joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400379d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd r14, edx
or rax, 0xffffffffffffffff
xor edx, edx
movsxd r15, ecx
sub r14, r15
mov r12d, 0xffffffff
inc r14
div r14
mov rbp, rdx
not rbp
dec rbp
nop word [rax + rax]
mov edi, 8
lea rsi, [rsp + 0x60]
nop word [rax + rax]
cmp rdi, r12
mov ebx, edi
mov rcx, rsi
cmova ebx, r12d
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x140037a39
int3
mov eax, ebx
add rsi, rax
sub rdi, rax
jne 0x140037a20
mov rax, qword [rsp + 0x60]
cmp rax, rbp
ja 0x140037a10
mov rbx, qword [rsp + 0x50]
xor edx, edx
mov rbp, qword [rsp + 0x58]
div r14
lea eax, [r15 + rdx]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140037a70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov edi, 8
lea rbp, [rsp + 0x70]
mov ebx, edi
mov r14, rcx
mov r15d, 0xffffffff
nop word [rax + rax]
cmp rbx, r15
mov esi, ebx
mov rcx, rbp
cmova esi, r15d
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x140037ab9
int3
mov eax, esi
add rbp, rax
sub rbx, rax
jne 0x140037aa0
mov rbp, qword [rsp + 0x70]
lea rsi, [rsp + 0x70]
nop dword [rax]
cmp rdi, r15
mov ebx, edi
mov rcx, rsi
cmova ebx, r15d
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x140037ae9
int3
mov eax, ebx
add rsi, rax
sub rdi, rax
jne 0x140037ad0
mov r10, qword [rsp + 0x70]
and rbp, 0xffffffffffff4fff
bts rbp, 0xe
movabs rax, 0x3fffffffffffffff
and r10, rax
movzx ecx, bp
movabs rax, 0x8000000000000000
or r10, rax
movabs rax, 0xffffffffffff
mov rdx, r10
shr r10, 0x30
and rdx, rax
mov rax, rbp
mov qword [rsp + 0x30], rdx
lea rdx, str._08x__04x__04x__04x__012llx
shr rax, 0x10
mov dword [rsp + 0x28], r10d
shr rbp, 0x20
mov dword [rsp + 0x20], ecx
mov r8d, ebp
movzx r9d, ax
mov rcx, r14
call fcn.14002c100
mov rbx, qword [rsp + 0x80]
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003c0b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov edi, r9d
mov ecx, 0x10
mov r14, r8
mov rbx, rdx
call fcn.140080c00
mov r15, rax
lea r8, [0x14003be90]
test r14, r14
mov r9, r15
setne dl
mov qword [rax], rbx
mov byte [rax + 8], dl
mov edx, 0x10000
mov dword [rax + 0xc], edi
xor eax, eax
mov qword [rsp + 0x28], rax
test rsi, rsi
cmove edx, eax
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14003c12e
mov rcx, r15
call fcn.140080c40
xor al, al
jmp 0x14003c143
test r14, r14
je 0x14003c138
mov qword [r14], rax
jmp 0x14003c141
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x14003d170
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [0x1400c8f20]
mov rbx, rcx
mov qword [rcx], rax
xor ebp, ebp
add rcx, 8
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdi, rdx
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], rbp
mov byte [rcx], bpl
call fcn.140003580
lea rax, [0x1400c8aa0]
mov dword [rbx + 0x28], ebp
mov qword [rbx], rax
lea ecx, [rbp + 0x20]
mov qword [rbx + 0x30], rbp
mov byte [rbx + 0x38], bpl
call fcn.140080c00
cmp qword [rdi + 0x18], 0x10
mov rsi, rax
jb 0x14003d1ee
mov rcx, qword [rdi]
jmp 0x14003d1f1
mov rcx, rdi
mov rax, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x44], ebp
call fcn.140065470
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400655f0
mov rdx, qword [rsp + 0x20]
mov rcx, rsi
bswap rdx
call fcn.140057fa0
mov ecx, 0x20
mov qword [rbx + 0x40], rax
call fcn.140080c00
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx + 8]
mov rcx, rax
mov rdx, qword [rdx]
call fcn.140057fa0
mov qword [rbx + 0x48], rax
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400812a0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003d2a0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, qword [rsp + 0x100]
lea rax, [0x1400c8f20]
mov qword [rcx], rax
mov rdi, r8
mov rbx, rcx
mov qword [rcx + 0x20], 0xf
add rcx, 8
xor r12d, r12d
mov rbp, r9
mov rsi, rdx
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
mov qword [rcx + 0x10], r12
mov byte [rcx], r12b
call fcn.140003580
lea rax, [0x1400c8aa0]
mov dword [rbx + 0x28], r12d
mov qword [rbx], rax
lea ecx, [r12 + 0x30]
mov qword [rbx + 0x30], r12
mov byte [rbx + 0x38], r12b
call fcn.140080c00
cmp qword [rdi + 0x18], 0x10
mov r15, rax
jb 0x14003d336
mov rcx, qword [rdi]
jmp 0x14003d339
mov rcx, rdi
mov rax, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x44], r12d
call fcn.140065470
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400655f0
mov rdx, qword [rsp + 0x20]
mov r9, rbp
bswap rdx
mov r8, rsi
mov rcx, r15
call fcn.140057060
mov ecx, 0x30
mov qword [rbx + 0x40], rax
call fcn.140080c00
mov rcx, qword [rbx + 0x40]
mov r9, r14
mov r8, rsi
mov rdx, qword [rcx + 8]
mov rcx, rax
mov rdx, qword [rdx]
inc rdx
call fcn.140057060
mov qword [rbx + 0x48], rax
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003df10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rdi, rcx
add rcx, 0x70
call fcn.140016600
lea rcx, [rdi + 0x28]
call fcn.14003da10
lea rcx, [rdi + 0x70]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebp, ebp
jne 0x14003df8c
mov rax, qword [0x1400dc760]
test rax, rax
jne 0x14003df6d
lea r9d, [rbp + 0x32]
mov r8d, 0x3e8
lea rcx, str.ActivityTracker.ThreadTrackers.MemLimitTrackerCount
call fcn.14004c020
mov qword [0x1400dc760], rax
mov edx, dword [rdi + 0x24]
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rdi]
mov edx, ebp
mov qword [rsp + 0x40], rsi
call fcn.14003e5c0
mov ecx, 0x30
mov rbx, rax
call fcn.140080c00
mov r8, qword [rdi + 8]
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.14003dbc0
lea rax, [0x1400c8b30]
mov dword [rsi + 0x20], ebp
mov qword [rsi], rax
mov qword [rsi + 0x28], rbx
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x14003dfe7
call fcn.140027ad0
mov rdx, rax
movsxd rax, dword [rdi + 0x1c]
mov ebx, 1
add rax, rax
mov qword [rdx + rax*8], rsi
movsxd rcx, dword [rdi + 0x1c]
mov eax, dword [rdi + 0x20]
add rcx, rcx
mov dword [rdx + rcx*8 + 8], eax
lock xadd dword [rdi + 0x24], ebx
mov rax, qword [0x1400dc768]
test rax, rax
jne 0x14003e031
lea r9d, [rax + 0x65]
lea r8d, [rax + 0x64]
lea rcx, str.ActivityTracker.ThreadTrackers.Count
call fcn.14004e7c0
mov qword [0x1400dc768], rax
mov r8, qword [rax]
lea edx, [rbx + 1]
mov rcx, rax
call qword [r8 + 0x20]
mov rbx, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003e220
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
mov rbx, qword [0x1400dc758]
mov r15, r8
mov r12, rdx
mov rdi, rcx
test rbx, rbx
jne 0x14003e259
xor esi, esi
mov rax, rcx
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, dword [0x1400d6d18]
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x14003e27a
call fcn.140027ad0
mov rcx, rax
movsxd rbp, dword [rbx + 0x1c]
xor esi, esi
mov eax, dword [rbx + 0x20]
add rbp, rbp
cmp dword [rcx + rbp*8 + 8], eax
je 0x14003e290
mov ebp, esi
jmp 0x14003e294
mov rbp, qword [rcx + rbp*8]
mov qword [rdi], rbp
test rbp, rbp
je 0x14003e325
mov rax, qword [rbp + 8]
mov qword [rsp + 0x40], r14
mov r14d, dword [rax + 0x38]
cmp r14d, dword [rbp + 0x18]
jb 0x14003e2b9
mov rax, qword [rbp + 8]
jmp 0x14003e315
mov rbx, r14
lea rcx, [rsp + 0x80]
shl rbx, 7
add rbx, qword [rbp + 0x10]
call qword [0x1400d6ca0]
mov byte [rsp + 0x20], 1
mov rcx, qword [rax]
mov qword [rbx], rcx
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], rsi
mov byte [rbx + 0x70], 0x20
mov qword [rbx + 0x78], r15
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rbx + 0x18], rsi
mov rax, qword [rbp + 8]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rcx
lea ecx, [r14 + 1]
mov dword [rax + 0x38], ecx
mov dword [rdi + 8], r14d
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rax, rdi
mov qword [rdi + 0x10], rsi
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003e340
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
mov rbx, qword [0x1400dc758]
mov r15, r8
mov r12, rdx
mov rdi, rcx
test rbx, rbx
jne 0x14003e379
xor esi, esi
mov rax, rcx
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, dword [0x1400d6d18]
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x14003e39a
call fcn.140027ad0
mov rcx, rax
movsxd rbp, dword [rbx + 0x1c]
mov eax, dword [rbx + 0x20]
add rbp, rbp
cmp dword [rcx + rbp*8 + 8], eax
jne 0x14003e3b3
mov rbp, qword [rcx + rbp*8]
test rbp, rbp
jne 0x14003e3be
mov rcx, rbx
call fcn.14003df10
mov rbp, rax
xor esi, esi
mov qword [rdi], rbp
test rbp, rbp
je 0x14003e451
mov rcx, qword [rbp + 8]
mov qword [rsp + 0x40], r14
mov r14d, dword [rcx + 0x38]
cmp r14d, dword [rbp + 0x18]
jb 0x14003e3e5
mov rax, qword [rbp + 8]
jmp 0x14003e441
mov rbx, r14
lea rcx, [rsp + 0x80]
shl rbx, 7
add rbx, qword [rbp + 0x10]
call qword [0x1400d6ca0]
mov byte [rsp + 0x20], 1
mov rcx, qword [rax]
mov qword [rbx], rcx
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], rsi
mov byte [rbx + 0x70], 0x30
mov qword [rbx + 0x78], r15
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rbx + 0x18], rsi
mov rax, qword [rbp + 8]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rcx
lea ecx, [r14 + 1]
mov dword [rax + 0x38], ecx
mov dword [rdi + 8], r14d
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rax, rdi
mov qword [rdi + 0x10], rsi
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003e470
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x58
mov rdi, rcx
xor r15d, r15d
mov rcx, qword [r8]
mov r14, rdx
mov qword [rsp + 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov rbx, qword [0x1400dc758]
mov dword [rsp + 0x80], eax
test rbx, rbx
jne 0x14003e4bd
mov qword [rdi], r15
mov rax, rdi
mov qword [rdi + 0x10], r15
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rbx
ret
mov ecx, dword [0x1400d6d18]
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x14003e4de
call fcn.140027ad0
mov rcx, rax
movsxd rsi, dword [rbx + 0x1c]
mov eax, dword [rbx + 0x20]
add rsi, rsi
cmp dword [rcx + rsi*8 + 8], eax
jne 0x14003e4f7
mov rsi, qword [rcx + rsi*8]
test rsi, rsi
jne 0x14003e502
mov rcx, rbx
call fcn.14003df10
mov rsi, rax
mov qword [rdi], rsi
test rsi, rsi
je 0x14003e59a
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x88], rbp
mov ebp, dword [rcx + 0x38]
cmp ebp, dword [rsi + 0x18]
jb 0x14003e528
mov rax, qword [rsi + 8]
jmp 0x14003e589
mov rbx, rbp
lea rcx, [rsp + 0x90]
shl rbx, 7
add rbx, qword [rsi + 0x10]
call qword [0x1400d6ca0]
mov byte [rsp + 0x30], 1
mov rcx, qword [rax]
mov rax, qword [rsp + 0x80]
mov qword [rbx + 0x78], rax
mov qword [rbx], rcx
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r15
mov byte [rbx + 0x70], 0x41
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
mov qword [rbx + 0x18], r15
mov rax, qword [rsi + 8]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x20], rcx
lea ecx, [rbp + 1]
mov dword [rax + 0x38], ecx
mov dword [rdi + 8], ebp
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x50]
mov rax, rdi
mov qword [rdi + 0x10], r15
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rbx
ret

Function at 0x140044c10
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x140044c32
call fcn.140027ad0
mov rcx, rax
movsxd rbx, dword [0x1400dc77c]
mov eax, dword [0x1400dc780]
add rbx, rbx
cmp dword [rcx + rbx*8 + 8], eax
jne 0x140044c63
mov rbx, qword [rcx + rbx*8]
cmp rbx, 0xffffffffffffffff
jne 0x140044c5a
xor eax, eax
add rsp, 0x20
pop rbx
ret
test rbx, rbx
jne 0x140044cf8
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140044c7f
call fcn.140027ad0
mov rdx, rax
movsxd rax, dword [0x1400dc77c]
add rax, rax
mov qword [rdx + rax*8], 0xffffffffffffffff
movsxd rcx, dword [0x1400dc77c]
mov eax, dword [0x1400dc780]
add rcx, rcx
mov dword [rdx + rcx*8 + 8], eax
mov ecx, 0x40
call fcn.140080c00
mov rcx, rax
call fcn.140044d10
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140044cd6
call fcn.140027ad0
mov rdx, rax
movsxd rcx, dword [0x1400dc77c]
add rcx, rcx
mov qword [rdx + rcx*8], rbx
movsxd rcx, dword [0x1400dc77c]
mov eax, dword [0x1400dc780]
add rcx, rcx
mov dword [rdx + rcx*8 + 8], eax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400452d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rcx + 0x10], rdx
lea rax, [0x1400c8b88]
mov qword [rcx], rax
xor ebx, ebx
lea rax, [0x1400c8be8]
mov rbp, rdx
mov qword [rcx + 8], rax
mov rdi, rcx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov rax, qword [rdx + 0x340]
mov dword [rcx + 0x28], eax
call fcn.140060cc0
mov ecx, dword [0x1400d6d18]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140045339
call fcn.140027ad0
mov rdx, rax
movsxd rcx, dword [rsi + 4]
mov eax, dword [rsi + 8]
add rcx, rcx
mov rsi, rbx
cmp dword [rdx + rcx*8 + 8], eax
jne 0x140045350
mov rsi, qword [rdx + rcx*8]
mov ecx, 0x28
mov qword [rsp + 0x78], rsi
call fcn.140080c00
mov rdx, rdi
mov rcx, rax
call fcn.140060d40
lea rcx, [rsi + 0xe8]
mov rdx, rax
call fcn.1400611a0
call fcn.140060b70
mov ecx, dword [0x1400d6d18]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x14004539d
call fcn.140027ad0
mov rdx, rax
movsxd rcx, dword [rsi + 4]
mov eax, dword [rsi + 8]
add rcx, rcx
cmp dword [rdx + rcx*8 + 8], eax
jne 0x1400453b6
mov rbx, qword [rdx + rcx*8]
test rbx, rbx
jne 0x1400453b7
int3
mov rcx, qword [rbx]
mov qword [rsp + 0x70], rcx
test rcx, rcx
je 0x1400453ce
mov eax, 1
lock xadd dword [rcx + 8], eax
call fcn.14005e270
mov rcx, rax
lea r9, [rsp + 0x70]
lea r8, str.ThreadLocalEventBuffer
lea rdx, [rdi + 8]
call fcn.14005eac0
call fcn.14001e9c0
mov rdx, rax
lea r8, [rbp + 8]
lea rcx, [rsp + 0x30]
call fcn.14003e220
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea rcx, [rsp + 0x30]
call fcn.14003de10
movzx r9d, byte [rsp + 0x70]
lea rcx, [rbp + 0x2d8]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x20]
call fcn.14004a8e0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea r11, [rsp + 0x50]
mov rax, rdi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400454c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rax, [0x1400c8b88]
mov r14, rcx
mov qword [rcx], rax
lea rax, [0x1400c8be8]
mov qword [rcx + 8], rax
call fcn.140060cc0
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140045506
call fcn.140027ad0
movsxd rdx, dword [rbx + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rbx + 8]
cmp dword [rdx + 8], eax
je 0x14004551d
xor ecx, ecx
jmp 0x140045520
mov rcx, qword [rdx]
mov rdx, r14
call fcn.140060f10
call fcn.14005e270
lea rdx, [r14 + 8]
mov rcx, rax
call fcn.14005edd0
mov rsi, qword [r14 + 0x10]
add rsi, 8
call fcn.14001e9c0
mov rdx, rax
lea rcx, [rsp + 0x30]
mov r8, rsi
call fcn.14003e220
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea rcx, [rsp + 0x30]
call fcn.14003de10
cmp qword [r14 + 0x18], 0
je 0x1400455af
mov rax, qword [r14 + 0x10]
mov rax, qword [rax + 0x340]
cmp dword [r14 + 0x28], eax
jne 0x1400455af
mov rax, qword [r14 + 0x10]
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x20]
mov rax, qword [r14 + 0x18]
mov qword [r14 + 0x18], 0
mov rdx, qword [r14 + 0x20]
mov qword [rsp + 0x80], rax
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.140060cc0
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400455cd
call fcn.140027ad0
movsxd rdx, dword [rbx + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rbx + 8]
cmp dword [rdx + 8], eax
je 0x1400455e4
xor eax, eax
jmp 0x1400455e7
mov rax, qword [rdx]
mov rbp, qword [r14 + 0x10]
lea r8, [rsp + 0x88]
add rbp, 0x2d8
mov qword [rsp + 0x88], rax
mov rcx, rbp
lea rdx, [rsp + 0x20]
call fcn.140049340
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rax, rbx
cmp rbx, rdi
je 0x140045629
mov rax, qword [rax]
cmp rax, rdi
jne 0x140045621
mov rax, qword [rbp + 8]
cmp rbx, qword [rax]
jne 0x140045641
cmp rdi, rax
jne 0x140045641
mov rcx, rbp
call fcn.1400491f0
jmp 0x14004566b
cmp rbx, rdi
je 0x14004566b
nop word [rax + rax]
mov r8, rbx
lea rdx, [rsp + 0x90]
mov rbx, qword [rbx]
mov rcx, rbp
call fcn.1400498e0
cmp rbx, rdi
jne 0x140045650
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [0x1400d6d18]
mov rbx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140045694
call fcn.140027ad0
mov rdx, rax
movsxd rax, dword [rbx + 0x2b4]
add rax, rax
mov qword [rdx + rax*8], 0
movsxd rcx, dword [rbx + 0x2b4]
mov eax, dword [rbx + 0x2b8]
add rcx, rcx
mov dword [rdx + rcx*8 + 8], eax
mov rbx, qword [r14 + 0x18]
test rbx, rbx
je 0x1400456d3
mov rcx, rbx
call fcn.14005ce90
mov rcx, rbx
call fcn.140080c40
mov rbx, qword [rsp + 0x98]
lea rax, [0x1400c8b98]
mov qword [r14 + 8], rax
lea rax, method.std::_Facet_base.virtual_8
mov qword [r14], rax
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140046120
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x140046145
call fcn.140027ad0
mov rcx, rax
movsxd rdx, dword [rbx + 0x2c0]
mov eax, dword [rbx + 0x2c4]
add rdx, rdx
cmp dword [rcx + rdx*8 + 8], eax
jne 0x140046166
cmp qword [rcx + rdx*8], 0
jne 0x14004626a
mov qword [rsp + 0x30], rdi
call fcn.140060cc0
mov ecx, dword [0x1400d6d18]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140046189
call fcn.140027ad0
movsxd rdx, dword [rdi + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rdi + 8]
cmp dword [rdx + 8], eax
jne 0x140046265
cmp qword [rdx], 0
je 0x140046265
mov eax, dword [0x1400dc784]
test eax, eax
je 0x1400461c6
mov eax, dword [0x1400dc784]
test eax, eax
je 0x1400461c6
call fcn.140044c10
inc dword [rax + 0x38]
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x1400461e2
call fcn.140027ad0
mov rcx, rax
movsxd rax, dword [rbx + 0x2b4]
shl rax, 4
add rcx, rax
mov eax, dword [rbx + 0x2b8]
cmp dword [rcx + 8], eax
jne 0x14004621c
mov rcx, qword [rcx]
test rcx, rcx
je 0x14004621c
mov rax, qword [rbx + 0x340]
mov edx, dword [rcx + 0x28]
cmp edx, eax
je 0x140046240
mov rax, qword [rcx]
mov edx, 1
call qword [rax + VariantCopy]
mov ecx, 0x30
call fcn.140080c00
mov rdx, rbx
mov rcx, rax
call fcn.1400452d0
mov rdx, rax
lea rcx, [rbx + 0x2b0]
call fcn.14001f950
mov eax, dword [0x1400dc784]
test eax, eax
je 0x140046265
mov eax, dword [0x1400dc784]
test eax, eax
je 0x140046265
call fcn.140044c10
mov ecx, dword [rax + 0x38]
test ecx, ecx
je 0x140046265
dec ecx
mov dword [rax + 0x38], ecx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret