joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140064344
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov edi, 0x104
mov ecx, edi
call fcn.1400731c0
mov rdx, rax
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebp, ebp
movsxd rbx, eax
test eax, eax
je 0x140064393
lea edx, [rbx - 1]
movsxd r8, edx
lea eax, [rbp + 0x5c]
cmp word [rsi + r8*2], ax
je 0x140064393
mov word [rsi + rbx*2], ax
inc ebx
sub edi, ebx
mov ecx, edi
call fcn.140073270
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov word [rsi + rax*2], bp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400643b8
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
xor eax, eax
test rcx, rcx
je 0x1400643c9
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cdqe
add rsp, 0x28
ret

Function at 0x1400643e8
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140064413
test dl, 2
je 0x140064406
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
jmp 0x140064415
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140064484
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140064497
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
jmp 0x140064499
xor eax, eax
add rsp, 0x28
ret

Function at 0x140064bd0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
mov rcx, qword [0x140213e80]
call fcn.140072078
mov rbx, rax
test rax, rax
je 0x140064c23
cmp qword [rax + 8], 0
je 0x140064c02
cmp dword [rax + 0x1c], 0
jne 0x140064c02
mov rcx, rax
call fcn.140064cd0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [rsp + 0x38]
shl rcx, 0x20
mov eax, eax
or rax, rcx
add rsp, 0x20
pop rbx
ret
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x140064c30
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov rcx, qword [0x140213e80]
jne 0x140064c50
add rsp, 0x30
pop rdi
jmp fcn.1400722b4
mov rdx, rdi
mov qword [rsp + 0x48], rbx
call fcn.140072078
mov rbx, rax
test rax, rax
je 0x140064cc5
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140064cad
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x1c], eax
jne 0x140064c9a
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, qword [0x140210620]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140213e80]
mov rdx, rdi
call fcn.14007200c
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140064cd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x140064d14
mov r8d, dword [rcx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret

Function at 0x140064d60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov dword [rsp + 0x58], 0
mov rdx, rcx
mov rbx, r8
mov rcx, qword [0x140213e80]
call fcn.140072078
test rax, rax
je 0x140064dc8
cmp qword [rax + 8], 0
mov rdx, rdi
je 0x140064dae
mov r8, rbx
mov rcx, rax
call fcn.140064e70
cdqe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140064de0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov dword [rsp + 0x48], ebx
mov rsi, rdx
test rdx, rdx
je 0x140064e58
test r8d, r8d
je 0x140064e58
mov rdx, rcx
mov rcx, qword [0x140213e80]
call fcn.140072078
test rax, rax
je 0x140064e54
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x140064e41
mov rcx, rax
call fcn.140064fc0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140064e70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov rdi, r8
mov r15, rdx
mov r14, rcx
cmp dword [rcx + 0x1c], ebp
jne 0x140064ea7
call fcn.140064cd0
mov dword [r14 + 0x1c], 1
mov dword [r14 + 0x14], ebp
movsxd r12, dword [r14 + 0x14]
mov eax, dword [r14 + 0x18]
mov rbx, r12
sub eax, r12d
movsxd rdx, eax
add rdx, qword [r14 + 8]
cmp r12, rdi
jl 0x140064f20
mov rax, rdi
sub rax, 1
je 0x140064f11
sub rax, 1
je 0x140064efe
cmp rax, 2
je 0x140064eed
mov r8, rdi
mov rcx, r15
call fcn.14002e3e0
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140064f9a
mov eax, dword [rdx]
mov dword [r15], eax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140064f9a
movzx eax, word [rdx]
mov word [r15], ax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140064f9a
movzx eax, byte [rdx]
mov byte [r15], al
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140064f9a
mov r8, rbx
mov rcx, r15
call fcn.14002e3e0
movsxd r8, dword [r14 + 0x10]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
add r15, rbx
sub rdi, rbx
mov qword [rsp + 0x20], rbp
cmp rdi, r8
jl 0x140064f60
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
add eax, r12d
mov dword [r14 + 0x14], ebp
jmp 0x140064f98
mov rdx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x60]
mov rcx, r15
mov rdx, qword [r14 + 8]
cmp rdi, rax
mov rbx, rax
mov dword [r14 + 0x14], eax
cmovle rbx, rdi
mov dword [r14 + 0x18], eax
mov r8, rbx
call fcn.14002e3e0
sub dword [r14 + 0x14], ebx
lea eax, [rbx + r12]
cdqe
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140064fc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x1400650ba
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x14006501b
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x14006507c
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x140065074
sub edx, 1
je 0x14006506b
cmp edx, 2
je 0x140065064
mov r8, rbx
mov rdx, r14
call fcn.14002e3e0
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x14006504a
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x14006504a
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x14006504a
mov rcx, rsi
call fcn.140064cd0
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x1400650ab
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x140065050
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x140065045
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x140066a90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r14d, dword [rsp + 0x48]
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r14b, 0x10
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov esi, r9d
mov r11d, edx
cmove rbx, rax
mov r10, rcx
mov r12, r8
mov r15, r8
test edx, edx
jle 0x140066b81
lea eax, [r9 - 4]
mov r13d, 0x3d3d
movsxd rdi, eax
nop dword [rax + rax]
mov rdx, r8
sub rdx, r15
cmp r11d, 3
jae 0x140066bf8
mov r9d, r14d
and r9d, 0x20
cmp r11d, 2
jne 0x140066ba8
test r9d, r9d
je 0x140066b21
lea eax, [rsi - 3]
movsxd rcx, eax
cmp rdx, rcx
jmp 0x140066b24
cmp rdx, rdi
jge 0x140066c74
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10]
add r10, 2
shl rcx, 8
or rcx, rax
shl rcx, 2
mov rax, rcx
shr rax, 0xc
movzx eax, byte [rax + rbx]
mov byte [r8], al
mov rax, rcx
shr rax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r8 + 1], al
movzx eax, byte [rcx + rbx]
mov byte [r8 + 2], al
add r8, 3
test r9d, r9d
jne 0x140066c62
mov byte [r8], 0x3d
inc r8
mov byte [r8], 0
sub r8, r12
mov rax, r8
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
test r9d, r9d
je 0x140066bb8
lea eax, [rsi - 2]
movsxd rcx, eax
cmp rdx, rcx
jmp 0x140066bbb
cmp rdx, rdi
jge 0x140066c74
movzx ecx, byte [r10]
inc r10
shl rcx, 4
mov rax, rcx
and ecx, 0x3f
shr rax, 6
movzx eax, byte [rax + rbx]
mov byte [r8], al
movzx eax, byte [rcx + rbx]
mov byte [r8 + 1], al
add r8, 2
test r9d, r9d
jne 0x140066c62
mov word [r8], r13w
add r8, 2
jmp 0x140066c62
cmp rdx, rdi
jge 0x140066c74
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10 + 2]
movzx r9d, byte [r10]
add r10, 3
shl r9, 8
or r9, rax
shl r9, 8
or r9, rcx
mov rax, r9
shr rax, 6
and eax, 0x3f
movsx edx, byte [rax + rbx]
mov rax, r9
and eax, 0x3f
movsx ecx, byte [rax + rbx]
mov rax, r9
shr rax, 0xc
and eax, 0x3f
shl ecx, 8
or edx, ecx
shr r9, 0x12
shl edx, 8
movsx eax, byte [rax + rbx]
or edx, eax
movsx eax, byte [r9 + rbx]
shl edx, 8
or edx, eax
mov dword [r8], edx
add r8, 4
sub r11d, 3
test r11d, r11d
jg 0x140066af0
jmp 0x140066b81
xor eax, eax
jmp 0x140066b8b
Function at 0x140067c10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140067e60
mov r11d, eax
lea edx, [rax*4]
movsxd r9, edx
test edx, edx
jle 0x140067c8d
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rcx, [rbx + 8]
nop
mov edx, dword [rcx - 8]
add r10, 4
mov eax, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rcx - 8], eax
lea rcx, [rcx + 0x10]
mov eax, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rcx - 0x14]
mov dword [rcx - 0x14], eax
mov eax, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rcx - 0x10]
mov dword [rcx - 0x10], eax
mov eax, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rcx - 0xc]
mov dword [rcx - 0xc], eax
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140067c40
cmp r11d, 1
jle 0x140067e49
mov qword [rsp + 0x30], rdi
lea r10d, [r11 - 1]
lea rdi, [0x140000000]
add rbx, 4
nop dword [rax + rax]
mov r9d, dword [rbx + 0x10]
lea rbx, [rbx + 0x10]
mov edx, dword [rbx - 4]
movzx eax, byte [rbx - 3]
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x1c1ef0]
movzx eax, byte [rdi + rax*4 + 0x1c12f0]
xor r8d, dword [rdi + rax*4 + 0x1c16f0]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
movzx eax, byte [rbx - 2]
xor r8d, dword [rdi + rcx*4 + 0x1c22f0]
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1c1af0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1c12f0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1c1af0]
movzx eax, byte [rdi + rcx*4 + 0x1c12f0]
xor r8d, dword [rdi + rax*4 + 0x1c1ef0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
movzx eax, r9b
mov r9d, dword [rbx + 4]
xor r8d, dword [rdi + rcx*4 + 0x1c16f0]
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1c22f0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx], r8d
movzx edx, byte [rdi + rcx*4 + 0x1c12f0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1c1af0]
movzx eax, byte [rdi + rcx*4 + 0x1c12f0]
xor r8d, dword [rdi + rax*4 + 0x1c1ef0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
movzx eax, r9b
mov r9d, dword [rbx + 8]
xor r8d, dword [rdi + rcx*4 + 0x1c16f0]
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1c22f0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1c12f0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1c1af0]
movzx eax, byte [rdi + rcx*4 + 0x1c12f0]
xor r8d, dword [rdi + rax*4 + 0x1c1ef0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1c16f0]
movzx ecx, byte [rdi + rax*4 + 0x1c12f0]
xor r8d, dword [rdi + rcx*4 + 0x1c22f0]
mov dword [rbx + 8], r8d
sub r10, 1
jne 0x140067cb0
mov rdi, qword [rsp + 0x30]
mov eax, r11d
add rsp, 0x20
pop rbx
ret
Function at 0x1400694e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
bt r8d, 0x10
jae 0x1400696ef
mov r11, rsp
push r12
push r14
sub rsp, 0xe8
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, rdx
mov r14, rcx
test rcx, rcx
je 0x1400696d4
mov eax, dword [rcx]
mov qword [r11 + 0x18], rbx
cdq
mov qword [r11 - 0x18], rbp
and edx, 7
mov ebp, dword [rsp + 0x120]
add eax, edx
sar eax, 3
mov qword [r11 - 0x20], rsi
test r9, r9
mov qword [r11 - 0x28], rdi
lea rdi, [0x1401a8080]
mov qword [r11 - 0x30], r13
cmovne rdi, r9
mov qword [r11 - 0x38], r15
movsxd r15, dword [rcx + 4]
movsxd r13, eax
cmp ebp, 0x18
jne 0x14006957b
mov rcx, rdi
call fcn.1401275b0
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140069570
jmp 0x1400695ba
cmp ebp, 0x19
jne 0x14006959f
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140069590
add rbx, rbx
jmp 0x1400695ba
mov rcx, rdi
call fcn.140127000
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400695b1
mov rdx, rdi
cmp rbx, r15
jle 0x14006960d
mov r8d, ebx
mov rcx, r14
call qword [r12 + SafeArrayPutElement]
mov rcx, r14
call qword [r12 + 0x20]
lea rdx, [r14 + 8]
mov r8, r13
lea rcx, [rsp + 0x20]
call fcn.14002e3e0
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, r13d
add rcx, r13
movsxd r8, eax
xor edx, edx
call fcn.14002cdf0
mov edx, 1
mov rcx, r14
call qword [r12 + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x140069631
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14002e3e0
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, ebx
add rcx, rbx
movsxd r8, eax
xor edx, edx
call fcn.14002cdf0
lea rcx, [r14 + 0x48]
mov r8, r15
lea rdx, [rsp + 0x20]
call fcn.14002e3e0
mov r13, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x110]
test r15d, r15d
jle 0x140069688
xor r9d, r9d
lea rcx, [rsp + 0x20]
mov rax, r14
sub rax, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, r9
inc r9
xor byte [rdx], 0x36
xor byte [rax + rdx + 0x48], 0x5c
cmp r9, r15
jl 0x140069670
mov r8d, r15d
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [r12 + SafeArrayPutElement]
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xd8]
cmp ebp, 0x18
jne 0x1400696b7
mov rcx, rdi
call fcn.1401275a0
jmp 0x1400696c4
cmp ebp, 0x19
je 0x1400696c4
mov rcx, rdi
call fcn.140126ff0
mov rbp, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401276a0
add rsp, 0xe8
pop r14
pop r12
ret
Function at 0x140069cc8
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x140069d3d
call qword [rcx + 0xb0]
mov edx, dword [rbx + 0xf4]
mov rdi, rax
mov dword [rbx + 0x108], edx
mov edx, dword [rbx + 0xf8]
mov dword [rbx + 0x10c], edx
test rax, rax
jne 0x140069d3d
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140069d15
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x140210620]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x140213ec0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x140213ee0], 0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140069d4c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ebx, r8d
mov ecx, dword [0x140213ec0]
mov edi, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rsi
mov rcx, rax
mov r9d, dword [rax + 0x104]
mov r8d, dword [rax + 0x100]
add r9d, ebx
add r8d, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x48]

Function at 0x140069d9c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140213ec0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x140069dbf
mov rcx, rax
add rsp, 0x28
jmp rdx
xor eax, eax
add rsp, 0x28
ret

Function at 0x140069dc8
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140213ec0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rax + 0x28]
test rdx, rdx
je 0x140069deb
mov rcx, rax
add rsp, 0x28
jmp rdx
xor eax, eax
add rsp, 0x28
ret

Function at 0x140069e28
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x140213ec0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140069e89
mov rcx, rax
call qword [rax + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140069e61
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x140210620]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x140213ec0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x140213ee0], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140069e90
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140213ec0], eax
add rsp, 0x28
ret
Function at 0x14006f840
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14d, r9d
mov rsi, r8
mov rbx, rcx
test r8, r8
je 0x14006f93f
cmp word [r8], 0
je 0x14006f93f
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x20], r15
mov eax, r13d
cmovns eax, edx
test rcx, rcx
je 0x14006f8b9
cmp word [rcx], r13w
je 0x14006f8b9
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x14006f8a0
cmp edi, eax
mov ebp, r13d
cmovg edi, eax
sub eax, edi
cmovns ebp, eax
jmp 0x14006f8be
mov edi, r13d
mov ebp, eax
call fcn.140073330
movzx r12d, word [rsi]
lea ecx, [rdi + rbp]
mov edx, r14d
mov r15d, eax
call fcn.1400731c0
mov rsi, rax
test r15d, r15d
je 0x14006f8e8
mov ecx, r15d
call fcn.140073370
mov rbx, rax
mov r15, qword [rsp + 0x20]
test edi, edi
movsxd rax, edi
lea rdi, [rax + rax]
jle 0x14006f906
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14002e3e0
add rsi, rdi
test ebp, ebp
je 0x14006f91e
mov rdi, rsi
mov edx, ebp
mov rax, r12
mov ecx, ebp
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov word [rsi], r13w
mov r13, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov ecx, r14d
add rsp, 0x30
pop r14
pop rsi
pop rbx
jmp fcn.1400732a0

Function at 0x14006f9a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.1400731c0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140126904
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14006f9d3
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140073270
Function at 0x14006fa00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x30
mov ebp, r9d
mov rbx, rcx
test r8, r8
je 0x14006faf9
movzx r12d, word [r8]
test r12w, r12w
je 0x14006faf9
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x28], r14
mov eax, r13d
mov qword [rsp + 0x20], r15
cmovns eax, edx
test rcx, rcx
je 0x14006fa79
cmp word [rcx], r13w
je 0x14006fa79
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x14006fa60
cmp edi, eax
mov esi, r13d
cmovg edi, eax
sub eax, edi
cmovns esi, eax
jmp 0x14006fa7e
mov edi, r13d
mov esi, eax
call fcn.140073330
lea ecx, [rdi + rsi]
mov edx, ebp
mov r15d, eax
call fcn.1400731c0
mov r14, rax
test r15d, r15d
je 0x14006faa3
mov ecx, r15d
call fcn.140073370
mov rbx, rax
movsxd r15, edi
test edi, edi
je 0x14006fabd
movsxd rcx, esi
lea r8, [r15 + r15]
mov rdx, rbx
lea rcx, [r14 + rcx*2]
call fcn.14002e3e0
test esi, esi
je 0x14006fad2
mov rdi, r14
mov edx, esi
mov rax, r12
mov ecx, esi
rep stosw word [rdi], ax
lea r14, [r14 + rdx*2]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov word [r14 + r15*2], r13w
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rbp
pop rbx
ret
mov ecx, ebp
add rsp, 0x30
pop r12
pop rbp
pop rbx
jmp fcn.1400732a0

Function at 0x14006fe10
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x14006fee2
mov qword [rsp + 0x40], rbp
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
nop
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x14006fe40
mov eax, 1
xor r15d, r15d
sub eax, esi
mov ebp, r15d
add ecx, eax
cmovns ebp, ecx
mov rcx, rbx
call fcn.140073330
mov edx, edi
mov ecx, ebp
mov r14d, eax
call fcn.1400731c0
mov rdi, rax
test r14d, r14d
je 0x14006fe83
mov ecx, r14d
call fcn.140073370
mov rbx, rax
mov r14, qword [rsp + 0x48]
mov ecx, ebp
test rbx, rbx
je 0x14006fec7
cmp esi, 1
jle 0x14006fea5
cmp word [rbx], r15w
je 0x14006fea5
add rbx, 2
dec esi
cmp esi, 1
jg 0x14006fe94
movzx eax, word [rbx]
test ax, ax
je 0x14006fec7
sub rbx, rdi
test ecx, ecx
je 0x14006fec7
mov word [rdi], ax
dec ecx
movzx eax, word [rbx + rdi + 2]
add rdi, 2
test ax, ax
jne 0x14006feb0
call fcn.140073270
mov rbp, qword [rsp + 0x40]
mov word [rdi], r15w
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov ecx, edi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.1400732a0