joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f03a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x40
cmp byte [rcx + 0x19], 0
mov rsi, rcx
jne 0x1800f03ba
mov eax, 0x8000ffff
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
xor edi, edi
mov qword [rsp + 0x30], r13
test rdx, rdx
je 0x1800f0570
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
nop word [rax + rax]
cmp rbx, 0xffffffffffffffff
je 0x1800f0569
cmp rbx, 0x10
jae 0x1800f0407
mov ebx, 0x20
jmp 0x1800f0415
cmp rbx, rax
ja 0x1800f0411
add rbx, rbx
jmp 0x1800f0415
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f03f0
movabs rax, 0x38e38e38e38e38e
cmp rbx, rax
ja 0x1800f0569
test rbx, rbx
je 0x1800f0573
mov ecx, dword [0x18025e63c]
lea rbp, [rbx + rbx*8]
shl rbp, 3
test ecx, ecx
jns 0x1800f044d
mov rax, rdi
jmp 0x1800f0453
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x1800f0473
mov eax, 0x8007000e
jmp 0x1800f05ca
mov rax, qword [rsi + 0x10]
mov rbp, rbx
cmp rbx, rax
cmova rbp, rax
test rbp, rbp
je 0x1800f04b6
lea rcx, [r13 + 0x38]
mov rdx, rbp
nop dword [rax]
lea rax, [rcx - 0x38]
test rax, rax
je 0x1800f04ac
mov qword [rcx - 0x10], rdi
mov qword [rcx - 8], rdi
mov qword [rcx], rdi
mov byte [rcx + 8], dil
mov byte [rcx + 9], 1
add rcx, 0x48
sub rdx, 1
jne 0x1800f0490
test rbp, rbp
je 0x1800f0558
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x28], r14
mov r14, 0xfffffffffffffff4
mov qword [rsp + 0x20], r15
lea r12, [r13 + 0xc]
sub r14, r13
mov r15, rbp
nop
lea rdx, [r14 + r12]
lea rcx, [r12 + 0x1c]
add rdx, qword [rsi]
add rdx, 0x28
mov rax, qword [rdx - 0x28]
mov qword [r12 - 0xc], rax
mov eax, dword [rdx - 0x20]
mov dword [r12 - 4], eax
mov eax, dword [rdx - 0x1c]
mov dword [r12], eax
mov eax, dword [rdx - 0x18]
mov dword [r12 + 4], eax
movzx eax, byte [rdx - 0x14]
mov byte [r12 + 8], al
movzx eax, byte [rdx - 0x13]
mov byte [r12 + 9], al
mov eax, dword [rdx - 0x10]
mov dword [r12 + 0xc], eax
mov eax, dword [rdx - 0xc]
mov dword [r12 + 0x10], eax
mov eax, dword [rdx - 8]
mov dword [r12 + 0x14], eax
call fcn.1800f11b0
add r12, 0x48
sub r15, 1
jne 0x1800f04e0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, rbp
call fcn.1800c5fe0
jmp 0x1800f0584
mov eax, 0x80070216
jmp 0x1800f05ca
mov rbx, rdi
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx]
xor edx, edx
call fcn.1800c5fe0
mov r13, rdi
cmp byte [rsi + 0x18], 0
je 0x1800f05b3
mov rbp, qword [rsi]
test rbp, rbp
je 0x1800f05b3
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f05a5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [rdi]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], r13
mov qword [rsi + 8], rbx
cmp qword [rsi + 0x10], rbx
jbe 0x1800f05c4
mov qword [rsi + 0x10], rbx
mov byte [rsi + 0x18], 1
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x30]
add rsp, 0x40
pop rsi
ret
Function at 0x1800f05f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
cmp byte [rcx + 0x19], 0
mov rsi, rcx
jne 0x1800f060a
mov eax, 0x8000ffff
add rsp, 0x30
pop rsi
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rdi
xor edi, edi
mov qword [rsp + 0x20], r14
test rdx, rdx
je 0x1800f0766
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
nop word [rax + rax]
cmp rbx, 0xffffffffffffffff
je 0x1800f075f
cmp rbx, 0x10
jae 0x1800f0657
mov ebx, 0x20
jmp 0x1800f0665
cmp rbx, rax
ja 0x1800f0661
add rbx, rbx
jmp 0x1800f0665
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f0640
movabs rax, 0x666666666666666
cmp rbx, rax
ja 0x1800f075f
test rbx, rbx
je 0x1800f0769
mov ecx, dword [0x18025e63c]
lea rbp, [rbx + rbx*4]
shl rbp, 3
test ecx, ecx
jns 0x1800f069d
mov rax, rdi
jmp 0x1800f06a3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800f06c3
mov eax, 0x8007000e
jmp 0x1800f07c0
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x58], r12
mov r12, rbx
cmp rbx, rax
cmova r12, rax
test r12, r12
je 0x1800f0708
lea rcx, [r14 + 0x18]
mov rdx, r12
lea rax, [rcx - 0x18]
test rax, rax
je 0x1800f06fe
mov qword [rcx - 0x10], rdi
mov qword [rcx - 8], rdi
mov qword [rcx], rdi
mov byte [rcx + 8], dil
mov byte [rcx + 9], 1
add rcx, 0x28
sub rdx, 1
jne 0x1800f06e2
test r12, r12
je 0x1800f0749
mov qword [rsp + 0x28], r13
mov rbp, rdi
mov r13, r12
nop dword [rax + rax]
mov rcx, qword [rsi]
mov rax, qword [rcx + rbp]
lea rdx, [rcx + rbp + 8]
lea rcx, [r14 + rbp + 8]
mov qword [r14 + rbp], rax
call fcn.1800f1240
add rbp, 0x28
sub r13, 1
jne 0x1800f0720
mov r13, qword [rsp + 0x28]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, r12
call fcn.1800c6190
mov r12, qword [rsp + 0x58]
jmp 0x1800f077a
mov eax, 0x80070216
jmp 0x1800f07c0
mov rbx, rdi
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx]
xor edx, edx
call fcn.1800c6190
mov r14, rdi
cmp byte [rsi + 0x18], 0
je 0x1800f07a9
mov rbp, qword [rsi]
test rbp, rbp
je 0x1800f07a9
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f079b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [rdi]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], r14
mov qword [rsi + 8], rbx
cmp qword [rsi + 0x10], rbx
jbe 0x1800f07ba
mov qword [rsi + 0x10], rbx
mov byte [rsi + 0x18], 1
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop rsi
ret
Function at 0x1800f07e0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x1800f07fa
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
xor r12d, r12d
test rdx, rdx
je 0x1800f08e3
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800f0858
cmp rbx, 0x10
jae 0x1800f0836
mov ebx, 0x20
jmp 0x1800f0844
cmp rbx, rax
ja 0x1800f0840
add rbx, rbx
jmp 0x1800f0844
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f0823
movabs rax, 0xfffffffffffffff
cmp rbx, rax
jbe 0x1800f0862
mov eax, 0x80070216
jmp 0x1800f093a
test rbx, rbx
je 0x1800f08e6
mov ecx, dword [0x18025e63c]
mov rsi, rbx
shl rsi, 4
test ecx, ecx
jns 0x1800f087d
mov rax, r12
jmp 0x1800f0883
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800f08a3
mov eax, 0x8007000e
jmp 0x1800f093a
mov rax, qword [rdi + 0x10]
mov r8, rbx
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800f08e9
mov rdx, r12
nop dword [rax]
mov rcx, qword [rdi]
add rdx, 0x10
sub r8, 1
mov rax, qword [rdx + rcx - 0x10]
mov qword [rdx + rsi - 0x10], rax
mov rax, qword [rdx + rcx - 8]
mov qword [rdx + rsi - 8], rax
jne 0x1800f08c0
jmp 0x1800f08e9
mov rbx, r12
mov rsi, r12
cmp byte [rdi + 0x18], 0
je 0x1800f0923
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdi]
test rbp, rbp
je 0x1800f091e
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f090f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rcx, qword [r12]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800f0934
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800f0960
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x1800f097a
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
test rdx, rdx
je 0x1800f0a9c
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800f0a95
cmp rbx, 0x10
jae 0x1800f09b9
mov ebx, 0x20
jmp 0x1800f09c7
cmp rbx, rax
ja 0x1800f09c3
add rbx, rbx
jmp 0x1800f09c7
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f09a2
movabs rax, 0x492492492492492
cmp rbx, rax
ja 0x1800f0a95
test rbx, rbx
je 0x1800f0a9f
mov ecx, dword [0x18025e63c]
mov rsi, rbx
imul rsi, rsi, 0x38
test ecx, ecx
jns 0x1800f09fe
mov rax, rbp
jmp 0x1800f0a04
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800f0a24
mov eax, 0x8007000e
jmp 0x1800f0af3
mov rax, qword [rdi + 0x10]
mov r8, rbx
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800f0aa2
mov rdx, rbp
nop word [rax + rax]
mov rcx, qword [rdi]
add rdx, 0x38
sub r8, 1
mov rax, qword [rdx + rcx - 0x38]
mov qword [rdx + rsi - 0x38], rax
mov rax, qword [rdx + rcx - 0x30]
mov qword [rdx + rsi - 0x30], rax
mov rax, qword [rdx + rcx - 0x28]
mov qword [rdx + rsi - 0x28], rax
mov rax, qword [rdx + rcx - 0x20]
mov qword [rdx + rsi - 0x20], rax
mov rax, qword [rdx + rcx - 0x18]
mov qword [rdx + rsi - 0x18], rax
mov rax, qword [rdx + rcx - 0x10]
mov qword [rdx + rsi - 0x10], rax
mov rax, qword [rdx + rcx - 8]
mov qword [rdx + rsi - 8], rax
jne 0x1800f0a40
jmp 0x1800f0aa2
mov eax, 0x80070216
jmp 0x1800f0af3
mov rbx, rbp
mov rsi, rbp
cmp byte [rdi + 0x18], 0
je 0x1800f0adc
mov qword [rsp + 0x48], r12
mov r12, qword [rdi]
test r12, r12
je 0x1800f0ad7
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f0ac8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov rcx, qword [rbp]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800f0aed
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800f0b10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x19], 0
mov rbp, rcx
jne 0x1800f0b2a
mov eax, 0x8000ffff
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], r12
xor r12d, r12d
mov qword [rsp + 0x20], r13
test rdx, rdx
je 0x1800f0ca1
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
nop dword [rax]
cmp rbx, 0xffffffffffffffff
je 0x1800f0c9a
cmp rbx, 0x10
jae 0x1800f0b77
mov ebx, 0x20
jmp 0x1800f0b85
cmp rbx, rax
ja 0x1800f0b81
add rbx, rbx
jmp 0x1800f0b85
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f0b60
movabs rax, 0x7ffffffffffffff
cmp rbx, rax
ja 0x1800f0c9a
test rbx, rbx
je 0x1800f0ca4
mov ecx, dword [0x18025e63c]
mov rdi, rbx
shl rdi, 5
test ecx, ecx
jns 0x1800f0bbc
mov rax, r12
jmp 0x1800f0bc2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x1800f0be2
mov eax, 0x8007000e
jmp 0x1800f0d14
mov rax, qword [rbp + 0x10]
mov r8, rbx
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800f0c1a
lea rcx, [r13 + 8]
mov rdx, r8
nop dword [rax]
lea rax, [rcx - 8]
test rax, rax
je 0x1800f0c10
mov qword [rcx], r12
mov qword [rcx + 8], r12
add rcx, 0x20
sub rdx, 1
jne 0x1800f0c00
test r8, r8
je 0x1800f0c66
mov rdx, r12
mov r9, r8
nop word [rax + rax]
mov rcx, qword [rbp]
add rdx, 0x20
sub r9, 1
mov rax, qword [rdx + rcx - 0x20]
mov qword [rdx + r13 - 0x20], rax
mov rax, qword [rdx + rcx - 0x18]
mov qword [rdx + r13 - 0x18], rax
mov rax, qword [rdx + rcx - 0x10]
mov qword [rdx + r13 - 0x10], rax
mov rax, qword [rdx + rcx - 8]
mov qword [rdx + r13 - 8], rax
jne 0x1800f0c30
mov rsi, qword [rbp + 0x10]
cmp r8, rsi
jae 0x1800f0ccb
mov rdi, r8
shl rdi, 5
add rdi, qword [rbp]
sub rsi, r8
nop dword [rax]
test rdi, rdi
je 0x1800f0c8e
lea rcx, [rdi + 8]
call fcn.1800c5e00
add rdi, 0x20
sub rsi, 1
jne 0x1800f0c80
jmp 0x1800f0ccb
mov eax, 0x80070216
jmp 0x1800f0d14
mov rbx, r12
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rcx]
test rsi, rsi
je 0x1800f0cc8
test rdi, rdi
je 0x1800f0cbe
lea rcx, [rdi + 8]
call fcn.1800c5e00
add rdi, 0x20
sub rsi, 1
jne 0x1800f0cb0
mov r13, r12
cmp byte [rbp + 0x18], 0
je 0x1800f0cfc
mov rdi, qword [rbp]
test rdi, rdi
je 0x1800f0cfc
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f0ced
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rcx, qword [r12]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp], r13
mov qword [rbp + 8], rbx
cmp qword [rbp + 0x10], rbx
jbe 0x1800f0d0e
mov qword [rbp + 0x10], rbx
mov byte [rbp + 0x18], 1
xor eax, eax
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x20]
add rsp, 0x30
pop rbp
ret
Function at 0x1800f0d40
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x1800f0d5a
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
xor r12d, r12d
test rdx, rdx
je 0x1800f0e47
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800f0db8
cmp rbx, 0x10
jae 0x1800f0d96
mov ebx, 0x20
jmp 0x1800f0da4
cmp rbx, rax
ja 0x1800f0da0
add rbx, rbx
jmp 0x1800f0da4
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f0d83
movabs rax, 0x1555555555555555
cmp rbx, rax
jbe 0x1800f0dc2
mov eax, 0x80070216
jmp 0x1800f0e9e
test rbx, rbx
je 0x1800f0e4a
mov ecx, dword [0x18025e63c]
lea rsi, [rbx + rbx*2]
shl rsi, 2
test ecx, ecx
jns 0x1800f0de2
mov rax, r12
jmp 0x1800f0de8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800f0e08
mov eax, 0x8007000e
jmp 0x1800f0e9e
mov rax, qword [rdi + 0x10]
mov r8, rbx
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800f0e4d
mov rdx, r12
nop
mov rcx, qword [rdi]
add rdx, 0xc
sub r8, 1
mov eax, dword [rdx + rcx - 0xc]
mov dword [rdx + rsi - 0xc], eax
mov eax, dword [rdx + rcx - 8]
mov dword [rdx + rsi - 8], eax
mov eax, dword [rdx + rcx - 4]
mov dword [rdx + rsi - 4], eax
jne 0x1800f0e20
jmp 0x1800f0e4d
mov rbx, r12
mov rsi, r12
cmp byte [rdi + 0x18], 0
je 0x1800f0e87
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdi]
test rbp, rbp
je 0x1800f0e82
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f0e73
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rcx, qword [r12]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800f0e98
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800f0ec0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x1800f0eda
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
xor r12d, r12d
test rdx, rdx
je 0x1800f0fcf
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800f0f38
cmp rbx, 0x10
jae 0x1800f0f16
mov ebx, 0x20
jmp 0x1800f0f24
cmp rbx, rax
ja 0x1800f0f20
add rbx, rbx
jmp 0x1800f0f24
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f0f03
movabs rax, 0xfffffffffffffff
cmp rbx, rax
jbe 0x1800f0f42
mov eax, 0x80070216
jmp 0x1800f1026
test rbx, rbx
je 0x1800f0fd2
mov ecx, dword [0x18025e63c]
mov rsi, rbx
shl rsi, 4
test ecx, ecx
jns 0x1800f0f61
mov rax, r12
jmp 0x1800f0f67
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800f0f87
mov eax, 0x8007000e
jmp 0x1800f1026
mov rax, qword [rdi + 0x10]
mov r8, rbx
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800f0fd5
mov rdx, r12
nop dword [rax]
mov rcx, qword [rdi]
add rdx, 0x10
sub r8, 1
mov eax, dword [rdx + rcx - 0x10]
mov dword [rdx + rsi - 0x10], eax
mov eax, dword [rdx + rcx - 0xc]
mov dword [rdx + rsi - 0xc], eax
mov eax, dword [rdx + rcx - 8]
mov dword [rdx + rsi - 8], eax
mov eax, dword [rdx + rcx - 4]
mov dword [rdx + rsi - 4], eax
jne 0x1800f0fa0
jmp 0x1800f0fd5
mov rbx, r12
mov rsi, r12
cmp byte [rdi + 0x18], 0
je 0x1800f100f
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdi]
test rbp, rbp
je 0x1800f100a
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f0ffb
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rcx, qword [r12]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800f1020
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800f1050
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x1800f106a
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
xor r12d, r12d
test rdx, rdx
je 0x1800f1137
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1800f10be
cmp rbx, 0x10
jae 0x1800f10a6
mov ebx, 0x20
jmp 0x1800f10b4
cmp rbx, rax
ja 0x1800f10b0
add rbx, rbx
jmp 0x1800f10b4
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x1800f1093
cmp rbx, rax
jbe 0x1800f10c8
mov eax, 0x80070216
jmp 0x1800f118e
test rbx, rbx
je 0x1800f113a
mov ecx, dword [0x18025e63c]
lea rsi, [rbx + rbx]
test ecx, ecx
jns 0x1800f10e0
mov rax, r12
jmp 0x1800f10e6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800f1106
mov eax, 0x8007000e
jmp 0x1800f118e
mov rax, qword [rdi + 0x10]
mov r8, rbx
mov rdx, r12
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x1800f113d
nop dword [rax]
mov rax, qword [rdi]
inc rdx
movzx ecx, word [rax + rdx*2 - 2]
mov word [rsi + rdx*2 - 2], cx
cmp rdx, r8
jb 0x1800f1120
jmp 0x1800f113d
mov rbx, r12
mov rsi, r12
cmp byte [rdi + 0x18], 0
je 0x1800f1177
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdi]
test rbp, rbp
je 0x1800f1172
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1800f1163
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rcx, qword [r12]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x1800f1188
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fa860
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x30]
xor esi, esi
mov rbx, rcx
test rdi, rdi
je 0x1800fa8a0
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800fa88c
mov rax, rsi
jmp 0x1800fa892
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbx + 0x38]
mov qword [rbx + 0x30], rsi
test rdi, rdi
je 0x1800fa8d0
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800fa8bc
mov rax, rsi
jmp 0x1800fa8c2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbx + 0x40]
mov qword [rbx + 0x38], rsi
test rdi, rdi
je 0x1800fa900
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800fa8ec
mov rax, rsi
jmp 0x1800fa8f2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbx + 0x50]
mov qword [rbx + 0x40], rsi
test rdi, rdi
je 0x1800fa930
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800fa91c
mov rax, rsi
jmp 0x1800fa922
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbx + 0x290]
mov qword [rbx + 0x50], rsi
call fcn.180109ae0
lea rcx, [rbx + 0x2b0]
xor edx, edx
mov r8d, 0x1a8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18024adb8

Function at 0x1800fa970
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800fa990
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rdi, qword [rbx + 0x288]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x1800fa9bd
mov rcx, rdi
call fcn.18011e050
lea rcx, [rdi + 0x30]
call fcn.180120170
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rbx + 0x268]
mov qword [rbx + 0x288], 0
call fcn.1800c6110
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800fa860
Function at 0x1800ff4e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.18011dbe0
test bl, 1
je 0x1800ff520
test rdi, rdi
je 0x1800ff520
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1800ff50c
xor eax, eax
jmp 0x1800ff512
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret