joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140032b20
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x140032b48
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140032b4a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140032bb0
test ecx, ecx
jle 0x140032b7e
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140032bb0
cmp qword [rdi + 0x80], 0
je 0x140032bb0
mov rcx, rdi
call fcn.140035b90
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
and eax, 0x39343172
cmp dword ss:[rax + riz], ebp
and eax, 0x30353172
xor dword [rsi], esi
Function at 0x1400330b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1403284b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400330dd
xor eax, eax
jmp 0x140033232
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140033108
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140033108
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140033232
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140033225
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14003314b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140033176
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003322a
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x140033225
cmp eax, 1
jle 0x1400331e5
cmp eax, 3
jne 0x140033225
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003322a
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140033213
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140033225
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x14003322a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402225a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140035bc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1403284b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140035c6b
cmp byte [rcx + 0x71], 0
je 0x140035c6b
mov edx, 0xffffffff
call fcn.1400330b0
cmp eax, 0xffffffff
je 0x140035c2c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140035c30
sub eax, 1
je 0x140035c34
sub eax, 2
je 0x140035c6b
xor al, al
jmp 0x140035c6d
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140035c62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140035c2c
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140035c6d
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402225a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140043340
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rdx
mov rdi, rcx
mov ecx, dword [0x140336628]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
test rax, rax
je 0x140043378
mov rdx, qword [rax + 8]
jmp 0x14004337b
mov rdx, rsi
mov r8d, 0x48
call fcn.14003b1b0
mov qword [rax + 0x20], rsi
lea rcx, [0x14004e1d0]
mov qword [rax + 0x28], rcx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov dword [rax + 0x30], esi
mov rcx, qword [rbx]
mov qword [rax + 0x38], rcx
mov qword [rbx], rsi
mov rcx, qword [rdi + 0x18]
mov rcx, qword [rcx + 0x10]
lock inc dword [rcx + 0x30]
mov rdx, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140023450
Function at 0x1400433e0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
call fcn.140022be0
test al, al
je 0x14004344f
mov rax, qword [rdi]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rdi], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140050e10
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14004343f
xor edx, edx
mov rcx, rax
call qword [rax]
nop
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [0x140336628]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
test rax, rax
je 0x140043468
mov rdx, qword [rax + 8]
jmp 0x14004346b
mov rdx, rbx
mov r8d, 0x48
call fcn.14003b1b0
mov qword [rax + 0x20], rbx
lea rcx, [0x14004e1d0]
mov qword [rax + 0x28], rcx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov dword [rax + 0x30], ebx
mov rcx, qword [rdi]
mov qword [rax + 0x38], rcx
mov qword [rdi], rbx
mov rcx, qword [rsi + 0x18]
mov rcx, qword [rcx + 0x10]
lock inc dword [rcx + 0x30]
mov rdx, rax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140023450
Function at 0x140056f70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rcx]
movups xmmword [rbp - 0x11], xmm1
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rbp + 0xf], xmm1
lea rdi, [rdx + 8]
mov rsi, qword [rdx]
mov rbx, qword [rdi]
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140056fe3
cmp qword [rax], rbx
je 0x1400570e2
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140056fd1
lea rax, [rbp - 0x21]
mov qword [rbp + 0x27], rax
lea rdx, [rbp - 0x21]
mov ecx, 0x78
call fcn.140022380
mov rbx, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [fcn.140057970]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [rbx + 0x38], xmm0
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rbx + 0x48], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rbx + 0x58], xmm1
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx + 0x68], xmm0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140025180
mov qword [rbp + 0x37], r14
mov qword [rbp + 0x2f], r14
test al, al
je 0x1400570c5
mov rax, qword [rdi]
mov qword [rbp - 0x49], rax
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x49]
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsi + 0x28]
mov qword [rbp - 0x31], rcx
mov rax, qword [rdi]
mov qword [rbp - 0x29], rax
xor r9d, r9d
lea r8, [rbp + 0x3f]
mov rdx, rbx
call fcn.140057970
nop
lea rcx, [rbp - 0x31]
call fcn.140024f40
nop
mov rdx, qword [rbp - 0x39]
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
cmp qword [rax + 8], 0
je 0x140056fe3
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x21]
call fcn.140057b70
nop
jmp 0x1400570c5
Function at 0x1400577b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rax - 0x70], xmm0
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rax - 0x60], xmm1
lea rdi, [rcx + 8]
mov rsi, qword [rcx]
mov rbx, qword [rdi]
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140057812
nop word [rax + rax]
cmp qword [rax], rbx
je 0x140057912
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140057800
lea rax, [rsp + 0x38]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x38]
mov ecx, 0x58
call fcn.140022380
mov rbx, rax
xor ebp, ebp
mov qword [rax + 0x20], rbp
lea rax, [fcn.140057a80]
mov qword [rbx + 0x28], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], ebp
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx + 0x38], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbx + 0x48], xmm1
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140025180
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], rbp
test al, al
je 0x1400578f9
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsi + 0x28]
mov qword [rsp + 0x58], rcx
mov rax, qword [rdi]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea r8, [rsp + 0x88]
mov rdx, rbx
call fcn.140057a80
nop
lea rcx, [rsp + 0x58]
call fcn.140024f40
nop
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp qword [rax + 8], 0
je 0x140057812
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.140057b40
nop
jmp 0x1400578f9

Function at 0x140057b70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rcx, 0x10
add rsp, 0x28
jmp fcn.1400577b0
Function at 0x140059040
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1403284b0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov edx, 0x208
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140059222
movdqa xmm0, xmmword [0x1402d5c60]
movdqu xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov word [rsp + 0x70], r15w
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x1400590c0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.14005da00
nop
movdqa xmm0, xmmword [0x1402d5c60]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov r8d, 7
lea rdx, str.cmd.exe
lea rcx, [rsp + 0x30]
call fcn.1400359b0
nop
mov r14, qword [rsp + 0x40]
test r14, r14
je 0x140059158
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdi, qword [rsp + 0x30]
lea rbx, [rsp + 0x30]
cmovae rbx, qword [rsp + 0x30]
call fcn.1400d3230
mov r9, rax
lea rdx, [r14 + rdi]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.1400d18a0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140059198
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059193
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140222cdc
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.14005d650
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.1400d2eb0
mov rdx, rax
mov rcx, rsi
call fcn.14005d650
nop
lea rcx, [rbp - 0x70]
call fcn.14005d810
nop
lea rcx, [rsp + 0x50]
call fcn.14005d810
nop
lea rcx, [rsp + 0x70]
call fcn.14005d810
mov rax, rsi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1402225a0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140058c90
int3
Function at 0x1400595c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rbx, rcx
lea r8, [0x140336570]
lea rcx, [0x140336588]
lea rdx, [0x14005e5d0]
call qword [sym.imp.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag____ptr64__int____cdecl___void____ptr64__void____ptr64__void____ptr64____ptr64___void____ptr64_]
test eax, eax
je 0x1400596f0
cmp byte [rbx + 0x28], 0
mov rsi, 0xffffffffffffffff
je 0x140059698
cmp byte [rbx + 0x29], 0
jne 0x140059698
mov rax, qword [rbx + 0x18]
mov ecx, dword [rax]
cmp ecx, 0x103
jne 0x140059698
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140059700
test al, al
je 0x140059698
mov rax, qword [rbx]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140059694
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140059700
test al, al
je 0x140059694
mov rcx, qword [rbx]
lea edx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r8, [0x140336570]
lea rdx, [0x14005e5d0]
lea rcx, [0x140336588]
test eax, eax
jne 0x14005967e
call qword [sym.imp.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag____ptr64__int____cdecl___void____ptr64__void____ptr64__void____ptr64____ptr64___void____ptr64_]
test eax, eax
je 0x1400596f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140059694
call qword [sym.imp.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag____ptr64__int____cdecl___void____ptr64__void____ptr64__void____ptr64____ptr64___void____ptr64_]
test eax, eax
je 0x1400596f0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov byte [rbx + 0x29], 1
mov qword [rsp + 0x40], rdi
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je case.default.0x1400596e9
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne case.default.0x1400596e9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne case.default.0x1400596e9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor al, 0x38
cmp byte [rsi], dh
sub al, 0x20
and eax, 0x38343172
cmp byte [rdx], dh
sub al, 0x20
and byte [rcx], dh
invalid
invalid
and byte [rcx], dh
invalid
Function at 0x14005c030
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x6f8]
sub rsp, 0x7f0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1403284b0]
xor rax, rsp
mov qword [rbp + 0x6e0], rax
mov rdi, rcx
lea rcx, [rbp + 0x300]
call fcn.14005c260
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rdx, rax
lea rcx, [rbp + 0x1c8]
call fcn.14005c260
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x90]
call fcn.14005c260
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x5a0], rdi
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x5a8]
call fcn.14005c260
nop
lea rcx, [rbp + 0x198]
call fcn.1400355e0
lea rcx, [rbp + 0xc0]
call fcn.1400355e0
nop
lea rcx, [rbp + 0x2d0]
call fcn.1400355e0
lea rcx, [rbp + 0x1f8]
call fcn.1400355e0
nop
lea rax, [0x14005c490]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x5a0]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x5a8]
lea rcx, [rsp + 0x58]
call fcn.14005c260
nop
lea rcx, [rbp + 0x6b0]
call fcn.1400355e0
lea rcx, [rbp + 0x5d8]
call fcn.1400355e0
nop
lea rcx, [rbx + 0x108]
call fcn.1400355e0
lea rcx, [rbx + 0x30]
call fcn.1400355e0
movups xmm0, xmmword [rdi + 0x328]
movaps xmmword [rbp + 0x440], xmm0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x450]
call fcn.14005e410
lea rcx, [rbp + 0x60]
call fcn.1400355e0
lea rcx, [rbp - 0x78]
call fcn.1400355e0
nop
mov rbx, qword [rbp + 0x448]
mov ecx, dword [0x140336660]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005c1b2
cmp qword [rax], rbx
je 0x14005c1b2
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14005c1a4
lea rdx, [rbp + 0x450]
mov ecx, 0x190
call fcn.140022380
mov r9, rax
xor ecx, ecx
mov qword [rax + 0x20], rcx
lea rax, [0x14005f900]
mov qword [r9 + 0x28], rax
mov qword [r9], rcx
mov qword [r9 + 8], rcx
mov qword [r9 + 0x10], rcx
mov qword [r9 + 0x18], rcx
mov dword [r9 + 0x30], ecx
movaps xmm0, xmmword [rbp + 0x440]
movups xmmword [r9 + 0x38], xmm0
lea rcx, [r9 + 0x48]
lea rdx, [rbp + 0x450]
call fcn.14005e410
mov rcx, qword [0x140335998]
lock inc dword [rcx + 0x30]
mov rdx, r9
call fcn.140023450
nop
lea rcx, [rbp + 0x568]
call fcn.1400355e0
lea rcx, [rbp + 0x490]
call fcn.1400355e0
mov rcx, qword [rbp + 0x6e0]
xor rcx, rsp
call fcn.1402225a0
lea r11, [rsp + 0x7f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005ee00
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rbp, rdx
mov r14, rcx
mov rax, qword [rcx + 0xd8]
mov r8, qword [rax]
mov ecx, dword [rcx + 0x80]
test ecx, ecx
jne 0x14005efdd
cmp byte [r8 + 0x40], cl
je 0x14005efac
cmp qword [r8 + 0x30], 0
jne 0x14005efac
cmp qword [r8 + 0x18], 0x10
jb 0x14005ee6e
mov r8, qword [r8]
mov qword [r14 + 0xc0], r8
mov rax, qword [r14 + 0x78]
mov r10, qword [r14 + 0xb8]
mov r11, qword [r14 + 0xd0]
mov ebx, dword [r14]
mov edi, dword [r14 + 0xb0]
lea rsi, [r14 + 0xe0]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
mov r9, qword [r14 + 0xa8]
mov r8, qword [r14 + 0xa0]
mov rdx, qword [r14 + 0xc0]
mov rcx, qword [r14 + 0xc8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r12d, eax
movups xmm6, xmmword [rsi]
movdqu xmmword [rsp + 0x68], xmm6
movsd xmm7, qword [rsi + 0x10]
movsd qword [rsp + 0x78], xmm7
mov rbx, qword [r14 + 0x98]
test rbx, rbx
je 0x14005ef10
lock inc dword [rbx + 8]
mov rbx, qword [r14 + 0x98]
movsd xmm7, qword [rsp + 0x78]
movdqu xmm6, xmmword [rsp + 0x68]
mov rdi, qword [r14 + 0x90]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rbx
mov word [rsp + 0x90], 1
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x14005f025
lea rcx, [r14 + 0x80]
call fcn.1400580b0
cmp dword [r14 + 0x80], 0
je 0x14005efe7
mov rcx, rbp
call fcn.140059540
nop
lea rcx, [rsp + 0x68]
call fcn.1400595c0
mov rax, rbp
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rax, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14005efb9
mov rax, qword [r8]
mov qword [r14 + 0xc8], rax
add r8, 0x20
cmp qword [r8 + 0x18], 0x10
jb 0x14005efce
mov r8, qword [r8]
mov qword [r14 + 0xc0], r8
test ecx, ecx
je 0x14005ee75
mov rcx, rbp
call fcn.140059540
jmp 0x14005ef7d
movups xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
movdqa xmm1, xmmword [0x1402d5ce0]
movdqu xmmword [rsp + 0x68], xmm1
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
mov word [rbp + 0x28], 1
mov byte [rsp + 0x90], 0
jmp 0x14005ef73
lea rcx, [rsp + 0x58]
call fcn.140058be0
mov rdx, rax
call fcn.14005f040
int3