joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e3cc0780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x2e3cc0972
test rdx, rdx
je 0x2e3cc0972
lea rdx, [rsp + 0x28]
lea rcx, [rcx + 0x20]
call fcn.2e3d40c30
mov r12d, eax
test eax, eax
jne 0x2e3cc08fc
mov rdi, qword [rsp + 0x28]
movzx eax, di
cmp eax, dword [rbx + 4]
jae 0x2e3cc0953
movzx eax, di
movdqu xmm0, xmmword [rsi]
lea rdx, [rax + rax*2]
lea rax, [rax + rdx*4]
mov rdx, qword [rbx + 0x48]
shl rax, 3
movups xmmword [rdx + rax], xmm0
movdqu xmm1, xmmword [rsi + 0x10]
movups xmmword [rdx + rax + 0x10], xmm1
movdqu xmm2, xmmword [rsi + 0x20]
movups xmmword [rdx + rax + 0x20], xmm2
movdqu xmm3, xmmword [rsi + 0x30]
movups xmmword [rdx + rax + 0x30], xmm3
movdqu xmm4, xmmword [rsi + 0x40]
movups xmmword [rdx + rax + 0x40], xmm4
movdqu xmm5, xmmword [rsi + 0x50]
movups xmmword [rdx + rax + 0x50], xmm5
mov rcx, qword [rsi + 0x60]
mov qword [rdx + rax + 0x60], rcx
mov rdx, qword [rbx + 0x48]
mov qword [rdx + rax], rdi
movzx ecx, word [rsi]
mov rdx, qword [rbx + 0x48]
mov word [rdx + rax], cx
mov rdx, qword [rbx + 0x48]
mov ecx, 1
mov qword [rdx + rax + 8], 0xffffffffffffffff
lea rdx, [rbx + 0x50]
nop word [rax + rax]
mov eax, ecx
xchg dword [rdx], eax
test eax, eax
je 0x2e3cc086b
nop dword [rax + rax]
mov eax, dword [rdx]
cmp eax, 1
jne 0x2e3cc0850
pause
jmp 0x2e3cc0860
movabs r11, 0xffffffff0000ffff
lea r9, [rbx + 0x10]
nop dword [rax]
mov r8, qword [r9]
movzx edx, r8w
lea rax, [rdx + rdx*2]
lea rdx, [rdx + rax*4]
shl rdx, 3
mov rcx, qword [rbx + 0x48]
mov r10, qword [rcx + rdx + 8]
mov rcx, qword [r9]
xor rcx, r8
test rcx, r11
jne 0x2e3cc0880
cmp r10w, 0xffff
jne 0x2e3cc0910
mov rcx, r10
mov eax, dword [rsp + 0x28]
mov rdi, qword [rbx + 0x48]
shr rcx, 0x20
add ecx, 1
shl rcx, 0x20
or rcx, rax
mov rax, r10
lock cmpxchg qword [rdi + rdx + 8], rcx
jne 0x2e3cc0880
mov rdx, r8
mov eax, dword [rsp + 0x28]
shr rdx, 0x20
add edx, 1
shl rdx, 0x20
or rdx, rax
mov rax, r8
lock cmpxchg qword [r9], rdx
mov dword [rbx + 0x50], 0
test byte [rbx], 1
je 0x2e3cc0932
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
mov rax, r8
movzx r10d, r10w
shr rax, 0x20
lea edx, [rax + 1]
mov rax, r8
shl rdx, 0x20
or rdx, r10
lock cmpxchg qword [r9], rdx
jmp 0x2e3cc0880
xor r8d, r8d
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x2e3cc08fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r12d, r12d
jmp 0x2e3cc08fc
mov r8d, 0x4208
lea rdx, [0x2e3edbe60]
lea rcx, str.ma_job_extract_slot_slot____pQueue__capacity
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x2e3cc07cb
mov r12d, 0xfffffffe
jmp 0x2e3cc08fc
Function at 0x2e3cef8e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp qword [rsp + 0xc0], 0
mov rbp, rdx
mov r12, r8
mov rdi, r9
je 0x2e3cef913
mov rax, qword [rsp + 0xc0]
mov qword [rax], 0
test rbp, rbp
je 0x2e3cefa92
test r12, r12
je 0x2e3cefa92
mov r14, qword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
lea r15, [rsp + 0x4c]
test rdi, rdi
jne 0x2e3cef959
jmp 0x2e3cef9a8
mov edx, dword [rsp + 0x4c]
add rsi, rdx
cmp ebx, edx
ja 0x2e3cef9a8
test r8d, r8d
je 0x2e3cef9d8
cmp rdi, rsi
jbe 0x2e3cef9a8
mov rbx, rdi
mov eax, 0xffffffff
lea rdx, [r12 + rsi]
mov r9, r15
mov qword [rsp + 0x20], 0
sub rbx, rsi
mov rcx, rbp
cmp rbx, rax
cmova rbx, rax
mov r8d, ebx
call r14
mov r8d, eax
cmp eax, 1
jne 0x2e3cef940
mov eax, dword [rsp + 0x4c]
test eax, eax
je case.0x2e3cef9fd.38
mov edx, eax
add rsi, rdx
cmp ebx, eax
jbe 0x2e3cef954
nop dword [rax]
xor r8d, r8d
cmp qword [rsp + 0xc0], 0
je 0x2e3cef9c1
mov rax, qword [rsp + 0xc0]
mov qword [rax], rsi
mov eax, r8d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x3c], r8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
ja case.default.0x2e3cef9fd
lea rdx, [0x2e3ee0a7c]
mov eax, eax
mov r8d, dword [rsp + 0x3c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov r8d, 0xffffffde
cmp eax, 0x79
je case.0x2e3cef9fd.0
jbe 0x2e3cefa22
cmp eax, 0x83
mov r8d, 0xffffffff
mov eax, 0xffffffe7
cmove r8d, eax
jmp case.0x2e3cef9fd.0
mov r8d, 0xfffffffe
cmp eax, 0x57
je case.0x2e3cef9fd.0
cmp eax, 0x70
mov r8d, 0xffffffff
mov eax, 0xffffffee
cmove r8d, eax
jmp case.0x2e3cef9fd.0
mov r8d, 0xffffffff
jmp case.0x2e3cef9fd.0
mov r8d, 0xffffffef
jmp case.0x2e3cef9fd.0
mov r8d, 0xfffffff9
jmp case.0x2e3cef9fd.0
mov r8d, 0xfffffffc
jmp case.0x2e3cef9fd.0
mov r8d, 0xfffffffa
jmp case.0x2e3cef9fd.0
mov r8d, 0xfffffff7
jmp case.0x2e3cef9fd.0
mov r8d, 0xfffffffe
jmp 0x2e3cef9c1
Function at 0x2e3d128a0
Capabilities:
Read file on windows

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov r12, rcx
test rax, rax
je 0x2e3d12918
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jb 0x2e3d128e0
mov dword [r12 + 0x80], 1
mov dword [r12 + 0x84], 0x1e
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, [rax + 1]
mov qword [r12 + 0x28], rcx
cmp byte [rax], 0x4f
jne 0x2e3d128c7
cmp rdx, rcx
jbe 0x2e3d128bb
lea rax, [rcx + 1]
mov qword [r12 + 0x28], rax
cmp byte [rcx], 0x67
jne 0x2e3d128c7
cmp rdx, rax
jbe 0x2e3d128bb
lea rdx, [rax + 1]
mov qword [r12 + 0x28], rdx
movzx eax, byte [rax]
jmp 0x2e3d12974
mov rcx, qword [rcx + 0x18]
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
je 0x2e3d128bb
cmp al, 0x4f
jne 0x2e3d128c7
mov rcx, qword [r12 + 0x28]
test rcx, rcx
jne 0x2e3d129f9
mov rcx, qword [r12 + 0x18]
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
je 0x2e3d128bb
cmp al, 0x67
jne 0x2e3d128c7
mov rax, qword [r12 + 0x28]
test rax, rax
jne 0x2e3d12a03
mov rcx, qword [r12 + 0x18]
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
je 0x2e3d128bb
cmp al, 0x67
jne 0x2e3d128c7
mov rcx, r12
call fcn.2e3d12690
cmp al, 0x53
jne 0x2e3d128c7
mov rax, qword [r12 + 0x28]
test rax, rax
je 0x2e3d129e8
cmp rax, qword [r12 + 0x38]
jb 0x2e3d129c0
mov dword [r12 + 0x80], 1
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.2e3d40100
lea rdx, [rax + 1]
mov qword [r12 + 0x28], rdx
movzx eax, byte [rax]
test al, al
je 0x2e3d129a9
mov dword [r12 + 0x84], 0x1f
xor eax, eax
add rsp, 0x20
pop r12
ret
mov rcx, qword [r12 + 0x18]
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
jne 0x2e3d129cc
jmp 0x2e3d1299d
mov rdx, qword [r12 + 0x38]
jmp 0x2e3d128ee
mov rdx, qword [r12 + 0x38]
jmp 0x2e3d12901
Function at 0x2e3d25aa0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov edi, edx
lea rdx, [0x2e3ee32a9]
mov rcx, r8
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x2e3d25d08
xor edx, edx
mov r8d, 2
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rcx, r12
call sub.msvcrt.dll_ftell
mov rcx, r12
movsxd rbx, eax
call sub.msvcrt.dll_rewind
cmp ebx, 0xffffffff
je 0x2e3d25cb8
lea ecx, [rbx + 1]
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x2e3d25d69
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
cmp rbx, rax
ja 0x2e3d25bb0
mov rcx, r12
call sub.msvcrt.dll_fclose
cmp rbx, 0x3b
jbe 0x2e3d25b5d
movabs rax, 0x3a656c75646f4d20
xor rax, qword [r13 + 8]
movabs rdx, 0x6465646e65747845
xor rdx, qword [r13]
or rax, rdx
je 0x2e3d25c10
mov rcx, r13
call sub.msvcrt.dll_free
mov rbx, qword [fcn.2e3e58d50]
mov ecx, 2
call rbx
lea rdx, str.could_not_create_context:_module_is_not_sane_n
mov rcx, rax
call fcn.2e3c89790
mov ecx, 2
call rbx
mov rcx, rax
call sub.msvcrt.dll_fflush
mov qword [rsi], 0
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
lea r12, str.fread___failed
call sub.msvcrt.dll_fclose
mov rbx, qword [fcn.2e3e58d50]
mov ecx, 2
call rbx
mov rdx, r12
mov rcx, rax
call fcn.2e3c89790
mov ecx, 2
call rbx
mov rcx, rax
call sub.msvcrt.dll_fflush
mov rcx, r13
call sub.msvcrt.dll_free
mov eax, 5
mov qword [rsi], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
cmp byte [r13 + 0x10], 0x20
jne 0x2e3d25b5d
cmp byte [r13 + 0x25], 0x1a
jne 0x2e3d25b5d
cmp byte [r13 + 0x3b], 1
jne 0x2e3d25b5d
cmp byte [r13 + 0x3a], 4
jne 0x2e3d25b5d
mov r9d, edi
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.2e3d50e40
mov rcx, r13
mov dword [rsp + 0x2c], eax
call sub.msvcrt.dll_free
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x2e3d25b9d
js 0x2e3d25d4c
cmp eax, 1
je 0x2e3d25b65
cmp eax, 2
jne 0x2e3d25d4c
mov ecx, 2
mov rbx, qword [fcn.2e3e58d50]
call rbx
lea rdx, str.could_not_create_context:_malloc_failed_n
mov rcx, rax
call fcn.2e3c89790
mov ecx, 2
call rbx
mov rcx, rax
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop dword [rax + rax]
mov rcx, r12
call sub.msvcrt.dll_fclose
mov rbx, qword [fcn.2e3e58d50]
mov ecx, 2
call rbx
lea rdx, str.fseek___failed
mov rcx, rax
call fcn.2e3c89790
mov ecx, 2
call rbx
mov rcx, rax
call sub.msvcrt.dll_fflush
mov eax, 4
mov qword [rsi], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rbx, qword [fcn.2e3e58d50]
mov ecx, 2
call rbx
lea rdx, str.Could_not_open_input_file
mov rcx, rax
call fcn.2e3c89790
mov ecx, 2
call rbx
mov rcx, rax
call sub.msvcrt.dll_fflush
mov eax, 3
mov qword [rsi], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov ecx, 2
mov rbx, qword [fcn.2e3e58d50]
call rbx
lea rdx, str.could_not_create_context:_unknown_error_n
mov rcx, rax
jmp 0x2e3d25c95
mov rcx, r12
lea r12, str.JARXM_MALLOC___failed
call sub.msvcrt.dll_fclose
jmp 0x2e3d25bbf
Function at 0x2e3d26a70
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x28
mov r13, rcx
mov rcx, qword [rcx + 0x1a70]
mov r12, rdx
test rcx, rcx
je 0x2e3d26a9e
call sub.msvcrt.dll_free
mov qword [r13 + 0x1a70], 0
mov rcx, r12
lea rdx, [0x2e3ee32a9]
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x2e3d26ae8
mov r8d, 2
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rcx, r12
call sub.msvcrt.dll_ftell
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov r14d, eax
call sub.msvcrt.dll_fseek
lea eax, [r14 - 1]
cmp eax, 0x1fffffe
jbe 0x2e3d26b00
xor r14d, r14d
mov eax, r14d
add rsp, 0x28
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, r14d
mov edx, 1
mov rcx, r15
call sub.msvcrt.dll_calloc
mov dword [r13 + 0x1a78], r14d
mov rdx, r15
mov r9, r12
mov qword [r13 + 0x1a70], rax
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov rcx, r12
call sub.msvcrt.dll_fclose
mov rdx, qword [r13 + 0x1a70]
mov r8d, r14d
mov rcx, r13
call fcn.2e3d265c0
test al, al
jne 0x2e3d26aeb
jmp 0x2e3d26ae8
Function at 0x2e3d61b90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov eax, dword [0x2e3e6ad00]
sub eax, 1
cmp eax, 1
jbe 0x2e3d61c90
mov rsi, qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea r13, [rsp + 0x20]
lea r12, [rsp + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm6, qword [0x2e3eefb98]
mov rcx, r13
call rsi
mov rcx, r12
call rbx
mov rax, qword [rsp + 0x28]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jns 0x2e3d61c07
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
mov rax, qword [rsp + 0x20]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x2e3d61c33
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
divsd xmm0, xmm1
mov eax, dword [0x2e3e6ad00]
mulsd xmm0, xmm6
subsd xmm0, qword [0x2e3e6ad10]
comisd xmm0, xmmword [0x2e3eefba0]
jbe 0x2e3d61c5c
cmp eax, 8
je 0x2e3d61d40
lea edx, [rax - 0x10]
and edx, 0xffffffef
je 0x2e3d61c6c
sub eax, 0x40
and eax, 0xffffffbf
jne 0x2e3d61c76
mov dword [0x2e3e6ad00], 0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
cmp dword [0x2e3e6ad0c], 1
jg 0x2e3d61bb1
lea r13, [rsp + 0x20]
lea r12, [rsp + 0x28]
mov dword [0x2e3e6ad00], 4
mov rsi, qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, r13
call rsi
mov rbx, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, r12
call rbx
mov rax, qword [rsp + 0x28]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jns 0x2e3d61cf5
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
mov rax, qword [rsp + 0x20]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x2e3d61d21
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
divsd xmm0, xmm1
movsd xmm6, qword [0x2e3eefb98]
mulsd xmm0, xmm6
movsd qword [0x2e3e6ad58], xmm0
jmp 0x2e3d61bd1
cmp dword [0x2e3e6ad0c], 1
jg 0x2e3d61c76
mov dword [0x2e3e6ad00], 4
mov rcx, r13
call rsi
mov rcx, r12
call rbx
mov rax, qword [rsp + 0x28]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jns 0x2e3d61d8d
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
mov rax, qword [rsp + 0x20]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x2e3d61db9
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
divsd xmm0, xmm1
mov byte [0x2e3e6ad50], 1
mov eax, dword [0x2e3e6ad00]
mulsd xmm0, xmm6
movsd qword [0x2e3e6ad58], xmm0
jmp 0x2e3d61c5c
Function at 0x2e3d69640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x2e3f09580]
mov rbx, qword [rsi]
test rbx, rbx
je 0x2e3d696b0
mov rdi, qword [0x2e3f0b050]
mov edx, dword [rdi]
test edx, edx
je 0x2e3d69678
cmp dword [rbx + 8], 1
je 0x2e3d69690
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
mov ecx, 0x10001
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.2e3c320f0
mov rbx, qword [rsi]
test rbx, rbx
je 0x2e3d696d0
cmp qword [rbx + 0x50], 0
je 0x2e3d69700
or dword [rsi + 0x10], 0x400
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8d, 0x330
lea rdx, [0x2e3eefda8]
lea rcx, [0x2e3eefec4]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x2e3d69656
mov r8d, 0x2f2
lea rdx, [0x2e3eefda8]
lea rcx, [0x2e3eefec4]
call qword [sym.imp.msvcrt.dll__wassert]
mov eax, dword [rdi]
test eax, eax
jne 0x2e3d69698
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
jmp 0x2e3d6969f
mov rcx, qword [rbx + 0x358]
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x2e3d6969f

Function at 0x2e3d697a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x2e3f09580]
mov rbx, qword [rsi]
test rbx, rbx
je 0x2e3d69850
mov rdi, qword [0x2e3f0b050]
mov edx, dword [rdi]
test edx, edx
je 0x2e3d697d8
cmp dword [rbx + 8], 1
je 0x2e3d697f0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
mov ecx, 0x10001
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.2e3c320f0
mov rbx, qword [rsi]
test rbx, rbx
je 0x2e3d69820
mov rcx, qword [rbx + 0x358]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
and dword [rsi + 0x10], 0xfffff9ff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8d, 0x2e9
lea rdx, [0x2e3eefda8]
lea rcx, [0x2e3eefec4]
call qword [sym.imp.msvcrt.dll__wassert]
mov eax, dword [rdi]
test eax, eax
jne 0x2e3d697f8
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
jmp 0x2e3d6980a
mov r8d, 0x330
lea rdx, [0x2e3eefda8]
lea rcx, [0x2e3eefec4]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x2e3d697ba
Function at 0x2e3d6c6c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, qword [0x2e3f09580]
cmp byte [rbx + 0x15], 0
mov r12, qword [rbx]
jne 0x2e3d6c7f0
test r12, r12
je 0x2e3d6c8c0
mov rsi, qword [0x2e3f0b050]
mov qword [rbx + 0x1c], 0
mov edx, dword [rsi]
test edx, edx
je 0x2e3d6c880
mov qword [rsp + 0x48], 0
mov rcx, qword [r12 + 0x358]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x1c], rax
call fcn.2e3d69f90
mov r12d, dword [rsi]
movsxd rdi, eax
test r12d, r12d
je 0x2e3d6c900
mov r12d, dword [rsi + 0x410]
mov rax, qword [rsi + 0x408]
cmp edi, r12d
jge 0x2e3d6c838
mov rdx, qword [rax + rdi*8]
test rdx, rdx
je 0x2e3d6c838
or dword [rbx + 0x10], 2
xor r9d, r9d
xor r8d, r8d
mov byte [rbx + 0x15], 1
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x20], eax
mov rcx, qword [rbx]
call fcn.2e3c40160
test byte [rbx + 0x10], 0x40
je 0x2e3d6c82a
nop word [rax + rax]
mov rsi, qword [0x2e3f0b050]
xor edx, edx
mov ecx, 0x10001
mov eax, dword [rsi]
test eax, eax
je 0x2e3d6c8ec
cmp dword [rsi + 0x162c], 1
jne 0x2e3d6c898
mov ecx, dword [rsi + 0x1630]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x2e3d6c8e0
mov rax, qword [rax + 0x260]
mov ecx, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp rax
and dword [rbx + 0x10], 0xfffffffd
mov r9d, dword [rbx + 0x20]
xor edx, edx
mov rcx, r12
mov byte [rbx + 0x15], 0
mov r8d, dword [rbx + 0x1c]
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x20], eax
call fcn.2e3c40160
test byte [rbx + 0x10], 0x40
jne 0x2e3d6c798
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rdx, str.GLFW:_Failed_to_get_monitor
mov ecx, 4
call fcn.2e3e428c0
and dword [rbx + 0x10], 0xfffffffd
xor r9d, r9d
xor r8d, r8d
mov byte [rbx + 0x15], 0
xor edx, edx
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x20], eax
mov rcx, qword [rbx]
call fcn.2e3c40160
jmp 0x2e3d6c820
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
jmp 0x2e3d6c724
mov r8d, 0x40
lea rdx, str.C:Users_braid.nimblepkgs2_nimraylib_now_0.15.0_f136f0da2803a36acc6b869bbc8b621193f1849ccsources_raylib_mangledexternal_glfw_src_win32_thread.c
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x2e3d6c7bd
mov r8d, 0x211
lea rdx, [0x2e3eefda8]
lea rcx, [0x2e3eefec4]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x2e3d6c6e6
lea rdx, str.Cannot_set_swap_interval_without_a_current_OpenGL_or_OpenGL_ES_context
mov ecx, 0x10002
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.2e3c320f0
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
xor eax, eax
jmp 0x2e3d6c746
Function at 0x2e3d751f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x2e3f09580]
pxor xmm6, xmm6
pxor xmm3, xmm3
cvtsd2ss xmm6, qword [rax + 0x8a0]
xor eax, eax
comiss xmm6, xmm3
jne 0x2e3d75228
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rsi
ret
mov rbx, qword [0x2e3f0b050]
mov r8d, dword [rbx]
test r8d, r8d
je 0x2e3d75330
mov ecx, dword [rbx + 0x1670]
test ecx, ecx
jne 0x2e3d75440
call qword [rbx + 0x24a8]
mov eax, eax
sub rax, qword [rbx + 0x1668]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
js 0x2e3d75310
mov rax, qword [rbx + 0x1678]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
js 0x2e3d752e8
divsd xmm0, xmm1
mov rsi, qword [0x2e3f0f5a0]
pxor xmm1, xmm1
cvtss2sd xmm1, dword [rsi]
subsd xmm0, xmm1
comisd xmm0, xmmword [0x2e3ef2138]
ja 0x2e3d75348
mov rax, qword [0x2e3f0b0c0]
movss xmm0, dword [rax]
movss xmm1, dword [0x2e3ef2070]
movss xmm2, dword [0x2e3ef2000]
movaps xmm6, xmmword [rsp + 0x30]
divss xmm1, xmm0
movss xmm0, dword [0x2e3ef2144]
andps xmm2, xmm1
orps xmm0, xmm2
addss xmm0, xmm1
cvttss2si eax, xmm0
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
jmp 0x2e3d7527c
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
jmp 0x2e3d75267
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
pxor xmm0, xmm0
jmp 0x2e3d75280
mov edx, dword [rbx]
test edx, edx
je 0x2e3d75458
mov eax, dword [rbx + 0x1670]
test eax, eax
jne 0x2e3d75470
call qword [rbx + 0x24a8]
mov eax, eax
sub rax, qword [rbx + 0x1668]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
jns 0x2e3d75393
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
mov rax, qword [rbx + 0x1678]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x2e3d753c1
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
divsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
mov rcx, qword [0x2e3f0f540]
mulss xmm6, dword [0x2e3ef2140]
movss dword [rsi], xmm0
mov eax, dword [rcx]
lea edx, [rax + 1]
movsxd rax, edx
mov r8d, edx
imul rax, rax, 0xffffffff88888889
sar r8d, 0x1f
shr rax, 0x20
add eax, edx
sar eax, 4
sub eax, r8d
imul r8d, eax, 0x1e
mov eax, edx
mov rdx, qword [0x2e3f0b0c0]
movss xmm0, dword [rdx]
sub eax, r8d
mov dword [rcx], eax
mov rcx, qword [0x2e3f0f530]
cdqe
addss xmm0, xmm6
movss xmm1, dword [rcx + rax*4]
movss dword [rcx + rax*4], xmm6
subss xmm0, xmm1
movss dword [rdx], xmm0
jmp 0x2e3d752ac
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
jmp 0x2e3d75251
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
pxor xmm0, xmm0
jmp 0x2e3d753c9
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
jmp 0x2e3d75368
Function at 0x2e3d7c640
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x2e3d7c661
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp sub.msvcrt.dll_fflush

Function at 0x2e3d88020
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.2e3e58d50]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rdx, qword [0x2e3f0fce0]
mov rax, qword [rdx]
cmp rax, 0xdab
jg 0x2e3d8809d
mov r8, qword [0x2e3f0fcd0]
mov qword [r8 + rax*8], rcx
add rax, 1
mov qword [rdx], rax
add rsp, 0x28
ret
call fcn.2e3d88020
nop
nop word cs:[rax + rax]
nop

Function at 0x2e3d880b0
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.2e3e58d50]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rdx, qword [0x2e3f0f4a0]
mov rax, qword [rdx]
cmp rax, 0xdab
jg 0x2e3d8812d
mov r8, qword [0x2e3f0f490]
mov qword [r8 + rax*8], rcx
add rax, 1
mov qword [rdx], rax
add rsp, 0x28
ret
call fcn.2e3d880b0
nop
nop word cs:[rax + rax]
nop

Function at 0x2e3d8b3f0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x38
lea rcx, [0x2e3e6ae80]
call fcn.2e3e59960
mov rcx, qword [rax]
test rcx, rcx
je 0x2e3d8b41f
add rsp, 0x38
pop rbx
pop r12
pop r13
pop r14
jmp 0x2e3d8ad90
mov rcx, qword [0x2e3f0a680]
mov edx, 0x30
lea r13, str.ReraiseDefect
call fcn.2e3d88b70
lea rcx, [0x2e3ef55c0]
mov r12, rax
mov rax, qword [0x2e3f0a6a0]
mov qword [r12 + 0x10], r13
mov rbx, qword [r12 + 0x18]
mov qword [r12], rax
call fcn.2e3d89320
mov qword [r12 + 0x18], rax
test rbx, rbx
je 0x2e3d8b493
mov rax, qword [rbx - 0x10]
lea r14, [rbx - 0x10]
sub rax, 8
mov qword [rbx - 0x10], rax
cmp rax, 7
ja 0x2e3d8b493
mov rcx, qword [0x2e3f0af50]
call fcn.2e3e59960
mov rdx, r14
lea rcx, [rax + 0x18]
call fcn.2e3d7eda0
mov qword [rsp + 0x20], 0x35
lea r9, str.fatal.nim
mov rdx, r13
mov rcx, r12
lea r8, str.sysFatal
call fcn.2e3d8aee0
nop
nop word cs:[rax + rax]