joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400de775
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683

Function at 0x1400de994
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
movss dword [rbp - 0x6c], xmm3
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], rcx
mov eax, 0x10
mov qword [rbp - 0x50], rax
call fcn.140195b60
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x48], rcx
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov ecx, 0xb8
mov edx, 8
sub rsp, 0x20
call fcn.140019bef
add rsp, 0x20
mov qword [rbp - 0x30], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
add rsp, 0x20
xor eax, eax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp + rax - 0x10], xmm0
movabs rcx, 0xfcd445489c4ae7aa
movabs rdx, 0xfcd445489c4ae7ba
xor rcx, rdx
add rax, rcx
movabs rcx, 0x83180e3f300c47df
movabs rdx, 0x83180e3f300c475f
xor rcx, rdx
cmp rax, rcx
mov qword [rbp - 0x28], rax
jne 0x1400dea31
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x58]
add rdx, 0x60
mov qword [rbp - 0x78], rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
lea rdx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400d254d
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax + 0x60]
mov cl, 9
xor cl, 9
cmp al, cl
jne 0x1400deb58
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400d03d0
mov rax, qword [rbp - 0x78]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xcf
xor cl, 0xcf
cmp al, cl
jne 0x1400deb58
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x60]
add rcx, 0x98
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140021260
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x30]
add rsp, 0x20
add rcx, 0x80
mov rdx, qword [rax]
mov qword [rbp - 0x20], rdx
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
sub rsp, 0x20
call fcn.14004a998
movss xmm0, dword [rbp - 0x6c]
mov rax, qword [rbp - 0x30]
add rsp, 0x20
movss dword [rax + 0x90], xmm0
mov rax, qword [rbp - 0x30]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x1400ef0c8
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov eax, 0x30
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
add rsp, 0x20
xor eax, eax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
xorps xmm0, xmm0
movups xmmword [rcx + rax], xmm0
add rax, 0x10
movabs rcx, 0x319a5a1264f47d05
movabs rdx, 0x319a5a1264f47d35
xor rcx, rdx
cmp rax, rcx
mov qword [rbp - 8], rax
jne 0x1400ef102
mov rcx, qword [rbp - 0x10]
mov rax, qword [str._bee_]
sub rsp, 0x20
call qword [rax]
mov rax, qword [rbp - 0x10]
add rsp, 0x20
mov eax, dword [rax + 0x20]
mov rsp, rbp
pop rbp
ret

Function at 0x1400f3b2a
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140019683
Function at 0x14010b483
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x50], rcx
mov eax, 0x10
mov qword [rbp - 0x48], rax
call fcn.140195b60
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov rcx, rsp
mov qword [rbp - 8], rcx
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x40], rax
mov rax, qword [0x1401a1928]
mov qword [rbp - 0x20], rax
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
mov r9, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov r10, rax
mov rax, qword [rbp - 0x20]
mov qword [rbp + 8], r10
xor r10d, r10d
mov qword [rbp], r10
mov qword [r9], r10
mov r11, r9
add r11, 8
mov qword [rbp - 0x18], r11
mov qword [r9 + 8], r10
mov dword [rcx], r8d
mov qword [rcx + 8], rdx
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov r9, qword [rbp]
add rsp, 0x20
xorps xmm0, xmm0
movaps xmmword [rdx], xmm0
sub rsp, 0x40
mov rax, rsp
mov qword [rax + 0x30], rdx
mov qword [rax + 0x20], r9
mov dword [rax + 0x28], 0
mov rdx, r9
mov r8, r9
call fcn.1400a4467
add rsp, 0x40
mov ecx, eax
mov rax, qword [rbp + 8]
mov al, byte [rax + 0x60]
test al, al
setne al
test ecx, ecx
sete cl
or al, cl
test al, 1
jne 0x14010b646
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
movsxd rdx, dword [rax]
sub rsp, 0x20
call fcn.14001b50c
mov rax, qword [rbp - 0x40]
add rsp, 0x20
mov eax, dword [rax]
mov dword [rbp - 0x54], eax
mov ecx, 0x1a844134
xor ecx, 0x1a844134
cmp eax, ecx
je 0x14010b631
mov ecx, dword [rbp - 0x54]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x18]
mov rdx, qword [rdx]
add rdx, 8
mov qword [rbp - 0x78], rdx
mov rax, qword [rax + 8]
mov qword [rbp - 0x70], rax
movsxd rax, ecx
mov qword [rbp - 0x68], rax
xor eax, eax
cmp ecx, 0
mov qword [rbp - 0x60], rax
jle 0x14010b631
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
mov r8b, byte [r8 + rax]
mov byte [rdx + rax], r8b
movabs rdx, 0xd725fd3aa5ec0196
movabs r8, 0xd725fd3aa5ec0197
xor rdx, r8
add rax, rdx
cmp rax, rcx
mov qword [rbp - 0x60], rax
jne 0x14010b5f2
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax + 8]
sub rsp, 0x20
call fcn.1400a6997
add rsp, 0x20
mov rax, qword [rbp - 0x50]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x14010ebfb
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x40], rcx
mov eax, 0x10
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov rax, qword [0x1401a1928]
mov qword [rbp - 0x30], rax
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rcx
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
add rsp, 0x20
xor eax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp + rax - 0x10], xmm0
xor ecx, ecx
sub rcx, rax
movabs rax, 0xa533f7be95155d36
movabs rdx, 0xa533f7be95155d36
xor rax, rdx
movabs rdx, 0x79b4fd47aad0793f
movabs r8, 0x79b4fd47aad0792f
xor rdx, r8
sub rax, rdx
add rcx, rax
xor eax, eax
sub rax, rcx
movabs rcx, 0x4fe86ef292480fcc
movabs rdx, 0x4fe86ef292480ffc
xor rcx, rdx
cmp rax, rcx
mov qword [rbp - 0x18], rax
jne 0x14010ec85
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x48]
add rdx, 0x60
mov qword [rbp - 0x50], rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
lea rdx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400c1f70
mov rax, qword [rbp - 0x28]
add rsp, 0x20
mov al, byte [rax + 0x60]
mov cl, 0xe6
xor cl, 0xe6
cmp al, cl
jne 0x14010edb9
mov al, byte [rbp - 0x10]
test al, al
sete dl
lea rax, [rbp - 8]
mov qword [rbp - 0x70], rax
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x68], rcx
test rcx, rcx
setle al
or dl, al
xor eax, eax
test dl, 1
mov qword [rbp - 0x60], rcx
mov byte [rbp - 0x51], al
jne 0x14010eda8
mov rcx, qword [rbp - 0x68]
sub rsp, 0x20
call fcn.14008c8b2
add rsp, 0x20
mov cl, al
mov rax, qword [rbp - 0x50]
mov byte [rbp - 0x71], cl
mov al, byte [rax]
mov cl, 0xb9
xor cl, 0xb9
cmp al, cl
jne 0x14010edb9
mov rcx, qword [rbp - 0x70]
mov al, byte [rbp - 0x71]
and al, 1
mov rcx, qword [rcx]
mov qword [rbp - 0x60], rcx
mov byte [rbp - 0x51], al
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
mov dl, byte [rbp - 0x51]
mov byte [rax], dl
mov qword [rax + 8], rcx
mov rax, qword [rbp - 0x48]
mov rax, qword [rax + 8]
mov qword [rbp - 0x80], rax
cmp rax, 0
je 0x14010ee0b
mov rax, qword [rbp - 0x80]
mov rax, qword [rax]
movabs rcx, 0x2fc7e9d614d83b61
movabs rdx, 0x6fc7e9d614d83b61
xor rcx, rdx
and rax, rcx
cmp rax, 0
jne 0x14010ee0b
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call fcn.1400121d0
add rsp, 0x20
mov rax, qword [rbp - 0x40]
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1401270ed
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683
Function at 0x140144f42
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140019683

Function at 0x14015927a
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683

Function at 0x140162215
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683
Function at 0x1401682b5
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov qword [rsp + 0x28], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
xor eax, eax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + rax + 0x38], xmm0
add rax, 0x10
movabs rcx, 0x463d00bf741adf3a
movabs rdx, 0x463d00bf741adf7a
xor rcx, rdx
cmp rax, rcx
mov qword [rsp + 0x30], rax
jne 0x1401682e1
mov dword [rsp + 0x38], 0x40
lea rcx, [rsp + 0x38]
call fcn.1400a6a49
mov rcx, qword [rsp + 0x28]
mov cl, byte [rcx + 0x60]
test cl, cl
sete dl
sub eax, 1
sete al
and dl, al
mov rcx, qword [rsp + 0x40]
movabs rax, 0x731907d9c82dfec3
movabs r8, 0x8ce6f82637d2013c
xor rax, r8
test dl, 1
cmovne rax, rcx
add rsp, 0x78
ret
Function at 0x14016b439
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683
Function at 0x1401758a1
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140019683

Function at 0x14017b4b1
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683
Function at 0x140181bf1
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rdx]
mov qword [rsp + 0x60], rax
movabs rcx, 0xb4348da452043463
movabs rdx, 0xb4348da452043463
xor rcx, rdx
cmp rax, rcx
jle 0x140181ed9
mov rdx, qword [rsp + 0x60]
movabs rcx, 0x4ee8235a6d5cb4c7
movabs rax, 0x4ee8235a6d5cb4c6
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x48], rax
movabs r8, 0xd6a85f04be272b3f
movabs rcx, 0x2957a0fb41d8d4c0
xor r8, rcx
mov rcx, rdx
xor rcx, r8
and rcx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
or rcx, rdx
and rax, rcx
movabs rcx, 0xc41236aad02c83f
movabs rdx, 0xc41236aad02c83f
xor rcx, rdx
cmp rax, rcx
jge 0x140181cad
call fcn.14000a590
jmp 0x140181ed9
mov rax, qword [rsp + 0x48]
movabs rcx, 0xc9fc0d46b8e228e9
movabs rdx, 0xc9fc0d46b8e228e9
xor rcx, rdx
cmp rax, rcx
jge 0x140181d0f
mov rcx, qword [rsp + 0x48]
movabs rdx, 0xb9c23c44c67f7b53
movabs rax, 0xb9c23c44c67f7b53
xor rdx, rax
movabs r8, 0xf11cb21f3fb6f2de
movabs rax, 0x8ee34de0c0490d21
xor r8, rax
call fcn.140010917
jmp 0x140181ed9
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 8]
add rcx, 8
add rcx, qword [rdx]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r8b, byte [r8 + rcx]
mov byte [rax + rcx], r8b
movabs r8, 0xfa1ffb0fa480cc65
mov rax, rcx
add rax, r8
movabs r8, 0x4ce48e97f87c78db
movabs r9, 0x4ce48e97f87c78da
xor r8, r9
add rax, r8
movabs r8, 0x90559f134c97677a
movabs r9, 0x6a4a641ce817ab1f
xor r8, r9
sub rax, r8
cmp rcx, rdx
mov qword [rsp + 0x40], rax
jne 0x140181d3d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov r8, qword [rax]
movabs rax, 0x66a6726300e9739a
mov rdx, r8
add rdx, rax
add rdx, rcx
movabs rax, 0xd68f57706e7b63ba
movabs r9, 0xb02925136e921020
xor rax, r9
sub rdx, rax
mov qword [rsp + 0x28], rdx
mov rax, rdx
xor rax, rcx
movabs rcx, 0xd4e764a84b719766
movabs r9, 0x2b189b57b48e6899
xor rcx, r9
mov r9, rdx
xor r9, rcx
mov rcx, r8
and rcx, r9
movabs r9, 0xb0944deb3de6c241
movabs r10, 0x4f6bb214c2193dbe
xor r9, r10
xor r8, r9
and rdx, r8
or rcx, rdx
movabs rdx, 0xe3c85b9b5c72d22d
movabs r8, 0x1c37a464a38d2dd2
xor rdx, r8
xor rax, rdx
xor rcx, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
movabs r8, 0xab22803589c97262
xor rdx, r8
or rax, rcx
movabs rcx, 0xa5c207a873140a85
movabs r8, 0xee0879dfadd78e7
xor rcx, r8
or rcx, rdx
movabs rdx, 0x4fb34dc50d56ded
movabs r8, 0xfb04cb23af2a9212
xor rdx, r8
xor rax, rdx
and rax, rcx
movabs rcx, 0x84c3843087af1b09
movabs rdx, 0x84c3843087af1b09
xor rcx, rdx
cmp rax, rcx
jge 0x140181ecc
call fcn.14000a590
jmp 0x140181ed9
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x68
ret
Function at 0x140184c14
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683

Function at 0x14018e9ce
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140019683

Function at 0x14018f17c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683

Function at 0x14019146c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret

Function at 0x1401941bb
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140019683

Function at 0x14019423a
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov qword [rsp + 0x28], rax
movabs rcx, 0xdab03a74c06d821c
movabs rax, 0xdab03a74c06d823c
xor rcx, rax
call fcn.14004f54e
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rcx
mov al, byte [rax + 0x60]
mov cl, 0xed
xor cl, 0xed
cmp al, cl
jne 0x140134381
mov rax, qword [rsp + 0x30]
mov qword [0x140210d58], rax
add rsp, 0x38
ret
sub rsp, 0x28
call fcn.14004ae30
call fcn.140061d34
call fcn.140062b09
call fcn.140063074
call fcn.140067b18
call fcn.140079106
call fcn.14008d466
call fcn.1400a0258
call fcn.1400c2f70
call fcn.1400eefbf
call fcn.1400efadc
call fcn.14011fd32
nop
add rsp, 0x28
jmp 0x140134325
sub rsp, 0x28
call fcn.1400056b1
call fcn.14000589e
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov ecx, eax
mov rax, qword [0x1401a1928]
mov dword [rax], ecx
mov rdx, qword [0x1401a1938]
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
call fcn.140031224
call fcn.14009c494
call fcn.1400ef040
call fcn.14019200f
nop
add rsp, 0x28
jmp 0x1401941f0

Function at 0x140194d90
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140195c60
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x1401a1360]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140195c60
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140194e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x140210df4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140194fb0
mov rax, qword [0x140210df8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140194e4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140194ed7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140194e30
mov rcx, r12
call fcn.1401958b0
mov rbp, rax
test rax, rax
je 0x14019500d
mov rax, qword [0x140210df8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.1401959e0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140210df8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140194ff2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140194ed0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140194f60
add dword [0x140210df4], 1
cmp ebx, 8
jae 0x140194f08
test bl, 4
jne 0x140194fc0
test ebx, ebx
je 0x140194ef9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140194fe0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140194ef9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x140194f3a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x140210df8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140194ed0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1401a13d8]
mov edx, eax
call fcn.140194d90
xor edi, edi
jmp 0x140194e57
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140194ef9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140194ef9
mov rax, qword [0x140210df8]
mov edx, dword [rbp + 8]
lea rcx, [0x1401a13a0]
mov r8, qword [rax + rdi + 0x18]
call fcn.140194d90
mov rdx, r12
lea rcx, [0x1401a1380]
call fcn.140194d90
nop
nop dword [rax]
Function at 0x140195520
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140210e60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140210e40]
test rbx, rbx
je 0x140195574
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14019556b
test r12, r12
je 0x14019556b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140195550
lea rcx, [0x140210e60]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1401958b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1401a1720]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140195929
mov rcx, r10
call fcn.140195780
test eax, eax
je 0x140195929
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140195926
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x14019591d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140195929
add r8, 0x28
cmp r8, r9
jne 0x140195908
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret