joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400196c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rax + rcx + 0x88]
mov ebp, dword [rax + rcx + 0x20]
add rbp, rcx
mov ecx, dword [rax + rcx + 0x14]
mov qword [rsp + 0x30], rcx
mov edi, dword [rax + rsi + 0x18]
mov ecx, dword [rax + rsi + 0x1c]
add rcx, rsi
mov qword [rsp + 0x28], rcx
mov r13d, dword [rax + rsi + 0x24]
add r13, rsi
lea r15, [rsp + 0x38]
xor eax, eax
jmp 0x14001972e
xor ecx, ecx
lea rax, [r14 + 1]
cmp ecx, ebx
je 0x14001981c
cmp rax, rdi
je 0x140019818
mov r14, rax
mov r12d, dword [rbp + rax*4]
add r12, rsi
mov rcx, r12
call sub.msvcrt.dll_strlen
lea r8, [rax + 1]
mov rcx, r15
mov rdx, r12
call fcn.140169b20
cmp dword [rsp + 0x38], 1
je 0x140019848
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140019720
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
cmp rax, 8
jb 0x1400197f1
mov r8, rax
and r8, 0xfffffffffffffff8
xor ecx, ecx
nop word cs:[rax + rax]
rol ecx, 0xd
movzx r9d, byte [rdx]
add ecx, r9d
rol ecx, 0xd
movzx r9d, byte [rdx + 1]
add ecx, r9d
rol ecx, 0xd
movzx r9d, byte [rdx + 2]
add ecx, r9d
rol ecx, 0xd
movzx r9d, byte [rdx + 3]
add ecx, r9d
rol ecx, 0xd
movzx r9d, byte [rdx + 4]
add ecx, r9d
rol ecx, 0xd
movzx r9d, byte [rdx + 5]
add ecx, r9d
rol ecx, 0xd
movzx r9d, byte [rdx + 6]
add ecx, r9d
movzx r9d, byte [rdx + 7]
add rdx, 8
rol ecx, 0xd
add ecx, r9d
add r8, 0xfffffffffffffff8
jne 0x140019790
and eax, 7
je 0x140019722
xor r8d, r8d
nop dword [rax]
rol ecx, 0xd
movzx r9d, byte [rdx + r8]
add ecx, r9d
inc r8
cmp rax, r8
jne 0x140019800
jmp 0x140019722
xor eax, eax
jmp 0x140019837
movzx ecx, word [r13 + r14*2]
mov rdx, qword [rsp + 0x30]
cmp rcx, rdx
jae 0x14001987e
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
add rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x40]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rax, [0x140189ec0]
mov qword [rsp + 0x20], rax
lea rcx, [0x140189df8]
lea r9, [0x140189dd8]
lea r8, [rsp + 0x50]
mov edx, 0x2b
call fcn.14016c8d0
lea r8, [0x140189ed8]
call fcn.14016c4b0
int3
Function at 0x14001ba10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x14001ba50
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x14001ba45
cmp edi, 0x2d
jne 0x14001ba50
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x14001bbef
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x14001bbfa
movzx r11d, r11b
cmp rbx, rsi
jae 0x14001baed
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x14001baac
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x14001baed
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x14001baed
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x14001ba90
cmp r11d, 0xccccccc
jne 0x14001bad8
cmp sil, 7
jbe 0x14001ba90
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.14001c2a0
jmp 0x14001bbdc
mov r10d, dword [rsp + 0x80]
test al, al
je 0x14001bb0a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x14001bb1a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x14018a510]
subpd xmm1, xmmword [0x14018a520]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x14001bb8c
xorpd xmm1, xmm1
movsd xmm2, qword [0x14018a530]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x14001bb68
jnp 0x14001bbc5
test r10d, r10d
jns 0x14001bc23
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x14001bb60
mov eax, eax
mov r9, qword [section..data]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x14001bbe4
mulsd xmm0, xmm1
movq rax, xmm0
movabs r9, 0x7fffffffffffffff
and r9, rax
movabs rax, 0x7ff0000000000000
cmp r9, rax
je 0x14001bc23
test r8b, r8b
jne 0x14001bbd2
xorpd xmm0, xmmword [0x14018a540]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x14001bbca
jmp 0x14001bbd2
mov qword [rsp + 0x28], 5
jmp 0x14001bc03
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14001c340
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14001bbdc
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14001c340
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14001bbd9

Function at 0x140021320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x140186410]
jmp 0x140029410

Function at 0x140021b30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x140024b80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [0x140186410]
xor edx, edx
jmp 0x140029410
Function at 0x140029410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x140186410]
jmp 0x140029410
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x14002952b
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140029569
je 0x14002945a
test rdi, rdi
je 0x140029461
lea rcx, [rdi + 8]
test byte [rdi], 1
mov qword [rdi], 0
lea rax, [0x14018be08]
cmovne rax, rcx
jmp 0x140029468
xor eax, eax
jmp 0x140029569
lea rax, [0x14018be08]
mov rcx, qword [rax + 0x40]
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x68], esi
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x50
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x140029571
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140029566
mov rax, qword [rdi + 8]
cmp rax, 2
je 0x140029553
mov rcx, rdi
add rcx, 0x10
test rax, rax
je 0x140029545
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x140029553
call fcn.14001ff30
jmp 0x140029553
call fcn.14013ad90
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140029438
jmp 0x140029569
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x140029553
call fcn.14001f6a0
mov edx, 0x50
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov ecx, 8
mov edx, 0x50
call fcn.14015f6d0
ud2
Function at 0x14002f330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x14002f370
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x14002f365
cmp edi, 0x2d
jne 0x14002f370
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x14002f50f
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x14002f51a
movzx r11d, r11b
cmp rbx, rsi
jae 0x14002f40d
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x14002f3cc
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x14002f40d
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x14002f40d
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x14002f3b0
cmp r11d, 0xccccccc
jne 0x14002f3f8
cmp sil, 7
jbe 0x14002f3b0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.14002f860
jmp 0x14002f4fc
mov r10d, dword [rsp + 0x80]
test al, al
je 0x14002f42a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x14002f43a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x14018d110]
subpd xmm1, xmmword [0x14018d120]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x14002f4ac
xorpd xmm1, xmm1
movsd xmm2, qword [0x14018d130]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x14002f488
jnp 0x14002f4e5
test r10d, r10d
jns 0x14002f543
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x14002f480
mov eax, eax
lea r9, [0x14018d260]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x14002f504
mulsd xmm0, xmm1
movq rax, xmm0
movabs r9, 0x7fffffffffffffff
and r9, rax
movabs rax, 0x7ff0000000000000
cmp r9, rax
je 0x14002f543
test r8b, r8b
jne 0x14002f4f2
xorpd xmm0, xmmword [0x14018d140]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x14002f4ea
jmp 0x14002f4f2
mov qword [rsp + 0x28], 5
jmp 0x14002f523
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14002ecd0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14002f4fc
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14002ecd0
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14002f4f9
Function at 0x14004c440
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14004c4a6
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
jmp 0x14004c468
add rdi, rbx
sub rsi, rbx
je 0x14004c4a6
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x14004c460
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14004c460
and ebp, 0x7fffffff
jmp 0x14004c4a8
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140077be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
test byte [rcx], 1
je 0x140077c1f
lea rdx, [rcx + 8]
cmp qword [rcx + 0x38], 0xffffffffffffffff
mov r8, qword [rcx + 0x48]
mov r9, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov rcx, qword [rcx + 0x60]
je 0x140077d49
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x140077d58
cmp byte [rcx + 0x1a], 0
je 0x140077c3c
xor eax, eax
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
jne 0x140077d8b
jmp 0x140077da9
mov r8, qword [rcx + 8]
mov rax, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x50]
movzx r9d, byte [rcx + 0x18]
jmp 0x140077c57
add r8, r10
mov qword [rcx + 8], r8
mov r10d, r9d
xor r9b, 1
test r8, r8
je 0x140077c86
cmp r8, rdx
jae 0x140077c80
cmp byte [rax + r8], 0xbf
jg 0x140077c86
jmp 0x140077db3
jne 0x140077db3
cmp r8, rdx
je 0x140077d6b
movzx r11d, byte [rax + r8]
test r11b, r11b
jns 0x140077cf0
mov esi, r11d
and esi, 0x1f
movzx ebx, byte [rax + r8 + 1]
and ebx, 0x3f
cmp r11b, 0xdf
jbe 0x140077ce3
movzx edi, byte [rax + r8 + 2]
shl ebx, 6
and edi, 0x3f
or edi, ebx
cmp r11b, 0xf0
jb 0x140077d32
movzx r11d, byte [rax + r8 + 3]
and esi, 7
shl esi, 0x12
shl edi, 6
and r11d, 0x3f
or r11d, edi
or r11d, esi
test r10b, 1
je 0x140077cf6
jmp 0x140077d40
shl esi, 6
or esi, ebx
mov r11d, esi
nop dword [rax + rax]
test r10b, 1
jne 0x140077d40
mov r10d, 1
cmp r11d, 0x80
jb 0x140077c50
mov r10d, 2
cmp r11d, 0x800
jb 0x140077c50
cmp r11d, 0x10000
mov r10d, 4
sbb r10, 0
jmp 0x140077c50
shl esi, 0xc
or edi, esi
mov r11d, edi
test r10b, 1
je 0x140077cf6
mov byte [rcx + 0x18], r9b
mov rdx, r8
jmp 0x140077d75
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x38]
call fcn.140077dd0
test byte [rsp + 0x38], 1
jne 0x140077d8b
jmp 0x140077da9
mov byte [rcx + 0x18], r9b
test r10b, 1
je 0x140077d97
mov qword [rsp + 0x40], rdx
mov eax, 1
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
je 0x140077da9
mov rdx, qword [rsp + 0x40]
mov eax, 1
jmp 0x140077dab
mov byte [rcx + 0x1a], 1
xor eax, eax
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
jne 0x140077d8b
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov byte [rcx + 0x18], r9b
lea rcx, [0x140198498]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r9, rdx
call fcn.1401749a0
int3
Function at 0x140094b70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1401c9bd8]
jmp 0x1400987e0
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x1400988fb
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140098939
je 0x14009882a
test rdi, rdi
je 0x140098831
lea rcx, [rdi + 8]
test byte [rdi], 1
mov qword [rdi], 0
lea rax, [0x14019d1b0]
cmovne rax, rcx
jmp 0x140098838
xor eax, eax
jmp 0x140098939
lea rax, [0x14019d1b0]
mov rcx, qword [rax + 0x40]
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x68], esi
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x50
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x140098941
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140098936
mov rax, qword [rdi + 8]
cmp rax, 2
je 0x140098923
mov rcx, rdi
add rcx, 0x10
test rax, rax
je 0x140098915
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x140098923
call fcn.14007b510
jmp 0x140098923
call fcn.14013ad90
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140098808
jmp 0x140098939
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x140098923
call fcn.14007ba10
mov edx, 0x50
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov ecx, 8
mov edx, 0x50
call fcn.14015f6d0
ud2

Function at 0x140096290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1401c9bd8]
jmp 0x1400987e0
Function at 0x1400983e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x1400984f2
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400984e8
je 0x140098431
xor eax, eax
test rdi, rdi
je 0x140098438
test byte [rdi], 1
mov qword [rdi], 0
mov ecx, dword [rdi + 0x10]
cmove ecx, eax
mov ebx, 0
cmovne rbx, qword [rdi + 8]
mov eax, ecx
jmp 0x14009843a
xor eax, eax
jmp 0x1400984e8
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], al
mov dword [rsp + 0x30], esi
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x14009850c
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov r14, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x1400984e5
mov rsi, qword [rdi]
test rsi, rsi
je 0x1400984d2
dec qword [rsi]
jne 0x1400984d2
mov rax, qword [rsi + 0x10]
lock dec qword [rax]
jne 0x1400984b9
lea rcx, [rsi + 0x10]
call fcn.14007b170
dec qword [rsi + 8]
jne 0x1400984d2
mov edx, 0x20
mov r8d, 8
mov rcx, rsi
call fcn.14002d1a0
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rax, r14
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14013ad90
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14009840a
jmp 0x1400984e8
mov ecx, 8
mov edx, 0x18
call fcn.14015f6d0
ud2
lea rcx, [0x140186268]
xor edx, edx
jmp 0x1400983e0

Function at 0x140098560
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x14009862e
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140098621
je 0x14009861f
test rdi, rdi
je 0x1400985a8
movups xmm6, xmmword [rdi + 8]
test byte [rdi], 1
mov qword [rdi], 0
jne 0x1400985c4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x140098648
movups xmmword [rax], xmm6
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14009861a
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rax, rsi
jmp 0x140098621
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14013ad90
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14009858d
jmp 0x140098621
mov ecx, 8
mov edx, 0x18
call fcn.14015f6d0
int3
mov rdx, rcx
mov rcx, qword [0x1401865d0]
jmp 0x140098560
Function at 0x140098660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x140098760
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140098758
je 0x140098756
test rbx, rbx
je 0x1400986a2
mov rdi, qword [rbx]
mov qword [rbx], 0
test rdi, rdi
jne 0x1400986e1
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x28
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x14009878b
mov rdi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov byte [rax + 0x20], 0
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x14009877a
mov qword [rax], rdi
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140098751
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14009873e
mov rcx, rdi
call fcn.14007bbd0
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rax, rsi
jmp 0x140098758
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call fcn.14013ad90
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140098688
jmp 0x140098758
mov ecx, 8
mov edx, 0x10
call fcn.14015f6d0
ud2
mov ecx, 8
mov edx, 0x28
call fcn.14015f6d0
mov rsi, rax
mov edx, 0x10
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rcx, rsi
call fcn.140183770
mov rsi, rax
lock dec qword [rdi]
jne 0x1400987cb
lea rcx, [rsp + 0x20]
call fcn.14007bbd0
mov rcx, rsi
call fcn.140183770
call fcn.14016c600
int3
mov rdx, rcx
lea rcx, [0x140186248]
jmp 0x140098660
Function at 0x1400987e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1401c9bd8]
jmp 0x1400987e0
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x1400988fb
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140098939
je 0x14009882a
test rdi, rdi
je 0x140098831
lea rcx, [rdi + 8]
test byte [rdi], 1
mov qword [rdi], 0
lea rax, [0x14019d1b0]
cmovne rax, rcx
jmp 0x140098838
xor eax, eax
jmp 0x140098939
lea rax, [0x14019d1b0]
mov rcx, qword [rax + 0x40]
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x68], esi
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x50
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x140098941
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140098936
mov rax, qword [rdi + 8]
cmp rax, 2
je 0x140098923
mov rcx, rdi
add rcx, 0x10
test rax, rax
je 0x140098915
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x140098923
call fcn.14007b510
jmp 0x140098923
call fcn.14013ad90
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140098808
jmp 0x140098939
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x140098923
call fcn.14007ba10
mov edx, 0x50
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov ecx, 8
mov edx, 0x50
call fcn.14015f6d0
ud2
Function at 0x14009bdc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x14009862e
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140098621
je 0x14009861f
test rdi, rdi
je 0x1400985a8
movups xmm6, xmmword [rdi + 8]
test byte [rdi], 1
mov qword [rdi], 0
jne 0x1400985c4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [0x1401c9cd8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.14002d190
test rax, rax
je 0x140098648
movups xmmword [rax], xmm6
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14009861a
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.14002d1a0
mov rax, rsi
jmp 0x140098621
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14013ad90
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14009858d
jmp 0x140098621
mov ecx, 8
mov edx, 0x18
call fcn.14015f6d0
int3
mov rdx, rcx
mov rcx, qword [0x1401865d0]
jmp 0x140098560

Function at 0x1400a33b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov rcx, qword [0x1401c9bd8]
jmp 0x1400987e0