joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1423970
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x142397d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x142398d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1423975
lea eax, [rcx + 1]
jmp 0x142399b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14239ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1423994
sub eax, 3
jb 0x14239ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1423a1d
sar eax, 1
movsxd rbp, eax
jb 0x1423a04
jmp 0x14239dc
add ebx, ebx
jne 0x14239da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423a04
inc ecx
add ebx, ebx
jne 0x14239ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423a04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14239fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14239ec
add ecx, 2
jmp 0x1423a09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01423932
jmp 0x142397d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x100f000]
mov eax, dword [rdi]
or eax, eax
je 0x1423a79
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1023000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1423a29
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1423a73
mov qword [rbx], rax
add rbx, 8
jmp 0x1423a49
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1423abd
cmp al, 0xef
ja 0x1423aa5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1423a85
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1423a94
mov eax, dword [rdi]
add rdi, 4
jmp 0x1423a94
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1423b11
sub rsp, 0xffffffffffffff80
jmp 0x45bb20
Function at 0x140005418
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400054dc
lea rcx, [0x14015f840]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14015f830]
jmp 0x1400054a2
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000549f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x14015f830]
mov rdx, rsi
call fcn.14000c338
jmp 0x1400054a2
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000546f
mov rdi, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x14015f830]
lea rdx, [rdi + 1]
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.14000c2f4
lea rcx, [0x14015f840]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140005ff0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x14015f8d0]
call fcn.14000c450
test rax, rax
je 0x14000601e
mov r8, qword [rax]
mov edx, ebx
mov rcx, qword [rax + 8]
add rsp, 0x20
pop rbx
jmp qword [r8 + 0x48]
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.14001b880

Function at 0x140006150
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x14015fce4], 0
mov rbx, rcx
jne 0x140006167
call fcn.1400064d0
mov ecx, dword [0x14015fce0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r11, rax
test rax, rax
jne 0x14000618f
call fcn.1400064d0
mov ecx, dword [0x14015fce0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r11, rax
movsxd r9, dword [r11 + 4]
mov eax, reloc.WS2_32.dll_recv
movsxd r10, dword [r11]
mov r8d, dword [r11 + r10*4 + 0x4c]
mov edx, dword [r11 + r10*4 + 8]
ror r8d, 0xd
add r8d, dword [r11 + r9*4 + 0x4c]
ror edx, 5
add edx, dword [r11 + r9*4 + 8]
mov dword [r11 + r10*4 + 8], r8d
mov dword [r11 + r10*4 + 0x4c], edx
sub r10d, 1
cmovs r10d, eax
sub r9d, 1
mov dword [r11], r10d
cmovs r9d, eax
mov dword [r11 + 4], r9d
mov r9d, r8d
mov r8d, edx
add rbx, 1
je 0x14000620f
mov rdx, rbx
mov eax, ebx
shr rdx, 0x20
imul rax, r9
mov rcx, rdx
imul rcx, r8
imul rdx, r9
shr rcx, 0x20
shr rax, 0x20
add rax, rcx
add rax, rdx
add rsp, 0x20
pop rbx
ret
shl r9, 0x20
and r9, r8
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400067e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rcx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 8]
xor ebx, ebx
mov esi, ebx
call fcn.14001cc70
mov rcx, qword [rdi + 0x60]
mov r12, rax
call fcn.14001cc70
mov r13, rax
call fcn.14001cec0
mov rbp, rax
lea eax, [rbx + 1]
test rbp, rbp
je 0x140006983
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, eax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140006976
test byte [rdi + 0x40], 2
mov qword [rdi + 0x18], rax
jne 0x140006882
lea edx, [rbx + 0x34]
mov rcx, rbp
lea r8d, [rbx + 1]
call fcn.14001d160
mov r8, qword [0x14015fcf0]
test r8, r8
je 0x14000689b
mov edx, 0x2714
mov rcx, rbp
call fcn.14001d160
mov r8, qword [0x14015fcf8]
test r8, r8
je 0x1400068d1
cmp qword [0x14015fd00], rbx
je 0x1400068d1
mov edx, 0x27bf
mov rcx, rbp
call fcn.14001d160
mov r8, qword [0x14015fd00]
mov edx, 0x27c0
mov rcx, rbp
call fcn.14001d160
mov r8, r12
mov edx, 0x2712
mov rcx, rbp
call fcn.14001d160
mov r8, r13
mov edx, 0x2722
mov rcx, rbp
call fcn.14001d160
lea r8, [0x14000679c]
mov edx, 0x4e2b
mov rcx, rbp
call fcn.14001d160
mov r8, rdi
mov edx, 0x2711
mov rcx, rbp
call fcn.14001d160
mov r8d, dword [rdi + 0x44]
mov edx, 0x9c
mov rcx, rbp
call fcn.14001d160
mov r8d, dword [rdi + 0x48]
mov edx, 0x9b
mov rcx, rbp
call fcn.14001d160
mov edx, 0x63
mov rcx, rbp
lea r8d, [rdx - 0x62]
call fcn.14001d160
mov rcx, rbp
call fcn.14001cf80
test eax, eax
jne 0x140006960
cmp dword [rdi + 4], 0xfffffffb
mov eax, 1
cmovne esi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140006976
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call fcn.14001d110
mov eax, 1
cmp esi, eax
jne 0x140006990
mov dword [rdi + 4], 0xfffffffe
jmp 0x14000699d
cmp dword [rdi + 4], 0xfffffffb
setne bl
add ebx, 0xfffffffc
mov dword [rdi + 4], ebx
mov rcx, r12
call fcn.14001c440
mov rcx, r13
call fcn.14001c440
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140006ae4
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov r12, r9
mov rcx, qword [0x14015fd08]
mov r14d, r8d
mov rsi, rdx
xor ebx, ebx
call fcn.14000b694
mov r15, rax
test rbp, rbp
je 0x140006aca
test rsi, rsi
je 0x140006aca
mov rcx, qword [0x14015f7b8]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
mov rdi, rax
or dword [rax + 4], 0xffffffff
mov dword [rax], ebx
call fcn.14001cbe8
mov rcx, rsi
mov qword [rdi + 8], rax
call fcn.14001cbe8
mov rcx, r12
mov qword [rdi + 0x10], rax
call fcn.14001cbe8
mov qword [rdi + 0x60], rax
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x48], eax
mov dword [rdi + 0x40], r14d
test r14b, 1
je 0x140006ab7
lea rax, [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400069d0]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140006ac2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
jmp 0x140006aca
mov rcx, rdi
call fcn.1400067e0
movsxd rbx, eax
mov rcx, rdi
call fcn.14001f540
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea r9, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
jmp 0x1400069e0

Function at 0x140006bd4
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1c0
mov ebx, reloc.WS2_32.dll_recv
lea r8, [0x140006af0]
mov edx, ebx
lea ecx, [rbx + 0x28]
call fcn.14000c5a0
xor r8d, r8d
mov qword [0x14015fd38], rax
xor edx, edx
mov ecx, ebx
call fcn.14000b72c
xor ebx, ebx
mov qword [0x14015fd48], rax
cmp word [0x14015fd30], bx
jne 0x140006cf7
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edi, [rbx + 1]
test eax, eax
jne 0x140006c3c
movzx eax, di
jmp 0x140006c3e
mov eax, ebx
lea rcx, str.ws2_32.dll
mov word [0x14015fd30], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14015fd40], rax
test rax, rax
je 0x140006cf7
lea rdx, [0x14013b6b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14015fd40]
lea rdx, [0x14013b6c0]
mov qword [0x14015fd10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14015fd40]
lea rdx, str.getnameinfo
mov qword [0x14015fd18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14015fd40]
lea rdx, str.WSAStringToAddressA
mov qword [0x14015fd20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14015fd10], rbx
mov qword [0x14015fd28], rax
je 0x140006cf7
cmp qword [0x14015fd18], rbx
je 0x140006cf7
cmp qword [0x14015fd20], rbx
je 0x140006cf7
mov ecx, dword [0x14015fd34]
test rax, rax
cmovne ecx, edi
mov dword [0x14015fd34], ecx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rdi
ret
Function at 0x140006eb0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1401601f8]
call fcn.14000c450
test rax, rax
je 0x140006edc
mov rcx, qword [rax + 8]
mov edx, ebx
add rsp, 0x20
pop rbx
jmp fcn.14001cd50
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.14001b880

Function at 0x140007fec
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
xor eax, eax
test rcx, rcx
je 0x140007fff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
add rsp, 0x28
ret

Function at 0x140008020
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov edi, 0x104
mov ecx, edi
call fcn.140024fc0
mov rdx, rax
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebp, ebp
movsxd rbx, eax
test eax, eax
je 0x14000806f
lea edx, [rbx - 1]
movsxd r8, edx
lea eax, [rbp + 0x5c]
cmp word [rsi + r8*2], ax
je 0x14000806f
mov word [rsi + rbx*2], ax
inc ebx
sub edi, ebx
mov ecx, edi
call fcn.140025070
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov word [rsi + rax*2], bp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140008094
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp qword [0x14015fde0], 0
jne 0x1400080fa
lea rcx, [0x14015fde0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400080e6
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [0x14015fde8]
imul qword [0x14015fde0]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x14015fde0], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [0x14015fde0], 0
jne 0x1400080fa
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
jmp 0x140008120
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x14015fde8]
cqo
idiv qword [0x14015fde0]
add rsp, 0x28
ret

Function at 0x14000a090
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14016008c], eax
add rsp, 0x28
ret
Function at 0x14000a8d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x14000a9a2
mov qword [rsp + 0x40], rbp
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
nop
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x14000a900
mov eax, 1
xor r15d, r15d
sub eax, esi
mov ebp, r15d
add ecx, eax
cmovns ebp, ecx
mov rcx, rbx
call fcn.140032b30
mov edx, edi
mov ecx, ebp
mov r14d, eax
call fcn.140024fc0
mov rdi, rax
test r14d, r14d
je 0x14000a943
mov ecx, r14d
call fcn.140032b70
mov rbx, rax
mov r14, qword [rsp + 0x48]
mov ecx, ebp
test rbx, rbx
je 0x14000a987
cmp esi, 1
jle 0x14000a965
cmp word [rbx], r15w
je 0x14000a965
add rbx, 2
dec esi
cmp esi, 1
jg 0x14000a954
movzx eax, word [rbx]
test ax, ax
je 0x14000a987
sub rbx, rdi
test ecx, ecx
je 0x14000a987
mov word [rdi], ax
dec ecx
movzx eax, word [rbx + rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000a970
call fcn.140025070
mov rbp, qword [rsp + 0x40]
mov word [rdi], r15w
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov ecx, edi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.14001b880

Function at 0x14000aea0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.140024fc0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140032ea8
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14000aed3
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140025070
Function at 0x14000af30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor ebp, ebp
mov r13d, r9d
mov r15d, edx
mov r12d, ebp
cmp edx, 1
jl 0x14000b09b
test rcx, rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov edi, ebp
mov qword [rsp + 0x20], r14
lea r14, [0x140138958]
mov rsi, r14
cmovne rsi, rcx
test r8, r8
cmovne r14, r8
movzx ecx, word [r14]
test cx, cx
je 0x14000b02a
cmp word [r14 + 2], di
je 0x14000b02a
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r14 + rax*2], di
jne 0x14000afa0
mov rbx, rsi
movsxd rbp, eax
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call fcn.140032bd8
test eax, eax
je 0x14000afce
cmp word [rbx], r12w
je 0x14000afce
add rbx, 2
jmp 0x14000afb0
inc edi
cmp edi, r15d
je 0x14000afe4
cmp word [rbx], r12w
je 0x14000afed
lea rbx, [rbx + rbp*2]
mov rsi, rbx
jmp 0x14000afb0
mov r12, rbx
sub r12, rsi
sar r12, 1
xor ebp, ebp
mov rcx, rbx
call fcn.140032b30
mov r14, qword [rsp + 0x20]
movsxd rbx, r12d
test eax, eax
je 0x14000b060
mov ecx, r13d
call fcn.140032ee0
lea r8, [rbx + rbx]
mov rdx, rsi
mov rcx, rax
call fcn.14001b8e0
mov edx, r13d
mov ecx, r12d
call fcn.140024fc0
mov rdi, rax
jmp 0x14000b07c
mov rbx, rsi
nop dword [rax]
movzx eax, word [rbx]
cmp ax, cx
je 0x14000b043
test ax, ax
je 0x14000b043
add rbx, 2
jmp 0x14000b030
inc edi
cmp edi, r15d
je 0x14000b055
test ax, ax
je 0x14000afef
lea rsi, [rbx + 2]
jmp 0x14000b02a
mov r12, rbx
sub r12, rsi
sar r12, 1
jmp 0x14000afef
mov edx, r13d
mov ecx, r12d
call fcn.140024fc0
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.140032c04
mov rsi, qword [rsp + 0x58]
mov word [rdi + rbx*2], bp
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
mov ecx, r13d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.14001b880

Function at 0x14000b694
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401600b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14000b715
mov r8, qword [0x1401600b0]
lea edx, [rax + 8]
mov rcx, qword [0x14015f7b8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1401600b8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1401600a8]
jmp 0x14000b701
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14000b6fe
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000b6ec
mov rdx, rdi
lea rcx, [0x14000b830]
call fcn.1400333d8
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b72c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbp, r8
mov rsi, rdx
and ecx, 7
je 0x14000b756
mov eax, 8
sub eax, ecx
add edi, eax
mov rbx, qword [0x1401600b0]
test rbx, rbx
jne 0x14000b79c
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x14015f7b8]
lea edx, [rbx + 8]
movsxd rdi, edi
mov r8, rdi
mov dword [0x1401600b8], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1401600b8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1401600b0]
jmp 0x14000b79f
movsxd rdi, edi
mov ecx, dword [0x1401600b8]
lea rax, [rdi + rbx]
mov qword [0x1401600b0], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x1401600b0]
mov edx, 8
mov rcx, qword [0x14015f7b8]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1401600b8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rsi, rsi
jne 0x14000b7ee
test rbp, rbp
je 0x14000b815
mov edx, 0x28
lea rcx, [0x1401600a8]
call fcn.14000c2f4
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
test rsi, rsi
je 0x14000b815
lea rcx, [rdi + rbx]
call rsi
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000bad0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
movsxd rbx, edx
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x1401600d0]
xor edx, edx
mov rsi, rax
mov rax, qword [r14]
mov r8d, dword [rsi + 0x10]
sub r8d, ebx
movsxd rdi, r8d
lea r9, [rdi + 0xa]
test rax, rax
jne 0x14000bb24
mov r8, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x14000bb2d
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [r14], rax
mov rcx, rax
mov rdx, qword [rsi]
shr rdi, 1
add rdx, rbx
mov r8d, edi
call fcn.140032ba0
mov rdi, qword [rsp + 0x40]
mov qword [rsi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x14000bba0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14015cc80]
cmp ecx, 0xffffffff
jne 0x14000bbb6
call fcn.14000be00
jmp 0x14000bbc6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14000bbe5
call fcn.140033790
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x14000bb60]
add rsp, 0x28
jmp fcn.1400333d8
add rsp, 0x28
ret
Function at 0x14000bda0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14015cc80]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000bde0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add qword [rax + 0x10], 2
add rsp, 0x28
ret

Function at 0x14000be00
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1401600d0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14015cc80], eax
add rsp, 0x28
jmp fcn.140033790

Function at 0x14000be30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rax + 0x338]
mov rcx, qword [rax + 0x10]
mov qword [rax + rdx*8 + 0x18], rcx
inc qword [rax + 0x338]
add rsp, 0x28
ret

Function at 0x14000be60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14015cc80]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rbx, qword [rax + rcx*8 + 0x18]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000beb0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rax, qword [rax + rcx*8 + 0x18]
mov qword [rdx + 0x10], rax
add rsp, 0x28
ret

Function at 0x14000bee0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rdx, qword [rax + rcx*8 + 0x18]
mov qword [rax + 0x10], rdx
mov rax, qword [rax]
add rax, rdx
add rsp, 0x28
ret

Function at 0x14000bf20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rax, qword [rax + rcx*8 + 0x18]
add rax, qword [rdx]
add rsp, 0x28
ret

Function at 0x14000bf50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14015cc80]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov qword [rax + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]