joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028bbb
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
cmp qword [rcx], 0
jle 0x140028dd3
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x140028dad
mov rax, qword [rsp + 0x50]
movabs rcx, 0x535d8d2f76b43bf
movabs rdx, 0xada8f2ed1932bb33
xor rcx, rdx
sub rax, rcx
movabs rcx, 0x580d178589338f06
movabs rdx, 0xa7f2e87a76cc70f6
xor rcx, rdx
add rax, rcx
movabs rcx, 0xa89d2a3fee59f88c
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
movabs rcx, 0xfdc8c2bc3b571116
movabs rdx, 0xfdc8c2bc3b571106
xor rcx, rdx
cmp rax, rcx
jb 0x140028d1f
mov r8, qword [rsp + 0x40]
movabs rcx, 0x70587dffbdb5f421
movabs rax, 0x8fa78200424a0bd1
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x30], rax
mov rdx, rax
and rdx, r8
shl rdx, 1
mov rcx, rax
add rcx, r8
sub rcx, rdx
movabs rdx, 0x816237a321bd6646
movabs r8, 0x816237a321bd6646
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140028d03
jmp 0x140028d0d
call fcn.14000a590
jmp 0x140028dad
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x140028dad
mov rcx, qword [rsp + 0x50]
call fcn.14016b46c
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x140028e08
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
movabs rdx, 0x939ea05a1fc39a16
movabs r8, 0x939ea05a1fc39a16
xor rdx, r8
movabs r8, 0x3615a5af1ffe5767
movabs r9, 0x3615a5af1ffe5766
xor r8, r9
sub rdx, r8
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
and rax, 1
or rdx, 1
add rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x140028bfd
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140028e08
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret
Function at 0x140028e0e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx]
movabs rcx, 0x3617f87a8789d1a3
movabs rdx, 0x3617f87a8789d1a3
xor rcx, rdx
cmp rax, rcx
jle 0x140028ff1
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x140028fbf
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x40], rax
movabs rcx, 0x702cdc2e2b84b7a8
movabs rdx, 0x702cdc2e2b84b7b8
xor rcx, rdx
cmp rax, rcx
jb 0x140028f6f
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov rcx, r8
and rcx, rdx
movabs rdx, 0x5997d95a25026dc5
movabs r9, 0xa66826a5dafd923a
xor rdx, r9
xor r8, rdx
mov rdx, rax
and rdx, r8
or rcx, rdx
movabs rdx, 0xf55e5c5ab0215673
movabs r8, 0xf55e5c5ab0215673
xor rdx, r8
cmp rcx, rdx
setl cl
movabs rdx, 0x9a26d2a23f5185e8
movabs r8, 0x65d92d5dc0ae7a17
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x140028f53
jmp 0x140028f5d
call fcn.14000a590
jmp 0x140028fbf
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x140028fbf
mov rcx, qword [rsp + 0x50]
call fcn.1401347ba
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x140029026
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movabs rdx, 0x6e10a1ccb60811e4
movabs r8, 0x6e10a1ccb60811e5
xor rdx, r8
add rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x140028e69
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140029026
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret

Function at 0x14002902c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400892fc
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002906c
mov rcx, qword [rsp + 0x28]
call fcn.14008945b
nop
add rsp, 0x38
ret
Function at 0x140029828
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140054106
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x140029879
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
add rsp, 0x38
ret
Function at 0x140029ebd
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400f98ef
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
xor ecx, ecx
xor cl, 0
cmp al, cl
jne 0x140029f03
mov rcx, qword [rsp + 0x28]
call fcn.1400f9a6e
nop
add rsp, 0x38
ret
Function at 0x14002a55a
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14005ad14
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0xec
xor cl, 0xec
cmp al, cl
jne 0x14002a5b1
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
add rsp, 0x38
ret
Function at 0x14002ab8a
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14002ac93
mov rcx, qword [rsp + 0x40]
movabs rdx, 0xf4544dbf0d5b0f8b
movabs rax, 0xbabb240f2a4f07b
xor rdx, rax
mov rax, rcx
and rax, rdx
movabs rdx, 0x64a144c871c88136
movabs r8, 0x9b5ebb378e377ec6
xor rdx, r8
or rcx, rdx
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x14002ac72
mov rdx, qword [rsp + 0x38]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x14002ac41
jmp 0x14002ac4b
call fcn.14000a590
jmp 0x14002ac93
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
mov cl, 1
xor cl, 1
and cl, 1
call fcn.140013f0f
jmp 0x14002ac93
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.140013f0f
mov rcx, qword [rsp + 0x40]
call fcn.140014085
nop
add rsp, 0x48
ret

Function at 0x14002b221
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14002b255
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x28
ret

Function at 0x14002b2a4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14002b2d8
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x28
ret

Function at 0x14002b658
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rcx
mov rax, rcx
mov qword [rsp + 0x48], rax
mov qword [rcx], 0
mov rax, rcx
add rax, 8
mov qword [rsp + 0x50], rax
mov qword [rcx + 8], 0
mov rdx, qword [rdx]
call fcn.14002b3be
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
cmp rax, 0
jle 0x14002b72d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
add rcx, 8
mov qword [rsp + 0x28], rcx
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
mov r8, qword [r8]
mov r8b, byte [r8 + rax + 8]
mov byte [rdx + rax + 8], r8b
movabs rdx, 0x2de1e2edcbd1db72
movabs r8, 0x2de1e2edcbd1db72
xor rdx, r8
movabs r8, 0x2c36926e583f40d1
movabs r9, 0x2c36926e583f40d0
xor r8, r9
sub rdx, r8
sub rax, rdx
cmp rax, rcx
mov qword [rsp + 0x38], rax
jne 0x14002b6ca
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
Function at 0x14002b92e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14007d84b
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0xaf
xor cl, 0xaf
cmp al, cl
jne 0x14002b974
mov rcx, qword [rsp + 0x28]
call fcn.14007d843
nop
add rsp, 0x38
ret

Function at 0x14002c430
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400bef9b
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002c470
mov rcx, qword [rsp + 0x28]
call fcn.1400bf17c
nop
add rsp, 0x38
ret
Function at 0x14002d023
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rcx
mov rax, qword [rcx]
movabs rcx, 0x3e64f05037fae33e
movabs rdx, 0x3e64f05037fae33e
xor rcx, rdx
cmp rax, rcx
jle 0x14002d21f
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x48]
cmp rax, 0
je 0x14002d1d3
mov rax, qword [rsp + 0x48]
movabs rcx, 0xd5894fe1bee0da86
movabs rdx, 0x4eb1f4c229b685e7
xor rcx, rdx
add rax, rcx
movabs rcx, 0x6fafe2e3c27260a
movabs rdx, 0xf90501d1c3d8d9fa
xor rcx, rdx
add rax, rcx
movabs rcx, 0x9b38bb2397565f61
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0x534088d3f95da102
movabs rdx, 0x534088d3f95da112
xor rcx, rdx
cmp rax, rcx
jb 0x14002d1a0
mov rdx, qword [rsp + 0x38]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xd3c00addd144296c
movabs r8, 0xd3c00addd144296c
xor rdx, r8
cmp rcx, rdx
setl dl
movabs rcx, 0x2b56f82244ac4046
movabs r8, 0xd4a907ddbb53bfb9
xor rcx, r8
cmp rax, rcx
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x14002d175
jmp 0x14002d17f
call fcn.14000a590
jmp 0x14002d1d3
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140013f0f
jmp 0x14002d1d3
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.140013f0f
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140014085
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
movabs rdx, 0x1ea894be1c3a53b5
movabs r8, 0x1ea894be1c3a53b5
xor rdx, r8
movabs r8, 0xfbc9c966e4fe8d47
movabs r9, 0xfbc9c966e4fe8d46
xor r8, r9
sub rdx, r8
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x58], rax
jl 0x14002d064
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14002d254
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x68
ret

Function at 0x14002d25a
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14012177c
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002d29a
mov rcx, qword [rsp + 0x28]
call fcn.1401218d5
nop
add rsp, 0x38
ret
Function at 0x14002d7c3
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx]
movabs rcx, 0x64fa1112b2d88e67
movabs rdx, 0x64fa1112b2d88e67
xor rcx, rdx
cmp rax, rcx
jle 0x14002da1d
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x14002d99d
mov rax, qword [rsp + 0x50]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
movabs rdx, 0xdc67274fe92e1bab
movabs r8, 0xdc67274fe92e1bab
xor rdx, r8
movabs r8, 0x5ff516e5a4fffbb9
movabs r9, 0x5ff516e5a4fffbb8
xor r8, r9
sub rdx, r8
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x14002d94d
mov rdx, qword [rsp + 0x40]
movabs rax, 0xdad0e5b59f03ecca
movabs rcx, 0x252f1a4a60fc133a
xor rax, rcx
mov rcx, rdx
and rcx, rax
movabs rax, 0xafc7472ce2c21dfe
movabs r8, 0xafc7472ce2c21dfc
xor rax, r8
imul rcx, rax
mov rax, rdx
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
or al, al
xor edx, edx
xor dl, 1
xor al, dl
or cl, cl
mov dl, 1
xor dl, 0
xor cl, dl
xor edx, edx
xor dl, 1
xor al, dl
xor edx, edx
xor dl, 1
xor cl, dl
and al, cl
test al, 1
jne 0x14002d931
jmp 0x14002d93b
call fcn.14000a590
jmp 0x14002d99d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x14002d99d
mov rcx, qword [rsp + 0x50]
call fcn.1401214b1
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x14002da52
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movabs rdx, 0xecba72e1e0ec1616
movabs r8, 0xecba72e1e0ec1616
xor rdx, r8
sub rdx, rax
movabs rax, 0x533403e9897c98da
movabs r8, 0x533403e9897c98da
xor rax, r8
movabs r8, 0x769ccf618b3fcd92
movabs r9, 0x769ccf618b3fcd93
xor r8, r9
sub rax, r8
add rdx, rax
movabs rax, 0xfeb7be973539ed0c
movabs r8, 0xfeb7be973539ed0c
xor rax, r8
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x14002d81e
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14002da52
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret
Function at 0x14002dc48
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140120c9d
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002dc88
mov rcx, qword [rsp + 0x28]
call fcn.140120e32
nop
add rsp, 0x38
ret
Function at 0x14002e66b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140136161
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002e6ab
mov rcx, qword [rsp + 0x28]
call fcn.1401362be
nop
add rsp, 0x38
ret
Function at 0x14002ef2f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401351da
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002ef6f
mov rcx, qword [rsp + 0x28]
call fcn.140135384
nop
add rsp, 0x38
ret
Function at 0x14002f0c3
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60
mov qword [rsp + 0x68], rax
mov rax, qword [rcx]
mov qword [rsp + 0x70], rax
cmp rax, rdx
jle 0x14002f115
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.14002ef75
jmp 0x14002f3bc
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jge 0x14002f3bc
mov rax, qword [rsp + 0x58]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x14002f1d1
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
movabs rdx, 0x266739fa393a9f37
movabs r8, 0xd998c605c6c560c8
xor rdx, r8
xor rax, rdx
mov r8, 0xffffffffffffffff
movabs rdx, 0xbfffffffffffffff
xor r8, rdx
mov rdx, 0xffffffffffffffff
movabs r9, 0x7dca90f2b5eb025b
xor rdx, r9
or rax, r8
movabs r8, 0x7dca90f2b5eb025b
or rdx, r8
movabs r8, 0x5f776886823d6c4b
movabs r9, 0xa08897797dc293b4
xor r8, r9
xor rax, r8
and rax, rdx
cmp rax, rcx
jge 0x14002f247
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rdx, rax
sub rdx, rcx
mov qword [rsp + 0x40], rdx
xor rax, rdx
xor rdx, rcx
mov rcx, rax
and rcx, rdx
test rax, rax
sets al
test rcx, rcx
setns cl
add al, cl
inc al
test al, 1
jne 0x14002f23d
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.1400184ef
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rax], rcx
jmp 0x14002f247
call fcn.14000a590
jmp 0x14002f3bc
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rcx], rdx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jge 0x14002f3bc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
xor eax, eax
mov edx, eax
call fcn.14013538c
mov rax, qword [rsp + 0x68]
cmp byte [rax], 0
jne 0x14002f3bc
mov r9, qword [rsp + 0x30]
mov rcx, r9
and rcx, 1
movabs rax, 0x68272f264d830b41
movabs rdx, 0x68272f264d830b43
xor rax, rdx
imul rcx, rax
movabs rdx, 0x22336541125943ac
movabs rax, 0x22336541125943ad
xor rdx, rax
mov rax, r9
xor rax, rdx
add rax, rcx
movabs rcx, 0x27b89cc640bb1d6
movabs rdx, 0xfd8476339bf44e29
xor rcx, rdx
mov rdx, r9
xor rdx, rcx
movabs rcx, 0x96158ab2cf87c234
and rdx, rcx
mov r10, 0xffffffffffffffff
movabs rcx, 0x96158ab2cf87c234
xor r10, rcx
and r9, r10
movabs rcx, 0x650b7e35c039883f
movabs r8, 0x9af481ca3fc677c0
xor rcx, r8
movabs r8, 0x49c0b1973606fa22
movabs r11, 0xb63f4e68c9f905dd
xor r8, r11
xor rcx, r8
movabs r8, 0x2ec8dab6ddd97417
movabs r11, 0xb8dd5004125eb623
xor r8, r11
and rcx, r8
movabs r8, 0x9e2a52450c105452
movabs r11, 0x61d5adbaf3efabad
xor r8, r11
and r8, r10
or rdx, r9
or rcx, r8
xor rdx, rcx
xor rdx, 0xffffffffffffffff
mov rcx, rax
xor rcx, rdx
and rcx, rax
cmp rcx, 0
mov qword [rsp + 0x38], rax
jge 0x14002f25e
call fcn.14000a590
nop
add rsp, 0x78
ret