joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140108ff0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x140109059
cmp byte [rbx + 0x148], 0
je 0x140109027
lea rcx, [rbx + 0x150]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov byte [rbx + 0x148], 0
mov rcx, qword [rbx + 0xe8]
test rcx, rcx
je 0x140109048
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x140109048
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rbx + 0x10]
call fcn.1400f0e90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1401090a6
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140109095
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140109095
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1401090b1
inc ecx
inc rax
cmp rax, 6
jl 0x140109083
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1b8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010b1b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x14010b1fb
lea rbx, [rax + 8]
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14010b1eb
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b1eb
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, rbx
call fcn.1400f0e90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010b248
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b237
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010b237
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010b253
inc ecx
inc rax
cmp rax, 6
jl 0x14010b225
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x168]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14010b280
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14010b2ac
add rcx, 0x10
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010b2f9
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b2e8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010b2e8
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010b304
inc ecx
inc rax
cmp rax, 6
jl 0x14010b2d6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x78]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14010b4b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rbp + 0x128], rax
mov rdi, rdx
xor esi, esi
mov rax, qword [rcx + 0x28]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x40]
call rbx
nop
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0x108], rcx
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x118], rax
lea rax, fcn.140009110
mov qword [rsp + 0x50], rax
lea rax, [0x1404048f8]
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call rax
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x120], rax
lea rax, [0x140403eb0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
lea rax, [fcn.140009110]
cmp rdx, rax
je 0x14010b580
lea rcx, [rsp + 0x40]
call rdx
nop
mov rcx, qword [rbp + 0x118]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010b5b4
lea rcx, [0x14010c6b0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xf8]
call rax
jmp 0x14010b65b
mov r14, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14010c330
mov rdi, rax
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b5e2
mov rsi, qword [rax + 8]
mov r8d, 0x198
mov rdx, rsi
call fcn.140100b00
mov rbx, rax
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14010c330
lea rax, [0x14010c850]
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdi + 0x108]
test rcx, rcx
je 0x14010b62f
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b62f
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rdi + 0x30]
call fcn.1400f0e90
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf8]
call r14
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14010b65b
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp + 0x108]
mov rdx, qword [rax]
lea rcx, [rbp + 0xf8]
call rdx
nop
mov rcx, qword [rbp + 0x128]
xor rcx, rsp
call fcn.14028bc70
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010b970
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010b9bb
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14010b9a5
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b9a5
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax]
lea rcx, [rbx + 8]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010ba08
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b9f7
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010b9f7
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010ba13
inc ecx
inc rax
cmp rax, 6
jl 0x14010b9e5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x68]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010ba40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010baa5
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x14010ba77
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010ba77
mov rax, qword [rcx]
call qword [rax + select]
cmp byte [rbx + 0x58], 0
je 0x14010ba8f
lea rcx, [rbx + 0x60]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov byte [rbx + 0x58], 0
mov rax, qword [rbx + 0x20]
mov rdx, qword [rax]
lea rcx, [rbx + 0x10]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010baf3
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010bae2
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010bae2
mov ecx, 4
mov eax, ecx
nop
cmp qword [rdx + rax*8], 0
je 0x14010bafe
inc ecx
inc rax
cmp rax, 6
jl 0x14010bad0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xf0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14010c3b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rbp, rcx
mov rcx, qword [rcx + 0x20]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010c3f3
lea rcx, [0x14010c840]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
jmp 0x14010c4fd
mov r15, qword [rcx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14010c530
mov rsi, rax
mov qword [rsp + 0xf0], rax
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
test rax, rax
je 0x14010c425
mov rdx, qword [rax + 8]
jmp 0x14010c428
mov rdx, rbx
mov r8d, 0x90
call fcn.140100b00
mov rdi, rax
mov ecx, dword [rsi]
mov dword [rax + 8], ecx
lea rcx, [rax + 0x10]
lea rdx, [rsi + 8]
call fcn.1400d3e30
mov rcx, qword [rsi + 0x38]
mov qword [rdi + 0x40], rcx
mov rax, qword [rsi + 0x40]
mov qword [rdi + 0x48], rax
mov qword [rsi + 0x40], rbx
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 0x48]
mov qword [rsi + 0x48], rbx
mov qword [rdi + 0x50], rax
lea rcx, [rdi + 0x58]
lea rdx, [rsi + 0x50]
call fcn.1400d3e30
lea rax, [0x14010cdd0]
mov qword [rdi], rax
mov qword [rsp + 0xe0], rdi
mov rax, qword [rsi + 0x60]
mov rdx, qword [rax]
lea rcx, [rsi + 0x50]
call rdx
nop
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x14010c4ac
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x14010c4cb
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010c4cb
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rsi + 0x18]
mov rdx, qword [rax]
lea rcx, [rsi + 8]
call rdx
nop
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call r15
nop
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14010c4fd
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14010c5a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x14010c5eb
lea rbx, [rax + 0x38]
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14010c5db
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010c5db
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, rbx
call fcn.1400f0e90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010c638
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010c627
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010c627
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010c643
inc ecx
inc rax
cmp rax, 6
jl 0x14010c615
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x198]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14010c700
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14010c727
add rcx, 8
call fcn.14010bf60
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010c774
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010c763
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010c763
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010c77f
inc ecx
inc rax
cmp rax, 6
jl 0x14010c751
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14010d210
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x20]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010d258
lea rcx, [0x14010d6c0]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rdx
lea rdx, [rbp - 0x60]
mov rcx, rdi
call rax
jmp 0x14010d365
mov rsi, qword [rcx + 0x10]
mov eax, dword [rdx]
mov dword [rbp - 0x50], eax
add rdx, 8
lea rcx, [rbp - 0x48]
call fcn.1400d3e30
mov rax, qword [rbx + 0x38]
mov qword [rbp - 0x18], rax
mov rax, qword [rbx + 0x40]
mov qword [rbp - 0x10], rax
xor r14d, r14d
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x38], r14
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x48], r14
mov qword [rbp - 8], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x30], rax
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010d2b4
mov rdx, qword [rax + 8]
jmp 0x14010d2b7
mov rdx, r14
mov r8d, 0x60
call fcn.140100b00
mov rbx, rax
mov ecx, dword [rbp - 0x50]
mov dword [rax + 8], ecx
lea rcx, [rax + 0x10]
lea rdx, [rbp - 0x48]
call fcn.1400d3e30
mov rcx, qword [rbp - 0x18]
mov qword [rbx + 0x40], rcx
mov rcx, qword [rbp - 0x10]
mov qword [rbx + 0x48], rcx
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], r14
mov rax, qword [rbp - 8]
mov qword [rbp - 8], r14
mov qword [rbx + 0x50], rax
lea rax, [0x14010d700]
mov qword [rbx], rax
mov qword [rbp + 0x20], rbx
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14010d31d
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14010d33c
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010d33c
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rbp - 0x38]
mov rdx, qword [rax]
lea rcx, [rbp - 0x48]
call rdx
nop
lea rdx, [rbp + 0x20]
mov rcx, rdi
call rsi
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14010d365
mov rax, qword [rcx]
xor edx, edx
call rax
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010d5e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010d63d
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14010d609
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14010d627
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010d627
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rbx + 0x10]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010d68a
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010d679
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010d679
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010d695
inc ecx
inc rax
cmp rax, 6
jl 0x14010d667
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x60]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010d880
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010d8e0
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14010d8ac
mov edx, 0xb8
call fcn.14028bc90
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14010d8ca
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010d8ca
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rbx + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010d933
mov ecx, dword [0x1408047a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010d922
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010d922
mov ecx, 4
mov eax, ecx
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14010d93e
inc ecx
inc rax
cmp rax, 6
jl 0x14010d910
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xb0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401aebc0
Capabilities:
Hash data using fnv

Disassembly:
mov r9, qword [rdx]
movabs r11, 0x100000001b3
movabs rdx, 0xcbf29ce484222325
mov rax, r9
shr rax, 8
movzx r10d, al
movzx eax, r9b
xor rax, rdx
imul rax, r11
xor r10, rax
mov rax, r9
shr rax, 0x10
movzx ecx, al
mov rax, r9
shr rax, 0x18
imul r10, r11
xor r10, rcx
movzx ecx, al
mov rax, r9
shr rax, 0x20
movzx r8d, al
mov rax, r9
xor r8, rdx
shr rax, 0x28
imul r8, r11
imul r10, r11
xor r10, rcx
movzx ecx, al
xor r8, rcx
mov rax, r9
shr rax, 0x30
movzx ecx, al
mov eax, 0x9e3779b9
imul r8, r11
imul r10, r11
xor r8, rcx
shr r9, 0x38
imul r8, r11
xor r8, r9
imul r8, r11
mov rcx, r8
mov rdx, r8
shl rcx, 6
shr rdx, 2
add rcx, r10
add rax, rdx
add rax, rcx
xor rax, r8
ret
Function at 0x140227af0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140227b11
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140227b3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140227b40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140227b99
test ecx, ecx
jle 0x140227b79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140227b99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140227b99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
cld
test al, 0x33
movabs eax, dword [0xbdcd7f10f0d56222]
jns 0x140731e0e
insb byte [rdi], dx
sub al, 0x10
cmp eax, 0xbe6abc7
push rbp
invalid
fild word [0x18fad9773]
pop rdi
jns 0x140731e4d
mov eax, 0x607d09f1
or dword [rbp + 0x60], edi
Function at 0x140227bc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140227bf1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140227c08
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140227c2b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140227c2d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140227c69
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140227cfe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140227ca4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140227cde
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140227cfe
cmp rbx, rax
ja 0x140227cb0
test rbx, rbx
je 0x140227cfe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
cmp edi, ecx
invalid
Function at 0x140228160
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14022818d
xor eax, eax
jmp 0x1402282f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1402281c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1402281c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1402282f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1402282ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14022820a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140228235
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1402282f1
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1402282a4
sub eax, 1
je 0x1402282a4
cmp eax, 2
jne 0x1402282ec
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1402282f1
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1402282d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1402282ec
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1402282f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14028bc70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret