joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007f730
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
test byte [rcx + 0x8b], 4
mov rbx, rcx
jne 0x10007f916
mov rdi, qword [rcx + 0x98]
mov esi, 0xffffff80
mov ecx, dword [rdi]
mov eax, ecx
and eax, esi
cmp eax, esi
je 0x10007f77f
mov eax, ecx
and ecx, 0x7f
and eax, esi
sub eax, esi
xor eax, ecx
mov dword [rdi], eax
mov rax, qword [rbx + 0x98]
mov r14d, dword [rbx + 0x90]
lea rdx, [0x1000077c0]
mov r13, qword [rax + 8]
xor r8d, r8d
mov rcx, rbx
call fcn.100055880
mov edx, dword [rax]
mov r15d, dword [rax + 8]
mov ecx, edx
and ecx, esi
cmp ecx, esi
je 0x10007f7cc
mov ecx, edx
not edx
and ecx, esi
and edx, 0x7f
dec ecx
xor ecx, edx
mov dword [rax], ecx
test esi, ecx
jne 0x10007f7cc
mov rcx, rax
call fcn.100059224
lea rdx, [0x100007858]
xor r8d, r8d
mov rcx, rbx
call fcn.100055880
mov edx, dword [rax]
mov r12d, dword [rax + 8]
mov ecx, edx
and ecx, esi
cmp ecx, esi
je 0x10007f807
mov ecx, edx
not edx
and ecx, esi
and edx, 0x7f
dec ecx
xor ecx, edx
mov dword [rax], ecx
test esi, ecx
jne 0x10007f807
mov rcx, rax
call fcn.100059224
lea rdx, [0x1000078f0]
xor r8d, r8d
mov rcx, rbx
call fcn.100055880
mov edx, dword [rax]
mov ebp, dword [rax + 8]
mov ecx, edx
and ecx, esi
cmp ecx, esi
je 0x10007f841
mov ecx, edx
not edx
and ecx, esi
and edx, 0x7f
dec ecx
xor ecx, edx
mov dword [rax], ecx
test esi, ecx
jne 0x10007f841
mov rcx, rax
call fcn.100059224
test byte [rbx + 0x118], 1
je 0x10007f88f
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x10007f864
call qword [sym.imp.GDI32.dll_DeleteObject]
and qword [rbx + 0xf8], 0
mov rcx, rbx
call fcn.10007f4fc
mov rcx, qword [rbx + 0xc0]
mov r9d, 1
lea edx, [r9 + 0x2f]
mov r8, rax
mov qword [rbx + 0xf8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10007f8ec
mov ecx, dword [0x1000de19c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x10007f8e7
and dword [rsp + 0x30], 0
mov r10, qword [rax]
mov r9d, r15d
mov r8d, r14d
mov rdx, r13
mov rcx, rax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
call qword [r10]
mov rcx, qword [rbx + 0xc0]
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x2f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11, qword [rsi]
mov rcx, rsi
call qword [r11 + 8]
mov esi, 0xffffff80
test rdi, rdi
je 0x10007f916
mov edx, dword [rdi]
mov eax, edx
and eax, esi
cmp eax, esi
je 0x10007f916
mov eax, edx
not edx
and eax, esi
and edx, 0x7f
dec eax
xor eax, edx
mov dword [rdi], eax
test esi, eax
jne 0x10007f916
mov rcx, rdi
call fcn.100059224
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10007fb6c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x240], rax
test byte [rcx + 0x8b], 4
mov rbx, rcx
jne 0x10007fca3
test byte [rcx + 0x118], 8
je 0x10007fca3
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [rax + 1]
movsxd rdi, esi
add rdi, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x10007fca3
mov rcx, qword [rbx + 0xc0]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.10005e918
lea rdi, [0x10000c3f4]
mov rcx, rbp
test rax, rax
cmovne rdi, rax
mov r8, rdi
sub r8, rbp
movzx eax, word [rcx]
movzx edx, word [rcx + r8]
sub eax, edx
jne 0x10007fc39
add rcx, 2
test edx, edx
jne 0x10007fc25
test eax, eax
je 0x10007fc4d
mov rcx, qword [rbx + 0xc0]
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x10007fc81
mov edx, dword [rcx]
mov eax, edx
and eax, 0xffffff80
cmp eax, 0xffffff80
je 0x10007fc8f
mov eax, edx
not edx
and eax, 0xffffff80
and edx, 0x7f
dec eax
xor eax, edx
mov dword [rcx], eax
test eax, 0xffffff80
jne 0x10007fc8f
call fcn.100059224
jmp 0x10007fc8f
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000cd7d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x100081158
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x348
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x10008120b
lea rax, [0x1000137e8]
lea rcx, [rbx + 8]
xor edx, edx
mov r8d, 0x300
mov byte [rbx + 0x338], 0
mov byte [rbx + 0x339], 0
mov qword [rbx], rax
mov qword [rbx + 0x340], 1
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rax, [rbx + 0x308]
mov dword [rax], r11d
inc r11d
add rax, 4
cmp r11d, 8
jb 0x1000811c2
mov ecx, dword [0x1000de19c]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100081207
mov rcx, rbx
call fcn.100080c78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x100081210
xor eax, eax
jmp 0x100081210
mov eax, 0x8007000e
add rsp, 0x20
pop rbx
ret
Function at 0x10008121c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1000de19c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x10008125b
mov ecx, dword [0x1000de19c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdx, qword [rbx + 0x340]
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, rbx
call fcn.100080c78
add rsp, 0x20
pop rbx
ret

Function at 0x100089b88
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
mov qword [rcx + 0x10], r8
mov ecx, dword [0x1000de19c]
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
mov qword [rbx + 8], rax
cmp rax, rdi
je 0x100089d20
lea rdx, [0x1000078f0]
xor r8d, r8d
mov rcx, rbp
call fcn.100055880
lea r15d, [rdi - 0x80]
mov edx, dword [rax]
mov r14d, dword [rax + 8]
mov ecx, edx
and ecx, r15d
cmp ecx, r15d
je 0x100089c0c
mov ecx, edx
not edx
and ecx, r15d
and edx, 0x7f
dec ecx
xor ecx, edx
mov dword [rax], ecx
test r15d, ecx
jne 0x100089c0c
mov rcx, rax
call fcn.100059224
lea rdx, [0x100007858]
xor r8d, r8d
mov rcx, rbp
call fcn.100055880
mov edx, dword [rax]
mov r13d, dword [rax + 8]
mov ecx, edx
and ecx, r15d
cmp ecx, r15d
je 0x100089c4b
mov ecx, edx
not edx
and ecx, r15d
and edx, 0x7f
dec ecx
xor ecx, edx
mov dword [rax], ecx
test r15d, ecx
jne 0x100089c4b
mov rcx, rax
call fcn.100059224
lea rdx, [0x1000077c0]
xor r8d, r8d
mov rcx, rbp
call fcn.100055880
mov edx, dword [rax]
mov r12d, dword [rax + 8]
mov ecx, edx
and ecx, r15d
cmp ecx, r15d
je 0x100089c8a
mov ecx, edx
not edx
and ecx, r15d
and edx, 0x7f
dec ecx
xor ecx, edx
mov dword [rax], ecx
test r15d, ecx
jne 0x100089c8a
mov rcx, rax
call fcn.100059224
mov rsi, qword [rbp + 0x98]
mov r8d, dword [rbp + 0x90]
mov ecx, dword [rsi]
mov eax, ecx
and eax, r15d
cmp eax, r15d
je 0x100089cb3
mov eax, ecx
and ecx, 0x7f
and eax, r15d
sub eax, r15d
xor eax, ecx
mov dword [rsi], eax
mov rcx, qword [rbx + 8]
mov rax, qword [rbp + 0x98]
mov dword [rsp + 0x30], edi
mov r10, qword [rcx]
mov rdx, qword [rax + 8]
mov r9d, r12d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r13d
call qword [r10]
mov r8d, dword [rsi]
mov rbp, rax
mov ecx, r8d
and ecx, r15d
cmp ecx, r15d
je 0x100089d0b
mov edx, r8d
not r8d
and edx, r15d
and r8d, 0x7f
dec edx
xor edx, r8d
mov dword [rsi], edx
test r15d, edx
jne 0x100089d0b
mov rcx, rsi
call fcn.100059224
cmp rbp, rdi
je 0x100089d20
mov rcx, qword [rbx + 0x10]
mov rdx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdi, rax
lea r11, [rsp + 0x40]
mov qword [rbx], rdi
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000961e8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12d, 0xfffffff
mov rbx, qword [rax + 0x20]
test rbx, rbx
je 0x100096290
mov r8d, dword [rbx]
lea r9, [rbx + 8]
mov edx, r8d
shr edx, 0x1c
and edx, 1
je 0x100096232
mov rcx, qword [r9]
jmp 0x100096235
mov rcx, r9
xor r10d, r10d
and r8d, r12d
jbe 0x100096253
cmp qword [rcx], rsi
je 0x100096257
mov eax, dword [rbx]
inc r10d
add rcx, 8
and eax, r12d
cmp r10d, eax
jb 0x10009623d
or r10d, 0xffffffff
test r10d, r10d
js 0x100096290
test edx, edx
je 0x100096263
mov r9, qword [r9]
sub r8d, r10d
lea eax, [r10 + 1]
lea rcx, [r9 + r10*8]
dec r8d
lea rdx, [r9 + rax*8]
shl r8, 3
call sub.msvcrt.dll_memmove
mov r11d, dword [rbx]
lea eax, [r11 - 1]
xor eax, r11d
and eax, r12d
xor eax, r11d
mov dword [rbx], eax
xor edx, edx
mov rcx, rsi
call fcn.100096530
mov rdi, qword [rsi + 0x20]
test rdi, rdi
je 0x100096317
bt dword [rdi], 0x1c
mov eax, dword [0x1000e2e70]
jae 0x1000962d3
test al, 1
jne 0x1000962ca
or eax, 1
mov dword [0x1000e2e70], eax
lea rax, [0x100011f78]
mov qword [0x1000e2e58], rax
lea rcx, [0x1000e2e58]
jmp 0x1000962f5
test al, 2
jne 0x1000962ee
or eax, 2
mov dword [0x1000e2e70], eax
lea rax, fcn.1000a4148
mov qword [0x1000e2e50], rax
lea rcx, [0x1000e2e50]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
and dword [rdi], 0xe0000000
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x1000963ae
test dword [rbx], r12d
jne 0x1000963ae
bt dword [rbx], 0x1c
mov eax, dword [0x1000e2e74]
jae 0x100096359
test al, 1
jne 0x100096350
or eax, 1
mov dword [0x1000e2e74], eax
lea rax, [0x100011f78]
mov qword [0x1000e2e68], rax
lea rcx, [0x1000e2e68]
jmp 0x10009637b
test al, 2
jne 0x100096374
or eax, 2
mov dword [0x1000e2e74], eax
lea rax, fcn.1000a4148
mov qword [0x1000e2e60], rax
lea rcx, [0x1000e2e60]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
and dword [rbx], 0xe0000000
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and qword [rax + 0x20], 0
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1000963cb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret
Function at 0x1000966e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov byte [rcx + 0x18], 1
mov dword [rcx + 0x28], r8d
mov dword [rcx + 0x2c], r9d
and qword [rcx + 0x20], 0
mov ebx, edx
mov rsi, rcx
test edx, edx
js 0x100096764
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0x20]
xor eax, eax
test rcx, rcx
je 0x100096731
mov eax, dword [rcx]
and eax, 0xfffffff
xor edx, edx
test eax, eax
jle 0x100096764
mov r8d, dword [rcx]
movsxd r9, eax
shr r8d, 0x1c
and r8d, 1
test r8d, r8d
je 0x100096750
mov rax, qword [rcx + 8]
jmp 0x100096754
lea rax, [rcx + 8]
mov rax, qword [rax + rdx*8]
cmp dword [rax], ebx
je 0x10009678e
inc rdx
cmp rdx, r9
jl 0x100096745
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x10009679a
mov ebx, 0x8007000e
jmp 0x100096894
inc dword [rax + 0x28]
mov qword [rsi + 0x20], rax
jmp 0x100096886
and dword [rax + 0x10], 0
mov dword [rax + 0x28], 1
mov dword [rax], ebx
test ebx, ebx
js 0x10009680f
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rax + 0x20]
test rbx, rbx
jne 0x1000967fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx + 8]
lea r8d, [rbx + 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x100096837
and dword [rax], 0x80000000
mov ecx, dword [0x1000de268]
xor eax, eax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rax + 0x20], rbx
mov rdx, rdi
mov rcx, rbx
call fcn.100097144
mov ebx, eax
test eax, eax
js 0x100096854
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x10009683e
and qword [rdi + 0x20], rax
mov ebx, 0x8007000e
jmp 0x100096854
mov ebx, 0x8007000e
jmp 0x100096858
and dword [rax], 0x80000000
xor ecx, ecx
xor ebx, ebx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rdi + 0x20], rax
test ebx, ebx
jns 0x10009687c
add dword [rdi + 0x28], 0xffffffff
jne 0x100096882
mov rcx, rdi
call fcn.1000961e8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100096882
mov qword [rsi + 0x20], rdi
xor ebx, ebx
test ebx, ebx
js 0x100096894
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1000963e8
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10009a994
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x250
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebp, ebp
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r13d, 0x104
lea rcx, [rsp + 0x30]
mov edx, r13d
mov qword [0x1000e29a0], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebp
je 0x10009ab20
mov rax, r13
lea rcx, [rsp + 0x30]
lea r12d, [rbp + 1]
cmp word [rcx], bp
je 0x10009aa08
add rcx, 2
sub rax, r12
jne 0x10009a9fa
cmp rax, rbp
je 0x10009ab20
lea r8, [0x1000199d8]
lea rcx, [rsp + 0x30]
mov rsi, r13
mov rdx, r13
sub rsi, rax
call fcn.10006da60
cmp eax, ebp
jl 0x10009ab20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1000e2990], rax
cmp rax, rbp
je 0x10009ab20
lea rdi, [0x1000de1a8]
mov rdx, qword [rdi - 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi]
cmp qword [rax], rbp
je 0x10009ab1e
add ebx, r12d
add rdi, 0x10
cmp ebx, 6
jae 0x10009aa89
mov rax, qword [0x1000e2990]
jmp 0x10009aa55
mov edi, 4
lea rcx, [rsp + 0x20]
mov ebx, ebp
lea eax, [rdi + 7]
mov word [rsp + 0x22], bp
mov word [rsp + 0x26], bp
mov word [rsp + 0x24], ax
mov word [rsp + 0x20], di
call qword [0x1000e2960]
cmp rax, rbp
je 0x10009aabf
cmp word [rax + 4], di
cmovae ebx, r12d
cmp ebx, ebp
je 0x10009ab20
mov ebx, ebp
cmp rsi, rbp
je 0x10009ab20
lea r8, [0x1000199f8]
lea rcx, [rsp + 0x30]
mov rdx, r13
mov word [rsp + rsi*2 + 0x30], bp
call fcn.10006da60
cmp eax, ebp
jl 0x10009ab20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1000e2998], rax
cmp rax, rbp
je 0x10009ab20
lea rdx, [0x100019a10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
mov qword [0x1000e2958], rax
cmovne ebx, r12d
jmp 0x10009ab20
mov ebx, ebp
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000cd7d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x10009b214
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x100019b50]
mov rbx, rcx
mov qword [rcx], rax
lea rax, fcn.10009b570
mov qword [rcx + 0x10], rax
lea rax, [0x100019bb0]
mov qword [rcx + 0x18], rax
lea rax, [0x100019bf8]
mov qword [rcx + 0x20], rax
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x10009b25b
call fcn.1000a0018
and qword [rbx + 0x30], 0
mov rcx, rbx
call fcn.10007cd10
cmp byte [rbx + 0x100], 0
je 0x10009b279
lea rcx, [rbx + 0xd8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [rbx + 0x101], 0
je 0x10009b295
lea rcx, [0x100000000]
mov byte [rbx + 0x101], 0
call fcn.100078b84
lea rax, [0x10001a398]
mov qword [rbx], rax
add rsp, 0x20
pop rbx
jmp fcn.100060230
Function at 0x10009f0fc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x100019d98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
je 0x10009f1dd
lea rdx, [0x100019dc8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100019dd8]
mov rcx, rdi
mov qword [0x1000df730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100019df8]
mov rcx, rdi
mov qword [0x1000df7a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100019e20]
mov rcx, rdi
mov qword [0x1000df6e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100019e38]
mov rcx, rdi
mov qword [0x1000df8d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100019e58]
mov rcx, rdi
mov qword [0x1000df788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1000df740], rax
cmp qword [0x1000df730], rbx
je 0x10009f1dd
cmp qword [0x1000df7a8], rbx
je 0x10009f1dd
cmp qword [0x1000df6e8], rbx
je 0x10009f1dd
cmp qword [0x1000df8d0], rbx
je 0x10009f1dd
cmp qword [0x1000df788], rbx
je 0x10009f1dd
cmp rax, rbx
jne 0x10009f1f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
mov ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000a1694
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1000de268]
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
bt ebx, 0xf
mov rbp, qword [rax + 0x28]
jae 0x1000a1755
lea ecx, [rdi + 2]
xor edx, edx
call fcn.1000a0b08
cmp al, dil
je 0x1000a1755
test byte [rsi + 0x88], 0x80
je 0x1000a1755
mov rcx, rsi
call fcn.10005fb00
cmp rax, rdi
je 0x1000a1755
mov ecx, dword [rbp]
mov r8d, edi
mov edx, ecx
and edx, 0xfffffff
cmp edx, edi
jbe 0x1000a1748
shr ecx, 0x1c
mov r10, rdi
and ecx, 1
cmp ecx, edi
je 0x1000a1713
mov rax, qword [rbp + 8]
jmp 0x1000a1717
lea rax, [rbp + 8]
mov r9, qword [r10 + rax]
mov rax, rsi
cmp r9, rax
je 0x1000a1755
jmp 0x1000a172e
test byte [rax + 0x88], 0x80
jne 0x1000a1737
mov rax, qword [rax + 0x48]
cmp rax, rdi
jne 0x1000a1725
cmp rax, rdi
jne 0x1000a171e
inc r8d
add r10, 8
cmp edx, r8d
ja 0x1000a1709
mov r8, rsi
mov rcx, rbp
call fcn.10005fe4c
mov edi, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x1000a250c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
mov rcx, rsi
mov rbp, qword [rax + 0x28]
xor ebx, ebx
call fcn.10009d104
test al, al
je 0x1000a25be
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx + 8]
lea r8d, [rbx + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1000a256c
mov ebx, 0x8007000e
jmp 0x1000a267d
mov qword [rax], rsi
cmp byte [rsp + 0x58], bl
je 0x1000a258b
lea rdx, [rax + 8]
mov rcx, rsi
call fcn.10009dde4
mov ebx, eax
test eax, eax
js 0x1000a267d
cmp byte [rsp + 0x60], 0
je 0x1000a25a0
mov rcx, qword [rdi]
lea rdx, [rdi + 0x28]
call fcn.10009dec0
mov ebx, eax
test ebx, ebx
js 0x1000a267d
lea rcx, [rbp + 0x18]
mov rdx, rdi
call fcn.1000a3d28
mov ebx, eax
test eax, eax
js 0x1000a267d
test byte [rsi + 0x89], 2
je 0x1000a25de
lea rdx, [0x100007160]
xor r8d, r8d
mov rcx, rsi
call fcn.100055880
mov rdi, rax
jmp 0x1000a25e8
mov rax, qword [0x100007188]
mov rdi, qword [rax]
mov rsi, qword [rdi + 8]
mov qword [rsp + 0x20], rdi
test rsi, rsi
je 0x1000a2652
mov ecx, dword [rsi]
and dword [rsp + 0x68], 0
test ecx, 0xfffffff
jbe 0x1000a2652
mov dil, byte [rsp + 0x60]
xor ebp, ebp
bt ecx, 0x1c
jae 0x1000a2618
mov rcx, qword [rsi + 8]
jmp 0x1000a261c
lea rcx, [rsi + 8]
mov dl, byte [rsp + 0x58]
mov rcx, qword [rcx + rbp]
mov r8b, dil
call fcn.1000a250c
mov ebx, eax
test eax, eax
js 0x1000a264d
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsi]
add rbp, 8
inc edx
mov eax, ecx
and eax, 0xfffffff
mov dword [rsp + 0x68], edx
cmp eax, edx
ja 0x1000a260c
mov rdi, qword [rsp + 0x20]
mov ecx, dword [rdi]
mov eax, ecx
and eax, 0xffffff80
cmp eax, 0xffffff80
je 0x1000a267d
mov eax, ecx
not ecx
and eax, 0xffffff80
and ecx, 0x7f
dec eax
xor eax, ecx
mov dword [rdi], eax
test eax, 0xffffff80
jne 0x1000a267d
mov rcx, rdi
call fcn.100059224
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000a2694
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, r8
mov r12, rcx
mov byte [r8], 0
xor esi, esi
call fcn.1000a0ad0
test al, al
je 0x1000a279f
mov rax, qword [rdx + 0x28]
mov edx, dword [rax + 0xc]
cmp edx, 6
je 0x1000a26ef
cmp edx, 5
je 0x1000a26ef
cmp edx, 0xf
je 0x1000a26ef
cmp edx, 0x10
je 0x1000a26ef
cmp edx, 0x18
je 0x1000a26ef
cmp edx, 0x19
jne 0x1000a279f
mov ecx, dword [0x1000df7f0]
call fcn.1000a0bb4
test al, al
jne 0x1000a2720
mov ecx, dword [0x1000df7d8]
call fcn.1000a0bb4
test al, al
jne 0x1000a2720
mov ecx, dword [0x1000df8cc]
call fcn.1000a0bb4
test al, al
jne 0x1000a2720
xor bl, bl
jmp 0x1000a2722
mov bl, 1
mov ecx, dword [0x1000df850]
call fcn.1000a0bb4
mov dil, al
test bl, bl
jne 0x1000a2738
test al, al
je 0x1000a279f
mov ecx, dword [0x1000de268]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
mov r8, qword [rax + 0x28]
mov r10d, dword [r8 + 0x18]
and r10d, 0xfffffff
jbe 0x1000a2788
mov r9d, dword [r8 + 0x18]
shr r9d, 0x1c
and r9d, 1
xor ecx, ecx
test r9d, r9d
je 0x1000a2770
mov rax, qword [r8 + 0x20]
jmp 0x1000a2774
lea rax, [r8 + 0x20]
mov rax, qword [rcx + rax]
cmp qword [rax], r12
je 0x1000a279f
inc edx
add rcx, 8
cmp r10d, edx
ja 0x1000a2765
mov r8b, dil
mov dl, bl
mov rcx, r12
call fcn.1000a250c
mov esi, eax
test eax, eax
js 0x1000a279f
mov byte [rbp], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret
Function at 0x1000a74f4
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [0x1000e29b0], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000a7573
cmp dword [rsp + 0x24], 5
jb 0x1000a7553
cmp dword [rsp + 0x28], 1
jae 0x1000a755a
cmp dword [rsp + 0x24], 6
jb 0x1000a7573
mov eax, dword [0x1000de198]
cmp dword [rsp + 0x30], 2
mov ecx, 0x7f
cmove eax, ecx
mov dword [0x1000de198], eax
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000cd7d0
add rsp, 0x150
pop rbx
ret