joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026465
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
cmp qword [rcx], 0
jle 0x140026686
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x14002663a
mov rax, qword [rsp + 0x50]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
movabs rdx, 0x7a1717b08898ae24
movabs r8, 0x7a1717b08898ae24
xor rdx, r8
movabs r8, 0x6636769e45b5230b
movabs r9, 0x6636769e45b5230a
xor r8, r9
sub rdx, r8
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x1400265d4
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
xor eax, eax
sub rax, 1
sub rcx, rax
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0x3a903f96a7f0ed76
movabs r8, 0xc56fc069580f1289
xor rcx, r8
cmp rax, rcx
setg cl
mov al, cl
xor al, 0xff
xor r8d, r8d
mov r9b, r8b
xor r9b, 1
mov r8b, dl
xor r8b, r9b
or al, r8b
xor cl, 0xff
mov r8b, 1
xor r8b, 0
xor dl, r8b
or cl, dl
xor edx, edx
xor dl, 1
xor al, dl
xor cl, 0xff
or al, cl
test al, 1
jne 0x1400265b8
jmp 0x1400265c2
call fcn.14000a590
jmp 0x14002663a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x14002663a
mov rcx, qword [rsp + 0x50]
call fcn.1400cb129
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x1400266bb
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
movabs rcx, 0x48502b6a25d91610
movabs rdx, 0xb7afd495da26e9e0
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movabs rdx, 0x4691072fb4919b23
movabs r8, 0x4691072fb4919b23
xor rdx, r8
movabs r8, 0x4fc54f69a8ecd836
movabs r9, 0x4fc54f69a8ecd837
xor r8, r9
sub rdx, r8
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x1400264a7
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x1400266bb
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret
Function at 0x1400266c1
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
cmp qword [rcx], 0
jle 0x140026913
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x1400268e1
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, 0xfffffffffffffff0
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x14002685b
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
mov rdx, rax
xor rdx, 0xffffffffffffffff
or rcx, rdx
movabs rdx, 0xa3ed99cf95160b01
movabs r9, 0x5c1266306ae9f4fe
xor rdx, r9
xor rcx, rdx
movabs r9, 0x708f573cd22def45
movabs rdx, 0x8f70a8c32dd210ba
xor r9, rdx
mov rdx, r8
xor rdx, r9
or rcx, rdx
and r8, r8
xor r8, 0xffffffffffffffff
movabs r9, 0x8bb26cda7ec21987
movabs rdx, 0x744d9325813de678
xor r9, rdx
mov rdx, rax
xor rdx, r9
movabs r9, 0xd068a3e9b1f9bfc4
movabs r10, 0x2f975c164e06403b
xor r9, r10
xor r8, r9
or rdx, r8
movabs r8, 0x7b4fd6b85e012747
movabs r9, 0x84b02947a1fed8b8
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
movabs rdx, 0x9f2ee2aada988ee6
movabs r8, 0x9f2ee2aada988ee6
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14002683f
jmp 0x140026849
call fcn.14000a590
jmp 0x1400268e1
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x1400268e1
mov rcx, qword [rsp + 0x50]
call fcn.1400cc22c
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x140026948
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0xeac7fc716bb10248
movabs rax, 0x1538038e944efdb8
xor rdx, rax
mov rax, rcx
and rax, rdx
movabs rdx, 0xa89f4852666af7b7
movabs r8, 0x5760b7ad99950847
xor rdx, r8
or rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movabs rdx, 0x45819a11f81c0c2b
movabs r8, 0x45819a11f81c0c2a
xor rdx, r8
add rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x140026703
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140026948
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret
Function at 0x14002694e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x140026a79
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x140026a58
mov rdx, qword [rsp + 0x38]
movabs rcx, 0xc185f6ca5a521614
movabs rax, 0xde530d423a420a32
xor rcx, rax
mov rax, rdx
sub rax, rcx
movabs rcx, 0x14f2df6fadf41637
movabs r8, 0xeb0d2090520be9c7
xor rcx, r8
add rax, rcx
movabs rcx, 0x1fd6fb8860101c26
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, 1
xor cl, 0
xor al, cl
xor dl, 0xff
xor ecx, ecx
xor cl, 0
mov r8b, 1
xor r8b, 0
xor cl, r8b
or al, dl
or cl, 0
xor al, 0xff
and al, cl
test al, 1
jne 0x140026a27
jmp 0x140026a31
call fcn.14000a590
jmp 0x140026a79
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
mov cl, 1
xor cl, 1
and cl, 1
call fcn.140013f0f
jmp 0x140026a79
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.140013f0f
mov rcx, qword [rsp + 0x40]
call fcn.140014085
nop
add rsp, 0x48
ret

Function at 0x140026b07
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400cb4ce
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x5e
xor cl, 0x5e
cmp al, cl
jne 0x140026b4d
mov rcx, qword [rsp + 0x28]
call fcn.1400cb61a
nop
add rsp, 0x38
ret
Function at 0x140026c8b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60
mov qword [rsp + 0x68], rax
mov rax, qword [rcx]
mov qword [rsp + 0x70], rax
cmp rax, rdx
jle 0x140026cdd
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.140026b53
jmp 0x140026ede
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jge 0x140026ede
mov rax, qword [rsp + 0x58]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x140026d34
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
movabs rax, 0xbfffffffffffffff
and rax, qword [rdx]
cmp rax, rcx
jge 0x140026de9
mov rcx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
mov rax, r9
not rax
and rax, rcx
mov rdx, rcx
not rdx
mov r8, r9
and r8, rdx
sub r8, rax
mov qword [rsp + 0x40], r8
mov rax, r8
xor rax, r9
xor rdx, rcx
and rdx, r8
xor rdx, rcx
mov rcx, rax
and rcx, rdx
test rax, rax
sets al
test rcx, rcx
setns cl
add al, cl
inc al
test al, 1
jne 0x140026ddf
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
movabs r9, 0xb525191c3cb6771
movabs rax, 0xb525191c3cb6779
xor r9, rax
movabs rax, 0x126e3d5750e803e2
movabs r10, 0x126e3d5750e803ea
xor rax, r10
mov qword [rsp + 0x20], rax
call fcn.1400184ef
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rax], rcx
jmp 0x140026de9
call fcn.14000a590
jmp 0x140026ede
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rcx], rdx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jge 0x140026ede
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
xor eax, eax
mov edx, eax
call fcn.1400cb622
mov rax, qword [rsp + 0x68]
mov al, byte [rax]
mov cl, 0xa2
xor cl, 0xa2
cmp al, cl
jne 0x140026ede
mov rdx, qword [rsp + 0x30]
movabs rcx, 0xe3d5e856b65c8072
movabs rax, 0xe3d5e856b65c8073
xor rcx, rax
mov rax, rdx
add rax, rcx
movabs rcx, 0xc56a2302f37f2412
movabs r8, 0x3a95dcfd0c80dbed
xor rcx, r8
mov r8, rdx
and r8, rcx
movabs rcx, 0xac1219f532cf5bd9
movabs r9, 0xac1219f532cf5bdb
xor rcx, r9
imul rcx, r8
add rdx, 0xffffffffffffffff
sub rdx, rcx
mov rcx, rax
and rcx, rdx
movabs rdx, 0x79a52b48578c996e
movabs r8, 0x79a52b48578c996e
xor rdx, r8
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jge 0x140026e00
call fcn.14000a590
nop
add rsp, 0x78
ret

Function at 0x140026f55
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400ca7a2
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x85
xor cl, 0x85
cmp al, cl
jne 0x140026f9d
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
add rsp, 0x38
ret
Function at 0x140027491
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400cb752
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x1400274d3
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
add rsp, 0x38
ret
Function at 0x140027b15
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400cc41c
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140027b55
mov rcx, qword [rsp + 0x28]
call fcn.1400cc675
nop
add rsp, 0x38
ret
Function at 0x140027d1e
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60
mov qword [rsp + 0x68], rax
mov rax, qword [rcx]
mov qword [rsp + 0x70], rax
cmp rax, rdx
jle 0x140027d72
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.140027b5b
jmp 0x140027ff6
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jge 0x140027ff6
mov rax, qword [rsp + 0x58]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x140027dd9
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
movabs rdx, 0x6525c236e57f7698
movabs r8, 0xdada3dc91a808967
xor rdx, r8
and rax, rdx
cmp rax, rcx
jge 0x140027f58
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
movabs rax, 0x8e77a7eefb82ea89
movabs rcx, 0xa8ee43848bf27d79
xor rax, rcx
mov rdx, r9
sub rdx, rax
sub rdx, r8
movabs rax, 0x6e981b0821d3edff
movabs rcx, 0x4801ff6251a37a0f
xor rax, rcx
add rdx, rax
mov qword [rsp + 0x40], rdx
movabs rcx, 0x207d6f8598a11034
movabs rax, 0xdf82907a675eefcb
xor rcx, rax
mov rax, rdx
xor rax, rcx
movabs rcx, 0x9f6db66894db5b7f
and rax, rcx
movabs r11, 0x332c27eb50f4e40a
movabs rcx, 0xac419183c42fbf75
xor r11, rcx
movabs rcx, 0x9e8535e55b46a952
movabs r10, 0x617aca1aa4b956ad
xor rcx, r10
xor r11, rcx
mov r10, rdx
and r10, r11
mov rcx, r9
xor rcx, 0xffffffffffffffff
movabs rsi, 0x4d8a2e709d302c65
movabs rdi, 0xd2e7981809eb771a
xor rsi, rdi
and rcx, rsi
and r9, r11
or rax, r10
or rcx, r9
xor rax, rcx
cmp rax, 0
setl al
mov r9, rdx
xor r9, 0xffffffffffffffff
mov rcx, r8
and rcx, r9
movabs r9, 0xd574f9d1a12038ca
movabs r10, 0x2a8b062e5edfc735
xor r9, r10
xor r8, r9
and rdx, r8
or rcx, rdx
cmp rcx, 0xffffffffffffffff
setg dl
or al, al
xor al, 0xff
mov r8b, 1
xor r8b, 0
mov cl, dl
xor cl, r8b
mov r8b, 1
xor r8b, 0
xor dl, r8b
and cl, dl
xor edx, edx
xor dl, 1
xor al, dl
xor cl, 0xff
and al, cl
test al, 1
jne 0x140027f4e
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.1400184ef
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rax], rcx
jmp 0x140027f58
call fcn.14000a590
jmp 0x140027ff6
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rcx], rdx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jge 0x140027ff6
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
xor eax, eax
mov edx, eax
call fcn.1400cc67d
mov rax, qword [rsp + 0x68]
cmp byte [rax], 0
jne 0x140027ff6
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 1
movabs rcx, 0x5cecdac86ab6592f
movabs r8, 0xa31325379549a6d0
xor rcx, r8
xor rdx, rcx
mov rcx, rax
and rcx, rdx
cmp rcx, 0
mov qword [rsp + 0x38], rax
jge 0x140027f6f
call fcn.14000a590
nop
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14002806f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x77], al
je 0x1400280e4
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
call fcn.140020156
call fcn.1400201fa
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov byte [rax], 0
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rdx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
xor ecx, ecx
sub rcx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
mov qword [rsp + 0x30], rcx
movabs rcx, 0x342fb3e61f5cded7
movabs rdx, 0x342fb3e61f5cded7
xor rcx, rdx
cmp rax, rcx
jle 0x1400281ca
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x1400281a6
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x1400281ad
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
je 0x14002810a
jmp 0x1400281d5
mov rax, qword [rsp + 0x60]
mov cl, byte [rsp + 0x3f]
mov byte [rax], cl
add rsp, 0x78
ret
jmp 0x14002806f
Function at 0x1400281da
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x77], al
je 0x1400280e4
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
call fcn.140020156
call fcn.1400201fa
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov byte [rax], 0
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rdx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
xor ecx, ecx
sub rcx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
mov qword [rsp + 0x30], rcx
movabs rcx, 0x342fb3e61f5cded7
movabs rdx, 0x342fb3e61f5cded7
xor rcx, rdx
cmp rax, rcx
jle 0x1400281ca
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x1400281a6
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x1400281ad
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
je 0x14002810a
jmp 0x1400281d5
mov rax, qword [rsp + 0x60]
mov cl, byte [rsp + 0x3f]
mov byte [rax], cl
add rsp, 0x78
ret
jmp 0x14002806f
Function at 0x1400281df
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
cmp qword [rcx], 0
jle 0x1400283f2
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x1400283d1
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
movabs rax, 0x1a94603ba6ad6516
movabs rdx, 0x1a94603ba6ad6516
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x140028344
mov rdx, qword [rsp + 0x40]
movabs rcx, 0x7ee307089ef5a0b9
movabs rax, 0xc3464105a5b1611c
xor rcx, rax
mov rax, rdx
add rax, rcx
movabs rcx, 0x97b115a2703eebe5
movabs r8, 0x684eea5d8fc11415
xor rcx, r8
add rax, rcx
movabs rcx, 0xbda5460d3b44c1a5
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xe1966fa3ecdf9567
movabs r8, 0xe1966fa3ecdf9567
xor rdx, r8
cmp rcx, rdx
setl cl
movabs rdx, 0xc36c279af7eff08e
movabs r8, 0x3c93d86508100f71
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x140028328
jmp 0x140028332
call fcn.14000a590
jmp 0x1400283d1
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x1400283d1
mov rcx, qword [rsp + 0x50]
call fcn.1401201a9
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x140028427
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
movabs rcx, 0x1052655e8fa9c608
movabs rdx, 0xfe9bc2bf40d0179f
xor rcx, rdx
sub rax, rcx
movabs rcx, 0xc3e598bd064a55ad
movabs rdx, 0x3c1a6742f9b5aa5d
xor rcx, rdx
add rax, rcx
movabs rcx, 0xeec9a7e1cf79d197
add rax, rcx
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
xor edx, edx
sub rdx, 1
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x140028221
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140028427
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret
Function at 0x14002842d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1400527fb
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x91
xor cl, 0x91
cmp al, cl
jne 0x14002849d
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor eax, eax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x30
mov qword [rsp + 0x20], rax
jne 0x140028479
add rsp, 0x38
ret
Function at 0x140028989
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
cmp qword [rcx], 0
jle 0x140028b80
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x140028b3d
mov rax, qword [rsp + 0x50]
movabs rcx, 0x53409788878f58b3
movabs rdx, 0xacbf68777870a743
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x140028ae7
mov rcx, qword [rsp + 0x40]
mov rax, rcx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rdx, rax
xor rdx, rcx
movabs r8, 0xaa5db39b7a1e4e09
movabs r9, 0x55a24c6485e1b1f6
xor r8, r9
xor rdx, r8
mov r8, rcx
and r8, rdx
movabs rdx, 0x5eadeb2062ddd6b9
movabs r9, 0x5eadeb2062ddd6bb
xor rdx, r9
imul rdx, r8
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
movabs rdx, 0x88b7389b310b7c46
movabs r8, 0x88b7389b310b7c46
xor rdx, r8
cmp rcx, rdx
setl cl
movabs rdx, 0x4bc8ae11bca67a26
movabs r8, 0xb43751ee435985d9
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x140028acb
jmp 0x140028ad5
call fcn.14000a590
jmp 0x140028b3d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x140028b3d
mov rcx, qword [rsp + 0x50]
call fcn.1400890f8
mov rax, qword [rsp + 0x70]
mov al, byte [rax]
mov cl, 0x32
xor cl, 0x32
cmp al, cl
jne 0x140028bb5
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movabs rdx, 0xb64f25e532917cd2
add rax, rdx
add rax, 1
movabs rdx, 0x91194e76ec3457d4
movabs r8, 0x27566b93dea52b06
xor rdx, r8
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x1400289cb
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140028bb5
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret