joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400297b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400297e7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x140029808
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002980a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140029870
test ecx, ecx
jle 0x14002983e
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140029870
cmp qword [rdi + 0x80], 0
je 0x140029870
mov rcx, rdi
call fcn.14002c4e0
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140029d70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140029d9d
xor eax, eax
jmp 0x140029ef2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140029dc8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140029dc8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140029ef2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140029ee5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140029e0b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140029e36
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140029eea
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x140029ee5
cmp eax, 1
jle 0x140029ea5
cmp eax, 3
jne 0x140029ee5
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140029eea
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140029ed3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140029ee5
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x140029eea
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401e4940
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14002c510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14002c5bb
cmp byte [rcx + 0x71], 0
je 0x14002c5bb
mov edx, 0xffffffff
call fcn.140029d70
cmp eax, 0xffffffff
je 0x14002c57c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002c580
sub eax, 1
je 0x14002c584
sub eax, 2
je 0x14002c5bb
xor al, al
jmp 0x14002c5bd
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14002c5b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002c57c
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14002c5bd
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401e4940
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140047be0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xa8
mov qword [rsp + 0x68], 0xfffffffffffffffe
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rsp + 0x48], xmm1
lea rdi, [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov rbx, qword [rdi]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140047c43
cmp qword [rax], rbx
je 0x140047d43
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140047c31
lea rax, [rsp + 0x38]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x38]
mov ecx, 0x58
call fcn.14001a0a0
mov rbx, rax
xor ebp, ebp
mov qword [rax + 0x20], rbp
lea rax, [fcn.140047db0]
mov qword [rbx + 0x28], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], ebp
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx + 0x38], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbx + 0x48], xmm1
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14001c990
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], rbp
test al, al
je 0x140047d37
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x58], rax
mov rax, qword [rdi]
mov qword [rsp + 0x60], rax
call fcn.1400a9490
xor r9d, r9d
lea r8, [rsp + 0x88]
mov rdx, rbx
mov rcx, qword [rsi + 0x28]
call fcn.140047db0
nop
lea rcx, [rsp + 0x58]
call fcn.14001c760
nop
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rax + 8], 0
je 0x140047c43
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.140047e70
nop
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140049120
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov edx, 0x208
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140049302
movdqa xmm0, xmmword [0x140282f60]
movdqu xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov word [rsp + 0x70], r15w
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x1400491a0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.14004d5e0
nop
movdqa xmm0, xmmword [0x140282f60]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov r8d, 7
lea rdx, str.cmd.exe
lea rcx, [rsp + 0x30]
call fcn.14002c300
nop
mov r14, qword [rsp + 0x40]
test r14, r14
je 0x140049238
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdi, qword [rsp + 0x30]
lea rbx, [rsp + 0x30]
cmovae rbx, qword [rsp + 0x30]
call fcn.1401e2df0
mov r9, rax
lea rdx, [r14 + rdi]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.1401e1090
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140049278
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049273
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049273
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401e507c
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.14004d230
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.1401e2a70
mov rdx, rax
mov rcx, rsi
call fcn.14004d230
nop
lea rcx, [rbp - 0x70]
call fcn.14004d3f0
nop
lea rcx, [rsp + 0x50]
call fcn.14004d3f0
nop
lea rcx, [rsp + 0x70]
call fcn.14004d3f0
mov rax, rsi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1401e4940
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140048d70
int3
Function at 0x1400496a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rbx, rcx
lea r8, [0x1402d38b8]
lea rcx, [0x1402d38d0]
lea rdx, [0x14004e520]
call qword [sym.imp.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag____ptr64__int____cdecl___void____ptr64__void____ptr64__void____ptr64____ptr64___void____ptr64_]
test eax, eax
je 0x1400497d0
cmp byte [rbx + 0x28], 0
mov rsi, 0xffffffffffffffff
je 0x140049778
cmp byte [rbx + 0x29], 0
jne 0x140049778
mov rax, qword [rbx + 0x18]
mov ecx, dword [rax]
cmp ecx, 0x103
jne 0x140049778
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400497e0
test al, al
je 0x140049778
mov rax, qword [rbx]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140049774
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400497e0
test al, al
je 0x140049774
mov rcx, qword [rbx]
lea edx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r8, [0x1402d38b8]
lea rdx, [0x14004e520]
lea rcx, [0x1402d38d0]
test eax, eax
jne 0x14004975e
call qword [sym.imp.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag____ptr64__int____cdecl___void____ptr64__void____ptr64__void____ptr64____ptr64___void____ptr64_]
test eax, eax
je 0x1400497d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140049774
call qword [sym.imp.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag____ptr64__int____cdecl___void____ptr64__void____ptr64__void____ptr64____ptr64___void____ptr64_]
test eax, eax
je 0x1400497d0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov byte [rbx + 0x29], 1
mov qword [rsp + 0x40], rdi
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x1400497ad
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400497ad
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x1400497ad
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
Function at 0x14004bc80
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x608]
sub rsp, 0x700
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov rdi, rcx
lea rcx, [rbp + 0x288]
call fcn.14004beb0
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rdx, rax
lea rcx, [rbp + 0x178]
call fcn.14004beb0
lea rax, [rbp + 0x178]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x68]
call fcn.14004beb0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x4d0], rdi
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x4d8]
call fcn.14004beb0
nop
lea rcx, [rbp + 0x148]
call fcn.14002bed0
lea rcx, [rbp + 0x98]
call fcn.14002bed0
nop
lea rcx, [rbp + 0x258]
call fcn.14002bed0
lea rcx, [rbp + 0x1a8]
call fcn.14002bed0
nop
lea rax, [0x14004c0c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x4d0]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x4d8]
lea rcx, [rsp + 0x58]
call fcn.14004beb0
nop
lea rcx, [rbp + 0x5b8]
call fcn.14002bed0
lea rcx, [rbp + 0x508]
call fcn.14002bed0
nop
lea rcx, [rbx + 0xe0]
call fcn.14002bed0
lea rcx, [rbx + 0x30]
call fcn.14002bed0
movups xmm0, xmmword [rdi + 0x2f8]
movaps xmmword [rbp + 0x3a0], xmm0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x3b0]
call fcn.14004e000
lea rcx, [rbp + 0x38]
call fcn.14002bed0
lea rcx, [rbp - 0x78]
call fcn.14002bed0
nop
mov rbx, qword [rbp + 0x3a8]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14004bdfe
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x14004bdfe
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14004bdf0
lea rdx, [rbp + 0x3b0]
mov ecx, 0x168
call fcn.14001a0a0
mov r9, rax
xor ecx, ecx
mov qword [rax + 0x20], rcx
lea rax, [0x14004e1e0]
mov qword [r9 + 0x28], rax
mov qword [r9], rcx
mov qword [r9 + 8], rcx
mov qword [r9 + 0x10], rcx
mov qword [r9 + 0x18], rcx
mov dword [r9 + 0x30], ecx
movaps xmm0, xmmword [rbp + 0x3a0]
movups xmmword [r9 + 0x38], xmm0
lea rcx, [r9 + 0x48]
lea rdx, [rbp + 0x3b0]
call fcn.14004e000
mov rcx, qword [0x1402d3198]
lock inc dword [rcx + 0x30]
mov rdx, r9
call fcn.14001ad40
nop
lea rcx, [rbp + 0x4a0]
call fcn.14002bed0
lea rcx, [rbp + 0x3f0]
call fcn.14002bed0
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.1401e4940
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14004ec90
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rbp, rdx
mov r14, rcx
mov rax, qword [rcx + 0xd8]
mov r8, qword [rax]
mov ecx, dword [rcx + 0x80]
test ecx, ecx
jne 0x14004ee6d
cmp byte [r8 + 0x40], cl
je 0x14004ee3c
cmp qword [r8 + 0x30], 0
jne 0x14004ee3c
cmp qword [r8 + 0x18], 0x10
jb 0x14004ecfe
mov r8, qword [r8]
mov qword [r14 + 0xc0], r8
mov rax, qword [r14 + 0x78]
mov r10, qword [r14 + 0xb8]
mov r11, qword [r14 + 0xd0]
mov ebx, dword [r14]
mov edi, dword [r14 + 0xb0]
lea rsi, [r14 + 0xe0]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
mov r9, qword [r14 + 0xa8]
mov r8, qword [r14 + 0xa0]
mov rdx, qword [r14 + 0xc0]
mov rcx, qword [r14 + 0xc8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r12d, eax
movups xmm6, xmmword [rsi]
movdqu xmmword [rsp + 0x68], xmm6
movsd xmm7, qword [rsi + 0x10]
movsd qword [rsp + 0x78], xmm7
mov rbx, qword [r14 + 0x98]
test rbx, rbx
je 0x14004eda0
lock inc dword [rbx + 8]
mov rbx, qword [r14 + 0x98]
movsd xmm7, qword [rsp + 0x78]
movdqu xmm6, xmmword [rsp + 0x68]
mov rdi, qword [r14 + 0x90]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rbx
mov word [rsp + 0x90], 1
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x14004eeb5
lea rcx, [r14 + 0x80]
call fcn.140048220
cmp dword [r14 + 0x80], 0
je 0x14004ee77
mov rcx, rbp
call fcn.140049620
nop
lea rcx, [rsp + 0x68]
call fcn.1400496a0
mov rax, rbp
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rax, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14004ee49
mov rax, qword [r8]
mov qword [r14 + 0xc8], rax
add r8, 0x20
cmp qword [r8 + 0x18], 0x10
jb 0x14004ee5e
mov r8, qword [r8]
mov qword [r14 + 0xc0], r8
test ecx, ecx
je 0x14004ed05
mov rcx, rbp
call fcn.140049620
jmp 0x14004ee0d
movups xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
movdqa xmm1, xmmword [0x140282fb0]
movdqu xmmword [rsp + 0x68], xmm1
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
mov word [rbp + 0x28], 1
mov byte [rsp + 0x90], 0
jmp 0x14004ee03
lea rcx, [rsp + 0x58]
call fcn.140048cc0
mov rdx, rax
call fcn.14004eed0
int3
Function at 0x14004f590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rbp + 0x1d8], rax
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x10]
mov qword [rbp - 0x80], rax
mov rax, qword [rdx + 0x18]
mov qword [rbp - 0x78], rax
add rdx, 0x20
lea rcx, [rbp - 0x70]
call fcn.14004beb0
movups xmm0, xmmword [rbx]
movaps xmmword [rbp + 0xa0], xmm0
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14004e000
nop
lea rsi, [rdi + 8]
mov rdi, qword [rdi]
mov rbx, qword [rsi]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14004f632
cmp qword [rax], rbx
je 0x14004f789
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14004f620
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x80]
mov ecx, 0x288
call fcn.14001a0a0
mov rbx, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [fcn.140050be0]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
lea rcx, [rbx + 0x38]
lea rdx, [rbp - 0x80]
call fcn.14004e000
movaps xmm2, xmmword [rbp + 0xa0]
movups xmmword [rcx + 0x120], xmm2
add rcx, 0x130
lea rdx, [rbp + 0xb0]
call fcn.14004e000
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14001c990
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
test al, al
je 0x14004f738
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
call fcn.1400a9490
xor r9d, r9d
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [rdi + 0x28]
call fcn.140050be0
nop
lea rcx, [rsp + 0x20]
call fcn.14001c760
nop
mov rdx, qword [rsp + 0x40]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rcx, [rbp + 0x1a0]
call fcn.14002bed0
lea rcx, [rbp + 0xf0]
call fcn.14002bed0
lea rcx, [rbp + 0x70]
call fcn.14002bed0
lea rcx, [rbp - 0x40]
call fcn.14002bed0
mov rcx, qword [rbp + 0x1d8]
xor rcx, rsp
call fcn.1401e4940
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp qword [rax + 8], 0
je 0x14004f632
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.140051660
nop
jmp 0x14004f738
Function at 0x140051660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rdi, [rcx + 0x130]
lea rsi, [rcx + 0x128]
mov rbp, qword [rcx + 0x120]
mov rbx, qword [rsi]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400516c2
nop
cmp qword [rax], rbx
je 0x1400517af
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400516b0
mov qword [rsp + 0x60], rdi
mov rdx, rdi
mov ecx, 0x158
call fcn.14001a0a0
mov rbx, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [fcn.140051b70]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14004e000
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.14001c990
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], r14
test al, al
je 0x1400517a1
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
call fcn.1400a9490
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.140051b70
nop
lea rcx, [rsp + 0x28]
call fcn.14001c760
nop
mov rdx, qword [rsp + 0x58]
mov ecx, dword [0x1402d3934]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rax + 8], 0
je 0x1400516c2
mov rdx, rdi
mov rcx, rdi
call fcn.140047e70
nop
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret