joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c510
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov ebp, edx
mov rbx, rcx
test rcx, rcx
je 0x14008c7b5
cmp word [rcx], 0
je 0x14008c7b5
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], r14
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x14008c542
mov qword [rsp + 0x38], r12
mov edx, r8d
mov ecx, esi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x20], r15
call fcn.14008eae0
mov rdi, rax
mov r14, rax
mov qword [rsp + 0x78], rax
movzx eax, word [rbx]
cmp ebp, 1
jne 0x14008c696
test ax, ax
je 0x14008c77d
mov ebp, 0x22
lea r15d, [rbp + 5]
lea r12d, [rbp + 0x1a]
lea r13d, [rbp + 0x1c]
nop dword [rax + rax]
cmp ax, 0x26
jne 0x14008c67a
lea rdx, [0x140133428]
mov r8d, 6
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14008c5d3
mov word [rdi], bp
add rdi, 2
add rbx, 0xc
jmp 0x14008c685
lea rdx, [0x140133438]
mov r8d, 6
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14008c5fd
mov word [rdi], r15w
add rdi, 2
add rbx, 0xc
jmp 0x14008c685
lea rdx, [0x140133448]
mov r8d, 4
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14008c624
mov word [rdi], r12w
add rdi, 2
add rbx, 8
jmp 0x14008c685
lea rdx, [0x140133458]
mov r8d, 4
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14008c64b
mov word [rdi], r13w
add rdi, 2
add rbx, 8
jmp 0x14008c685
lea rdx, [0x140133468]
mov r8d, 5
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14008c677
mov ecx, 0x26
add rdi, 2
add rbx, 0xa
mov word [rdi - 2], cx
jmp 0x14008c685
movzx eax, word [rbx]
mov word [rdi], ax
add rdi, 2
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14008c5a0
jmp 0x14008c77d
test ax, ax
je 0x14008c77d
mov ebp, 0x22
lea r8, [0x140000000]
mov r9d, 0x5c
lea esi, [rbp - 0x17]
lea r10d, [rbp - 0x1b]
lea r11d, [rbp - 0x1a]
lea r15d, [rbp - 0x16]
lea r12d, [rbp - 0x18]
lea r13d, [rbp - 0x15]
lea r14d, [rbp - 0x19]
nop dword [rax]
cmp ax, r9w
jne 0x14008c75c
movzx eax, word [rbx + 2]
add eax, 0xffffffde
cmp eax, 0x54
ja case.0x14008c6fc.43
cdqe
movzx eax, byte [r8 + rax + 0x8c7ec]
mov ecx, dword [r8 + rax*4 + 0x8c7c4]
add rcx, r8
jmp rcx
mov word [rdi], r10w
add rbx, 4
jmp 0x14008c763
mov word [rdi], r11w
add rbx, 4
jmp 0x14008c763
mov word [rdi], r15w
add rbx, 4
jmp 0x14008c763
mov word [rdi], r12w
add rbx, 4
jmp 0x14008c763
mov word [rdi], r13w
add rbx, 4
jmp 0x14008c763
mov word [rdi], r14w
add rbx, 4
jmp 0x14008c763
mov word [rdi], si
add rbx, 4
jmp 0x14008c763
mov word [rdi], bp
add rbx, 4
jmp 0x14008c763
mov word [rdi], r9w
add rbx, 4
jmp 0x14008c763
mov word [rdi], r9w
jmp 0x14008c75f
mov word [rdi], ax
add rbx, 2
movzx eax, word [rbx]
add rdi, 2
test ax, ax
jne 0x14008c6d0
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
xor eax, eax
mov word [rdi], ax
sub rdi, r14
sar rdi, 1
sub esi, edi
mov ecx, esi
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
jmp fcn.14008ef40
mov ecx, r8d
add rsp, 0x48
pop rbp
pop rbx
jmp fcn.14008ec20
Function at 0x14008cc64
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140195a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14008cce5
mov r8, qword [0x140195a70]
mov rcx, qword [0x140192da8]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140195a78]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x140195a68]
jmp 0x14008ccd1
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14008ccce
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14008ccbc
lea rcx, [0x14008cbc8]
mov rdx, rdi
call fcn.140103d38
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14008ccfc
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x14008cd26
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x140195a70]
test rcx, rcx
jne 0x14008cd69
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x140192da8]
movsxd r8, ebx
mov edx, 8
mov dword [0x140195a78], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140195a78]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140195a70]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x140195a70], rcx
mov ecx, dword [0x140195a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x140195a70]
mov rcx, qword [0x140192da8]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x140195a78]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x14008cdbd
test rbp, rbp
je 0x14008cde4
lea rcx, [0x140195a68]
mov edx, 0x28
call fcn.14008d890
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x14008cde4
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008def0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140195ae8], 0
jne 0x14008df15
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140195ae8], 1
mov dword [0x140195aec], eax
mov rcx, qword [0x140192da8]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140195aec]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x14008e0d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140195ae8], 0
mov ebx, ecx
jne 0x14008e0f4
call fcn.14008def0
mov ecx, dword [0x140195aec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14008e11c
call fcn.14008def0
mov ecx, dword [0x140195aec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, send
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x14008e130
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x14008e170
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008e0d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140195ae8], 0
jne 0x14008df15
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140195ae8], 1
mov dword [0x140195aec], eax
mov rcx, qword [0x140192da8]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140195aec]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x14008e0d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140195ae8], 0
mov ebx, ecx
jne 0x14008e0f4
call fcn.14008def0
mov ecx, dword [0x140195aec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14008e11c
call fcn.14008def0
mov ecx, dword [0x140195aec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, send
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x14008e130
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x14008e170
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14008e1d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140195ae8], 0
mov rbx, rcx
jne 0x14008e1e7
call fcn.14008def0
mov ecx, dword [0x140195aec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
test rax, rax
jne 0x14008e20f
call fcn.14008def0
mov ecx, dword [0x140195aec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
movsxd r8, dword [r9]
movsxd rdx, dword [r9 + 4]
mov eax, reloc.WS2_32.dll_recv
mov r10d, dword [r9 + r8*4 + 0x4c]
mov r11d, dword [r9 + r8*4 + 8]
ror r10d, 0xd
add r10d, dword [r9 + rdx*4 + 0x4c]
ror r11d, 5
add r11d, dword [r9 + rdx*4 + 8]
mov dword [r9 + r8*4 + 8], r10d
mov dword [r9 + r8*4 + 0x4c], r11d
dec r8d
mov ecx, r11d
cmovs r8d, eax
dec edx
cmovs edx, eax
mov dword [r9], r8d
mov dword [r9 + 4], edx
inc rbx
je 0x14008e288
mov edx, r10d
mov r8, rbx
mov eax, ebx
shr r8, 0x20
imul rax, rdx
shr rax, 0x20
imul rcx, r8
imul rdx, r8
shr rcx, 0x20
add rax, rcx
add rax, rdx
add rsp, 0x20
pop rbx
ret
mov eax, r10d
shl rax, 0x20
and rax, rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14008e3b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x14018e720], 0xffffffff
jne 0x14008e3df
call fcn.14008ea70
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x14008e360]
call fcn.140103d38
jmp 0x14008e410
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14008e410
call fcn.14008f440
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x14008e360]
call fcn.140103d38
add rsp, 0x28
ret

Function at 0x14008e420
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 0x10]
mov qword [rcx + rax*8 + 0x18], rdx
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
inc rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
add rsp, 0x38
ret

Function at 0x14008e480
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + rax*8 + 0x18]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14008e4f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rax*8 + 0x18]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rsp, 0x38
ret

Function at 0x14008e560
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rax*8 + 0x18]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
add rsp, 0x38
ret
Function at 0x14008e5d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x20]
add rcx, qword [rdx + rax*8 + 0x18]
mov rax, rcx
add rsp, 0x38
ret

Function at 0x14008e700
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14008e790
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x14008e7f6
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x140196800]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x14008e821
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140196800]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14008f080
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14008e9d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x38
ret

Function at 0x14008ea20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14008ea70
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x140196800], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14018e720], eax
call fcn.14008f440
add rsp, 0x28
ret

Function at 0x14008eae0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x14008eb10
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x14008eb82
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140196800]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x14008ebe0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x14008ebe0
cmp dword [rsp + 0x20], 0x100000
jge 0x14008eba3
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140196800]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14008ec20
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x14008ef40
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret
Function at 0x14008efe0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x14008f03b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x14008f03b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x14008f03d
xor eax, eax
add rsp, 0x38
ret

Function at 0x14008f050
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x14008f100
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx]
add rsp, 0x38
ret

Function at 0x14008f440
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x340
xor edx, edx
mov rcx, qword [0x140196800]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rcx, qword [0x140196800]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x338], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x14018e720]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140094070
Capabilities:
Generate random numbers via rtlgenrandom
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov ebx, edi
nop
lea rcx, [rsp + 0x48]
mov edx, 4
mov dword [rsp + 0x48], edi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140094109
mov edx, dword [rsp + 0x48]
mov rcx, rdi
nop
cmp rbx, 4
jae 0x1400940c1
mov eax, edx
inc rbx
shr eax, cl
add rcx, 8
mov byte [rsp + rbx + 0x4f], al
cmp rcx, 0x20
jb 0x1400940a0
cmp rbx, 4
jb 0x140094080
lea rcx, str.EXPAT_ENTROPY_DEBUG
call qword [sym.imp.msvcrt.dll_getenv]
mov ebx, dword [rsp + 0x50]
test rax, rax
je 0x140094183
movzx ecx, byte [rax]
cmp cl, byte [0x14013396c]
jne 0x140094183
movzx eax, byte [rax + 1]
cmp al, byte [0x14013396d]
jne 0x140094183
call qword [sym.imp.msvcrt.dll___iob_func]
lea r8, str.rand_s
jmp 0x140094160
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.EXPAT_ENTROPY_DEBUG
xor eax, ebx
imul ebx, eax, 0x7fffffff
call qword [sym.imp.msvcrt.dll_getenv]
test rax, rax
je 0x140094183
movzx ecx, byte [rax]
cmp cl, byte [0x14013396c]
jne 0x140094183
movzx eax, byte [rax + 1]
cmp al, byte [0x14013396d]
jne 0x140094183
call qword [sym.imp.msvcrt.dll___iob_func]
lea r8, str.fallback_4_
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
lea rcx, [rax + 0x60]
mov r9d, 8
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
call qword [sym.imp.msvcrt.dll_fprintf]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret