joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078200
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rdx + 8]
mov rbx, r9
mov rdi, r8
mov rsi, rcx
test rax, rax
je 0x1400783bc
cmp dword [rax + 8], 0
je 0x1400783bc
test r8, r8
je 0x14007823a
cmp byte [r8], 0
jne 0x14007823c
xor edi, edi
test rbx, rbx
je 0x140078247
cmp byte [r9], 0
jne 0x140078249
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r9, qword [rsp + 0x68]
mov rdx, rbx
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edx, eax
cmp eax, 0x273f
jg 0x140078320
je 0x140078304
test eax, eax
je 0x1400782e8
sub edx, 8
je 0x1400782cc
sub edx, 0x271e
je 0x1400782b0
cmp edx, 0x16
jne 0x14007833a
mov dword [rsp + 0x20], 0x273c
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0x2726
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], reloc.WS2_32.dll_ntohl
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0x273f
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
sub edx, 0x277d
je 0x1400783a3
sub edx, 0x37c
je 0x14007838a
sub edx, 1
je 0x140078371
cmp edx, 1
je 0x140078358
call fcn.14010c950
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rbx
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0x2afb
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0x2afa
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0x2af9
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0x277d
call fcn.14010c950
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1400783d3
mov dword [rsp + 0x20], 0x3e3
call fcn.14010c950
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movups xmmword [rax], xmm0
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140078d70
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov dword [rsp + 0x48], 1
call fcn.14010c950
mov rbx, qword [rbx + 8]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
lea r9, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x44], eax
lea r8d, [rax + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.14010c950
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x140078df4
cmp eax, 0x4d2
jne 0x140078df9
call fcn.14010c950
test ebx, ebx
jne 0x140078e02
call fcn.14010c950
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010a950
add rsp, 0x60
pop rbx
ret

Function at 0x1400791c0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub rsp, 0x28
cmp edx, 2
jne 0x1400791ff
mov qword [rsp + 0x20], rbx
lea rbx, [rcx + 0x58]
mov rcx, rbx
call fcn.140078cf0
mov rcx, rbx
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx], 0xffffffffffffffff
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.140078750
add rsp, 0x28
ret
Function at 0x140079e70
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x140079ec0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140076f30
jmp 0x140079f58
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140079ee0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.140076f30
jmp 0x140079f58
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x140079f4c
cmp eax, 0x3e5
je 0x140079f4c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140076f30
jmp 0x140079f58
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140076ea0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010a950
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x140079f70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x140079fc0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.140076f30
jmp 0x14007a071
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140079fe3
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.140076f30
jmp 0x14007a071
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14007a032
mov eax, 0x2746
jmp 0x14007a03f
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x14007a065
cmp eax, 0x3e5
je 0x14007a065
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.140076f30
jmp 0x14007a071
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.140076ea0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010a950
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x14007a6f0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
xor r14d, r14d
test rax, rax
mov rbp, rcx
mov ecx, dword [0x1401a5e64]
mov rsi, r8
mov rdi, rdx
lea rbx, [rax + 0x28]
cmove rbx, r14
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007a735
cmp qword [rax], rbx
je 0x14007a75e
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14007a727
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi]
cmp byte [rax + 0x60], r14b
je 0x14007a7bd
mov qword [rsi + 0x20], r14
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x14007a79b
mov qword [rcx + 0x20], rsi
jmp 0x14007a79f
mov rcx, qword [rdi]
mov rbx, qword [rax + 8]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rbx, rbx
je 0x14007a742
mov rax, qword [rdi]
cmp byte [rax + 0x60], r14b
jne 0x14007a742
mov byte [rax + 0x60], 1
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rax + 0x68], rsi
mov qword [rax + 0x70], rsi
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov byte [rax + 0x60], 1
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov qword [rsi + 0x20], r14
mov rcx, qword [rax + 0x80]
test rcx, rcx
je 0x14007a7e7
mov qword [rcx + 0x20], rsi
jmp 0x14007a7eb
mov qword [rax + 0x78], rsi
mov qword [rax + 0x80], rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x28]
lock inc dword [rcx + 0x30]
call fcn.140076e20
xor al, al
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007b020
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov rax, qword [rdx + 0x10]
mov qword [rcx], rax
add rcx, 8
call fcn.1400763f0
nop
mov ecx, 0x18
call fcn.14010a978
mov rdi, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea ecx, [rax + 0x38]
call fcn.14010a978
mov rbx, rax
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
mov rcx, rbx
call fcn.1400763f0
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], 0
mov qword [rdi], rbx
mov eax, 1
lock xadd dword [0x1401a5db0], eax
inc eax
cmp eax, 1
jne 0x14007b0de
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1401a5db4], eax
xor ebx, ebx
lock xadd dword [0x1401a5db4], ebx
test ebx, ebx
jne 0x14007b17f
mov ecx, 0xa8
call fcn.14010a978
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0xa8
mov rcx, rax
call fcn.14010eb70
mov r8d, 0xffffffff
mov rdx, rdi
mov rcx, rbx
call fcn.140076910
nop
mov rdx, rax
mov rcx, rdi
call fcn.140077750
mov qword [rdi + 0x10], rax
mov qword [rsi + 0x30], rdi
mov rcx, qword [rdi + 0x10]
mov qword [rsi + 0x38], rcx
mov qword [rsi + 0x40], rdi
mov byte [rsi + 0x48], 1
mov rcx, qword [rdi + 0x10]
lock inc dword [rcx + 0x30]
mov qword [rsi + 0x50], 0
mov rax, rsi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14010a950
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x3c], 0
call fcn.14010c950
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rax
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1400152f0
int3
Function at 0x14007d520
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], 0x67452301
mov dword [rsp + 0x4c], 0xefcdab89
mov dword [rsp + 0x50], 0x98badcfe
mov dword [rsp + 0x54], 0x10325476
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14007d57f
mov rax, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14007d210
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.14007d320
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov dword [rsp + 0x30], 1
mov byte [rsp + 0x20], 0
mov r9d, select
xor r8d, r8d
mov edx, r9d
mov rcx, rbx
call fcn.14001e810
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14007d5e5
mov rax, qword [rbx]
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rax], xmm0
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x140080130
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140080205
test edx, edx
jne 0x140080176
mov rcx, qword [rcx + 0x58]
mov rcx, qword [rcx + 0x10]
call fcn.140076d90
mov rcx, qword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.1400765d0
mov rax, qword [rcx + 0x58]
mov rcx, qword [rax + 0x10]
xor eax, eax
xchg dword [rcx + 0x34], eax
mov ecx, 0x18
call fcn.14010a978
mov rsi, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov rbx, qword [rdi + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
lea ecx, [rax + 0x20]
call fcn.14010a978
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
lea rcx, vtable.boost::asio::detail::win_thread::func_class_boost::asio::detail::resolver_service_base::work_io_context_runner_.0
mov qword [rax], rcx
mov qword [rax + 0x18], rbx
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140076680
nop
mov rbx, qword [rdi + 0x78]
test rbx, rbx
je 0x140080201
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x18
mov rcx, rbx
call fcn.14010a970
mov qword [rdi + 0x78], rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140092c40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov rbx, rdx
mov rsi, rcx
mov byte [rsp + 0x41], 1
lea rcx, [rsp + 0x48]
call fcn.140096370
movups xmm0, xmmword [rbx + 0xc8]
movaps xmmword [rsp + 0x110], xmm0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1401a5e64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebp, ebp
test rax, rax
je 0x140092cd8
mov rax, qword [rax + 8]
test rax, rax
je 0x140092cd8
mov rdi, qword [rax]
test rdi, rdi
je 0x140092cd8
mov qword [rax], rbp
movzx eax, byte [rdi]
cmp al, 0x48
jb 0x140092cd0
mov byte [rdi + 0x120], al
jmp 0x140092cec
mov rcx, rdi
call fcn.14010a9e8
mov ecx, 0x121
call fcn.14010a978
mov rdi, rax
mov byte [rax + 0x120], reloc.zlibwapi.dll_Ordinal_72
mov qword [rdi + 0x20], rbp
lea rax, [0x1400a3be0]
mov qword [rdi + 0x28], rax
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], rbp
mov dword [rdi + 0x30], ebp
movzx eax, byte [rsp + 0x41]
mov byte [rdi + 0x39], al
mov byte [rsp + 0x41], bpl
lea rdx, [rsp + 0x48]
lea rcx, [rdi + 0x40]
call fcn.140096370
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [rdi + 0x108], xmm0
mov rax, qword [rsi]
mov rcx, qword [rax + 0x10]
lock inc dword [rcx + 0x30]
mov rdx, rdi
call fcn.140076e20
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x20]
call fcn.14009f090
nop
lea rcx, [rsp + 0x48]
call fcn.14008bac0
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.14010a950
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14009f090
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14009f0b7
add rcx, 0x40
call fcn.14008bac0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14009f10f
mov ecx, dword [0x1401a5e64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14009f0ff
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14009f0ff
cmp qword [rcx], 0
jne 0x14009f0ff
movzx eax, byte [rbx + 0x120]
mov byte [rbx], al
mov qword [rcx], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.14010a9e8
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009f5f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 8], rax
cmp qword [r8 + 0x18], 0x10
mov r10, r8
mov dword [rsp], r9d
jb 0x14009f614
mov r10, qword [r8]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x14009f627
add rax, qword [rdx]
mov rdx, qword [rdx]
jmp 0x14009f62a
add rax, rdx
xor r8d, r8d
cmp rdx, rax
je 0x14009f65a
sub r10, rdx
nop word [rax + rax]
movzx ecx, byte [rsp + r8]
xor cl, byte [rdx]
inc r8
mov byte [r10 + rdx], cl
and r8d, 3
inc rdx
cmp rdx, rax
jne 0x14009f640
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.14010a950
add rsp, 0x18
ret
Function at 0x1400a2070
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, r8
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a20c2
nop
cmp qword [rax], rbx
je 0x1400a21bc
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400a20b0
mov qword [rsp + 0x30], rdi
mov rdx, rdi
mov ecx, 0xd8
call fcn.1400762f0
mov rbx, rax
xor r15d, r15d
mov qword [rax + 0x20], r15
lea rax, [fcn.1400a3a80]
mov qword [rbx + 0x28], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x30], r15d
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.1400a4ad0
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.14007a6f0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
test al, al
je 0x1400a222c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov rax, qword [r14]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rsi, qword [rbp + 0x28]
mov qword [rsp + 0x20], rsi
mov rdi, qword [r14]
mov qword [rsp + 0x28], rdi
call fcn.14010c950
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.1400a3a80
nop
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400a21ec
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x1400a21d5
mov qword [rax + 0x20], rcx
jmp 0x1400a21d9
cmp qword [rax + 8], 0
je 0x1400a20c2
mov rdx, rdi
mov rcx, rdi
call fcn.1400ada20
nop
jmp 0x1400a222c
mov qword [rdi + 0x78], rcx
mov rax, qword [rdi + 0x70]
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x68], r15
mov qword [rdi + 0x70], r15
mov rbx, qword [rdi + 0x78]
test rbx, rbx
setne al
mov byte [rdi + 0x60], al
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400a221a
lock inc dword [rsi + 0x30]
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140076e20
nop
mov rdx, qword [rsp + 0x68]
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a33b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdx, [rsi + 0x10]
mov qword [rsp + 0x20], rsi
mov ecx, 0x88
call fcn.1400762f0
mov rdi, rax
lea rdx, [rsi + 0x10]
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [0x1400a4900]
mov qword [rdi + 0x28], rax
lea rcx, [rdi + 0x48]
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
mov dword [rdi + 0x30], r14d
movups xmm0, xmmword [rsi]
movups xmmword [rdi + 0x38], xmm0
call fcn.1400850c0
mov rcx, qword [rbp + 0x10]
lock inc dword [rcx + 0x30]
mov rdx, rdi
call fcn.140076e20
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
call fcn.1400a4890
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400aace0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, r8
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400aad32
nop
cmp qword [rax], rbx
je 0x1400aae2c
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400aad20
mov qword [rsp + 0x30], rdi
mov rdx, rdi
mov ecx, 0xb0
call fcn.1400762f0
mov rbx, rax
xor r15d, r15d
mov qword [rax + 0x20], r15
lea rax, [fcn.1400ab600]
mov qword [rbx + 0x28], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x30], r15d
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.1400abb60
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.14007a6f0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
test al, al
je 0x1400aae9c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov rax, qword [r14]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rsi, qword [rbp + 0x28]
mov qword [rsp + 0x20], rsi
mov rdi, qword [r14]
mov qword [rsp + 0x28], rdi
call fcn.14010c950
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.1400ab600
nop
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400aae5c
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x1400aae45
mov qword [rax + 0x20], rcx
jmp 0x1400aae49
cmp qword [rax + 8], 0
je 0x1400aad32
mov rdx, rdi
mov rcx, rdi
call fcn.1400ae690
nop
jmp 0x1400aae9c
mov qword [rdi + 0x78], rcx
mov rax, qword [rdi + 0x70]
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x68], r15
mov qword [rdi + 0x70], r15
mov rbx, qword [rdi + 0x78]
test rbx, rbx
setne al
mov byte [rdi + 0x60], al
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400aae8a
lock inc dword [rsi + 0x30]
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140076e20
nop
mov rdx, qword [rsp + 0x68]
mov ecx, dword [0x1401a5e84]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret