joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400436d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x1400436e6
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov rdi, qword [0x14016c568]
cmp rdi, 1
jbe 0x140043775
lea rbx, [rsi + 8]
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14004380b
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rbx
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [0x14016c578]
cmp rdi, 1
jbe 0x1400437c2
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14004381e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c568]
call fcn.14004b9f0
test al, al
je 0x140043831
mov qword [0x14016c570], 0
lea rbx, [0x14016c568]
lea rdi, [0x14016c570]
mov rcx, rdi
xor edx, edx
call fcn.140043450
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004b960
jmp 0x1400436f7
lea rcx, [0x14016c578]
call fcn.14004b9f0
test al, al
je 0x14004383d
mov qword [0x14016c580], 0
lea rbx, [0x14016c578]
lea rdi, [0x14016c580]
mov rcx, rdi
xor edx, edx
call fcn.140043450
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004b960
jmp 0x14004373b
test rbx, rbx
je 0x14004372a
call fcn.140006690
jmp 0x140043711
test rsi, rsi
je 0x14004376a
call fcn.140006690
jmp 0x140043751
mov rdi, qword [0x14016c568]
jmp 0x1400436f7
mov rdi, qword [0x14016c578]
jmp 0x14004373b

Function at 0x140044450
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1401719f0]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400444b2
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400444ee
movsxd rcx, dword [0x1401719e8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1401719ec]
jne 0x1400444ee
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401719f0]
call fcn.14007c144
cmp dword [0x1401719f0], 0xffffffff
jne 0x140044479
mov qword [0x1401719e8], 0
lea rcx, [0x1401719e8]
xor edx, edx
call fcn.140043450
lea rcx, [0x1401719f0]
call fcn.14007c0e4
jmp 0x140044479
xor eax, eax
jmp 0x1400444a6
Function at 0x1400448c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x14016c5c0]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140044922
mov rsi, qword [0x14016c5b8]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14007ed30
mov rax, rsi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c5c0]
call fcn.14007c144
cmp dword [0x14016c5c0], 0xffffffff
jne 0x1400448fd
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140081440
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14007c0a8
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14016c5f8]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400449db
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r8d, edi
call fcn.140006890
mov qword [0x14016c5b8], rsi
lea rcx, [0x14016c5c0]
call fcn.14007c0e4
jmp 0x1400448fd
lea rcx, [0x14016c5f8]
call fcn.14007c144
cmp dword [0x14016c5f8], 0xffffffff
jne 0x1400449b3
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x14016c5e8], xmm2
movups xmmword [0x14016c5d8], xmm1
movups xmmword [0x14016c5c8], xmm0
lea rcx, [0x14016c5f8]
call fcn.14007c0e4
jmp 0x1400449b3
Function at 0x1400458e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14016e328]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400459bc
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400459ff
movsxd rcx, dword [0x14016e320]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14016e324]
jne 0x1400459ff
mov rdi, qword [rax + rcx]
cmp byte [rsi], 0
jne 0x140045951
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rdi]
test rax, rax
js 0x140045a06
cmp dword [rdi + 0x14], 1
jne 0x140045a10
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x140045a4f
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov rsi, qword [rsi + 8]
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x140045a6d
mov rax, qword [rdi]
movabs rcx, 0x6000000000000000
and rcx, rax
movabs rax, 0xffffffffffffff
and rsi, rax
or rsi, rcx
mov qword [rdi], rsi
add dword [rdi + 0x14], 0xffffffff
jmp 0x140045949
lea rcx, [0x14016e328]
call fcn.14007c144
cmp dword [0x14016e328], 0xffffffff
jne 0x14004590f
mov qword [0x14016e320], 0
lea rcx, [0x14016e320]
xor edx, edx
call fcn.140043450
lea rcx, [0x14016e328]
call fcn.14007c0e4
jmp 0x14004590f
xor edi, edi
jmp 0x140045944
call fcn.1400f0a60
jmp 0x14004595d
cmp byte [rsi + 0x10], 0
je 0x140045982
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140045a3c
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0x4000000000000000
lock or qword [rdi], rax
jmp 0x140045982
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x140045974
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x140045993
Function at 0x140054a80
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x18], 0
je 0x140054b41
mov eax, dword [0x1401720d8]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054ba5
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [0x1401720d8]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054be8
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140054b35
movsxd rcx, dword [0x1401720d0]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x1401720d4]
movsxd rdx, dword [0x1401720d0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
jne 0x140054b5f
cmp qword [rsi], 0
jne 0x140054b93
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007ed30
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r14, [rsp + 0x28]
mov r9, qword [rbx + 0x30]
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rbx + 0x28], 0
mov rax, qword [rcx]
lea rdx, [rbx + 8]
mov r8, r14
call qword [rax]
add rbx, 0x38
cmp rbx, rdi
je 0x140054b41
jmp 0x140054b64
mov rcx, rsi
call fcn.1400b4cd0
mov rcx, qword [rsi]
call fcn.14007c098
jmp 0x140054b47
lea rcx, [0x1401720d8]
call fcn.14007c144
cmp dword [0x1401720d8], 0xffffffff
jne 0x140054aca
mov qword [0x1401720d0], 0
lea rcx, [0x1401720d0]
xor edx, edx
call fcn.140043450
lea rcx, [0x1401720d8]
call fcn.14007c0e4
jmp 0x140054aca
lea rcx, [0x1401720d8]
call fcn.14007c144
cmp dword [0x1401720d8], 0xffffffff
jne 0x140054afb
mov qword [0x1401720d0], 0
lea rcx, [0x1401720d0]
xor edx, edx
call fcn.140043450
lea rcx, [0x1401720d8]
call fcn.14007c0e4
jmp 0x140054afb
Function at 0x14005bc10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005bc44
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14005bc44
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005bc3e

Function at 0x14005d6f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005d72e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14005d727
call fcn.140006690
jmp 0x14005d70e

Function at 0x14005ed00
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x14016c5c0]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005ed63
mov rax, qword [0x14016c5b8]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14007ed30
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c5c0]
call fcn.14007c144
cmp dword [0x14016c5c0], 0xffffffff
jne 0x14005ed3d
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140081440
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14007c0a8
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14016c5f8]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005ee1c
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r8d, edi
call fcn.140006890
mov qword [0x14016c5b8], rsi
lea rcx, [0x14016c5c0]
call fcn.14007c0e4
jmp 0x14005ed3d
lea rcx, [0x14016c5f8]
call fcn.14007c144
cmp dword [0x14016c5f8], 0xffffffff
jne 0x14005edf4
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x14016c5e8], xmm2
movups xmmword [0x14016c5d8], xmm1
movups xmmword [0x14016c5c8], xmm0
lea rcx, [0x14016c5f8]
call fcn.14007c0e4
jmp 0x14005edf4
Function at 0x140065570
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400655c1
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007ed30
mov rax, rsi
add rsp, 0x30
pop rsi
ret
int3
Function at 0x140069e90
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14016c5f8]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140069eec
movzx eax, word [0x14016c5c8]
cmp ax, 9
jne 0x140069f4e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14007ed30
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x14016c5f8]
call fcn.14007c144
cmp dword [0x14016c5f8], 0xffffffff
jne 0x140069ec5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x14016c5e8], xmm2
movups xmmword [0x14016c5d8], xmm1
movups xmmword [0x14016c5c8], xmm0
lea rcx, [0x14016c5f8]
call fcn.14007c0e4
jmp 0x140069ec5
cmp ax, 5
jg 0x140069f6f
xor esi, esi
test ax, ax
je 0x140069ed7
cmp ax, 5
jne 0x140069f8f
mov esi, 3
jmp 0x140069ed7
cmp ax, 6
jne 0x140069f7f
mov esi, 2
jmp 0x140069ed7
cmp ax, 0xc
jne 0x140069f8f
mov esi, 4
jmp 0x140069ed7
mov esi, 5
jmp 0x140069ed7
Function at 0x140075f50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x140075fdf
mov rax, r8
shr rax, 2
mov rdx, r9
not rdx
add rdx, r10
jne 0x140075f77
xor edx, edx
jmp 0x140075fbc
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x14011ff10]
nop word [rax + rax]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x140075f90
test r8b, 1
je 0x140075fd9
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x14011ff10]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140075fd9
Function at 0x140076d10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
mov rdi, qword [0x14016c568]
cmp rdi, 1
jbe 0x140076d60
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140076da6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14016c568]
call fcn.14004b9f0
test al, al
je 0x140076db2
mov qword [0x14016c570], 0
lea rbx, [0x14016c568]
lea rdi, [0x14016c570]
mov rcx, rdi
xor edx, edx
call fcn.140043450
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004b960
jmp 0x140076d2a
test rsi, rsi
je 0x140076d55
call fcn.140006690
jmp 0x140076d3c
mov rdi, qword [0x14016c568]
jmp 0x140076d2a
Function at 0x140079250
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x140170350]
cmp rbx, 1
jbe 0x1400792a4
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400792ea
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140170350]
call fcn.14004b9f0
test al, al
je 0x1400792f6
mov qword [0x140170358], 0
lea r14, [0x140170350]
lea rbx, [0x140170358]
mov rcx, rbx
xor edx, edx
call fcn.140043450
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.14004b960
jmp 0x14007926c
test rdi, rdi
je 0x140079297
call fcn.140006690
jmp 0x14007927e
mov rbx, qword [0x140170350]
jmp 0x14007926c

Function at 0x140079310
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140170350]
cmp rsi, 1
jbe 0x140079359
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079352
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140170350]
call fcn.14004b9f0
test al, al
je 0x14007939f
mov qword [0x140170358], 0
lea rdi, [0x140170350]
lea rsi, [0x140170358]
mov rcx, rsi
xor edx, edx
call fcn.140043450
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14004b960
jmp 0x140079323
mov rsi, qword [0x140170350]
jmp 0x140079323

Function at 0x140079ca0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140171a68]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079d05
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079d41
movsxd rcx, dword [0x140171a60]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x140171a64]
movsxd rdx, dword [0x140171a60]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140171a68]
call fcn.14007c144
cmp dword [0x140171a68], 0xffffffff
jne 0x140079cc9
mov qword [0x140171a60], 0
lea rcx, [0x140171a60]
xor edx, edx
call fcn.140043450
lea rcx, [0x140171a68]
call fcn.14007c0e4
jmp 0x140079cc9
test rsi, rsi
je 0x140079cff
call fcn.140006690
jmp 0x140079cdb
Function at 0x140079d70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x140171a4c], eax
mov dword [rcx + 4], eax
mov eax, dword [0x140171a48]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079e59
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079edf
movsxd rcx, dword [0x140171a40]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x140171a44]
movsxd rdx, dword [0x140171a40]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x140171a58]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079e9c
lea rdi, [rsi + 4]
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079ef2
movsxd rcx, dword [0x140171a50]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x140171a54]
movsxd rdx, dword [0x140171a50]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140171a48]
call fcn.14007c144
cmp dword [0x140171a48], 0xffffffff
jne 0x140079db2
mov qword [0x140171a40], 0
lea rcx, [0x140171a40]
xor edx, edx
call fcn.140043450
lea rcx, [0x140171a48]
call fcn.14007c0e4
jmp 0x140079db2
lea rcx, [0x140171a58]
call fcn.14007c144
cmp dword [0x140171a58], 0xffffffff
jne 0x140079e11
mov qword [0x140171a50], 0
lea rcx, [0x140171a50]
xor edx, edx
call fcn.140043450
lea rcx, [0x140171a58]
call fcn.14007c0e4
jmp 0x140079e11
test rsi, rsi
je 0x140079dec
call fcn.140006690
jmp 0x140079dc8
test rdi, rdi
je 0x140079e4f
call fcn.140006690
jmp 0x140079e2b

Function at 0x140079f10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x1401703c0]
cmp rdi, 1
jbe 0x140079f5f
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140079fa5
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401703c0]
call fcn.14004b9f0
test al, al
je 0x140079fb1
mov qword [0x1401703c8], 0
lea rbx, [0x1401703c0]
lea rdi, [0x1401703c8]
mov rcx, rdi
xor edx, edx
call fcn.140043450
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004b960
jmp 0x140079f29
test rsi, rsi
je 0x140079f54
call fcn.140006690
jmp 0x140079f3b
mov rdi, qword [0x1401703c0]
jmp 0x140079f29
Function at 0x140079fc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401703c0]
cmp rsi, 1
jbe 0x14007a009
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14007a002
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401703c0]
call fcn.14004b9f0
test al, al
je 0x14007a04f
mov qword [0x1401703c8], 0
lea rdi, [0x1401703c0]
lea rsi, [0x1401703c8]
mov rcx, rsi
xor edx, edx
call fcn.140043450
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14004b960
jmp 0x140079fd3
mov rsi, qword [0x1401703c0]
jmp 0x140079fd3

Function at 0x14007a060
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140171a48]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a127
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14007a0c3
movsxd rcx, dword [0x140171a40]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x140171a44]
movsxd rdx, dword [0x140171a40]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x140171a58]
mov ecx, dword [0x140169930]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a16a
mov ecx, dword [0x140169448]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14007a122
movsxd rcx, dword [0x140171a50]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x140171a54]
movsxd rdx, dword [0x140171a50]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
ret
lea rcx, [0x140171a48]
call fcn.14007c144
cmp dword [0x140171a48], 0xffffffff
jne 0x14007a089
mov qword [0x140171a40], 0
lea rcx, [0x140171a40]
xor edx, edx
call fcn.140043450
lea rcx, [0x140171a48]
call fcn.14007c0e4
jmp 0x14007a089
lea rcx, [0x140171a58]
call fcn.14007c144
cmp dword [0x140171a58], 0xffffffff
jne 0x14007a0e8
mov qword [0x140171a50], 0
lea rcx, [0x140171a50]
xor edx, edx
call fcn.140043450
lea rcx, [0x140171a58]
call fcn.14007c0e4
jmp 0x14007a0e8

Function at 0x14007a4c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x140171950]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14007a4ed
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14007a4e3
Function at 0x1400aba00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, dword [0x140171950]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test edi, edi
jne 0x1400aba37
cmp rsi, 2
jb 0x1400aba41
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140044010
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400aba23
add rsp, 0x28
pop rdi
pop rsi
ret