f0]
lock xadd qword [rdi + 0x228], rax
jmp 0x11920cf
mov qword [rbx + 0x240], 0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
jmp 0x119214f
lea rbp, [rax - 8]
mov rdi, qword [rbp]
add rdi, 0xffffffffffffffff
js 0x153500b
nop
nop
mov rax, qword [rbx + 0x270]
lea rcx, [rax + rdi*8]
mov qword [rsp + 0x50], rcx
call fcn.0116a920
sub rdi, 1
jns 0x1534ff0
mov rax, qword [rsi]
mov rdx, rbp
mov rcx, rsi
call qword [rax + 0x28]
mov qword [rbx + 0x270], 0
jmp 0x119211b
Function at 0x11ce090
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, r9
mov rsi, r8
mov r13, rdx
mov rdi, rcx
xor r12d, r12d
mov qword [rax - 0x28], r12
mov rax, qword [0x039f1180]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14cbdfb
lea r14, [rax + 0x20]
jmp 0x11ce0e8
mov qword [rsp + 0x50], r14
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x20], rbx
mov r9, qword [r14 + 0x10]
lea r8, [rsp + 0x38]
mov rdx, r13
mov rcx, rdi
call fcn.011cd680
mov dword [rsp + 0x34], eax
test eax, eax
js 0x14cbe03
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14cbe08
cmp eax, 0x1000001
je 0x14cbe15
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x11ce21a
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rsi
mov rcx, rdi
call fcn.011cde10
mov dword [rsp + 0x34], eax
test eax, eax
js 0x14cbe1e
cmp eax, 0x1000001
jne 0x11ce210
mov dword [rsp + 0x34], eax
jmp 0x11ce180
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x11ce1e2
mov rdi, r12
cmp qword [r13 + 0x68], 0
jle 0x11ce1ce
mov rsi, r12
nop
nop
nop
lea rbx, [rsi + rdx]
mov rcx, rbx
call fcn.0119aa30
test eax, eax
js 0x11ce1b7
mov byte [rbx + 8], 0
mov qword [rbx], r12
add rdi, 1
add rsi, 9
cmp rdi, qword [r13 + 0x68]
jl 0x14cbe4d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [r14 + 0x10]
test rdx, rdx
je 0x11ce1e2
mov rax, qword [rcx]
call qword [rax + 0x28]
mov qword [rsp + 0x38], r12
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x58]
call qword [rax + 0x78]
mov eax, dword [rsp + 0x34]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
mov dword [rsp + 0x34], r12d
jmp 0x11ce180
mov rax, qword [rbx + 0x240]
jmp 0x11ce150
mov r14, r12
jmp 0x11ce0e8
jmp 0x11ce180
mov dword [rsp + 0x34], 0x1000001
jmp 0x11ce180
mov dword [rsp + 0x34], eax
jmp 0x11ce180
jmp 0x11ce180
mov rdx, qword [rsp + 0x38]
jmp 0x11ce1a0
Function at 0x11f91f0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
mov edx, eax
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
mov qword [rsp + 0xa8], rax
cmp rax, 0xffffffffffffffff
je 0x11f937f
mov qword [rsp + 0xb0], rax
xor edi, edi
mov qword [rsp + 0x28], rdi
xor esi, esi
mov qword [rsp + 0x30], rsi
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], 0x1c
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x11f9317
nop
cmp dword [rsp + 0x4c], r15d
je 0x11f929a
lea rdx, [rsp + 0x40]
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x11f930f
jmp 0x11f9280
mov r13d, dword [rsp + 0x48]
cmp rbx, rsi
jae 0x11f92b3
mov dword [rdi + rbx*4], r13d
add rbx, 1
mov qword [rsp + 0x38], rbx
jmp 0x11f9287
lea r12, [rsi + 0x100]
lea r14, [r12*4]
mov rcx, r14
call qword [sym.imp.MSVCR80.dll_malloc]
mov rbp, rax
test rax, rax
je 0x11f92ec
test rdi, rdi
jne 0x140d47c
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rsi, r12
mov qword [rsp + 0x30], r12
cmp rbx, rsi
jae 0x140d4c3
mov dword [rdi + rbx*4], r13d
add rbx, 1
mov qword [rsp + 0x38], rbx
mov rbp, qword [rsp + 0xa8]
jmp 0x11f9287
mov r12, qword [rsp + 0xa0]
lea rsi, [r12 + 0x28]
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x11f9367
xor eax, eax
test rbx, rbx
je 0x11f9340
mov edx, dword [rcx + 0x18]
nop
cmp dword [rdi + rax*4], edx
je 0x11f9397
add rax, 1
cmp rax, rbx
jb 0x11f9330
jmp 0x11f9340
mov rax, qword [rcx + 0x20]
mov qword [rsi + 0x20], rax
mov r8, rcx
xor edx, edx
mov rcx, qword [r12 + 0x60]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add qword [r12 + 0x50], 0xffffffffffffffff
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x11f9325
test rdi, rdi
je 0x11f9376
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rsi, rcx
jmp 0x11f935e
lea r9, [rbx*4]
mov r8, rdi
mov rdx, r14
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_memcpy_s]
test eax, eax
jne 0x140d4b5
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
mov rdi, rbp
mov qword [rsp + 0x28], rbp
mov rsi, r12
mov qword [rsp + 0x30], r12
jmp 0x11f92ec
mov rcx, rbp
call qword [sym.imp.MSVCR80.dll_free]
jmp 0x11f92ec
test rdi, rdi
je 0x140d4d2
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_free]
nop
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x11f937f