joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449fb0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x44a035
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x44a076
cmp dword [rsp + 0x2c], 0
je 0x44a05a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x44a090
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x0049f0f8]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x0049f0f8], rsi
jne 0x44a010
mov byte [0x0049f0f0], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x44a06c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x44a0dc
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x44a05f
mov edi, dword [rsp + 0x28]
jmp 0x44a06c
mov edi, dword [rsi + 0x18]
jmp 0x44a06a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.0044a530
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.Index_out_of_bounds
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.00426140
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.Index_out_of_bounds
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.0044a580
ud2

Function at 0x44a400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x004833a0]
test ecx, ecx
je 0x44a4e0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x44a434
mov rdi, rax
cmp qword [rax + 8], 0
je 0x44a434
add rdi, 0x10
jmp 0x44a4d6
mov ecx, dword [0x004833a0]
test ecx, ecx
je 0x44a4f3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x44a4d4
mov rsi, rax
test rax, rax
jne 0x44a4a3
movzx eax, byte [0x0049f150]
mov ecx, 0x18
mov edx, 8
call fcn.00420e50
test rax, rax
je 0x44a516
mov rsi, rax
lea rax, [0x00483388]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x004833a0]
test ecx, ecx
je 0x44a506
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x44a4d6
test rcx, rcx
je 0x44a4d6
lock dec qword [rcx]
jne 0x44a4d6
call fcn.00449f50
jmp 0x44a4d6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x00483388]
call fcn.00449fb0
mov ecx, eax
jmp 0x44a416
lea rcx, [0x00483388]
call fcn.00449fb0
mov ecx, eax
jmp 0x44a444
lea rcx, [0x00483388]
call fcn.00449fb0
mov ecx, eax
jmp 0x44a49b
mov ecx, 8
mov edx, 0x18
call fcn.004227e0
ud2
Function at 0x44ab10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x004833c0]
test ecx, ecx
je 0x44abaf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x44ab39
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x44ab9e
mov ecx, dword [0x004833c0]
test ecx, ecx
je 0x44abc2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x44aba4
mov rsi, rax
test rax, rax
jne 0x44ab98
movzx eax, byte [0x0049f150]
mov ecx, 0x10
mov edx, 8
call fcn.00420e50
test rax, rax
je 0x44abe5
mov rsi, rax
lea rax, [0x004833a8]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x004833c0]
test ecx, ecx
je 0x44abd5
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x44aba6
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x004833a8]
call fcn.00449fb0
mov ecx, eax
jmp 0x44ab25
lea rcx, [0x004833a8]
call fcn.00449fb0
mov ecx, eax
jmp 0x44ab45
lea rcx, [0x004833a8]
call fcn.00449fb0
mov ecx, eax
jmp 0x44ab90
mov ecx, 8
mov edx, 0x10
call fcn.004227e0
ud2

Function at 0x44b150
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x00490a10]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x44b1c1
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x44b1f7
test eax, eax
js 0x44b1d2
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x44b1ea
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x00490a78]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.0044a220
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.004496c0
mov ecx, 7
int 0x29
ud2
Function at 0x44b750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x00483380]
test ecx, ecx
je 0x44b80d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x44b780
cmp qword [rax + 8], 0
je 0x44b780
add rax, 0x10
jmp 0x44b807
mov ecx, dword [0x00483380]
test ecx, ecx
je 0x44b820
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x44b805
mov rsi, rax
test rax, rax
jne 0x44b7eb
movzx eax, byte [0x0049f150]
mov ecx, 0x20
mov edx, 8
call fcn.00420e50
test rax, rax
je 0x44b843
mov rsi, rax
lea rax, [0x00483368]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00483380]
test ecx, ecx
je 0x44b833
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x44b807
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00483368]
call fcn.00449fb0
mov ecx, eax
jmp 0x44b765
lea rcx, [0x00483368]
call fcn.00449fb0
mov ecx, eax
jmp 0x44b790
lea rcx, [0x00483368]
call fcn.00449fb0
mov ecx, eax
jmp 0x44b7e3
mov ecx, 8
mov edx, 0x20
call fcn.004227e0
ud2
Function at 0x44f030
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x54], 0
mov word [rsp + 0x5c], 0
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x38]
mov rcx, rdx
mov rdx, rax
call fcn.00467c80
mov rdi, rdx
test rax, rax
je 0x44f0c4
mov qword [rsp + 0x80], 1
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.00449600
mov qword [rsi], 0
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.00467ea0
cmp dword [rsp + 0x38], 2
jne 0x44f0f3
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
jmp 0x44f13f
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
cmp qword [rsp + 0x80], 2
jne 0x44f16b
lea rcx, [rsp + 0x88]
call fcn.00449600
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0xb8]
test rdi, rdi
je 0x44f1c9
mov qword [rsp + 0x80], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x44f245
mov rbx, qword [rsp + 0x80]
jmp 0x44f1cb
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x44f234
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x44f234
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x44f271
mov qword [rsi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x44f271
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.00449600
mov qword [rsi], 0
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
jmp 0x44f0b3
Function at 0x4685f0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, rcx
lea rcx, [rsp + 0xa8]
call fcn.0044bd60
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x46875b
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x4686b0
jmp 0x46868f
jae 0x468771
cmp r8, 0x201
jae 0x4686b0
mov edi, 0x200
lea rbp, [rsp + 0xa8]
mov r12, r8
jmp 0x4686f7
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x4686d7
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.0044c170
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x50]
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov r8d, r12d
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x468722
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4687a6
mov r8d, r15d
cmp r12, r8
jne 0x468680
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x46883a
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x46868f
jmp 0x4686b0
lea rcx, [rsp + 0xb0]
call fcn.00449600
mov byte [rsi + 0x18], 2
jmp 0x46880a
cmp rdi, r8
jb 0x468854
lea rcx, [rsp + 0x88]
mov rdx, rbp
call fcn.0044dcd0
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
jmp 0x4687bd
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x78], 2
mov rsi, qword [rsp + 0x38]
test rbx, rbx
je 0x4687da
mov rcx, qword [0x0049f0e8]
xor edx, edx
mov r8, qword [rsp + 0x28]
call fcn.00480424
cmp byte [rsp + 0x78], 2
jne 0x46881f
mov byte [rsi + 0x18], 2
lea rcx, [rsp + 0x60]
call fcn.00449600
cmp qword [rsp + 0x40], 0
je 0x46880a
mov rcx, qword [0x0049f0e8]
xor edx, edx
mov r8, qword [rsp + 0x30]
call fcn.00480424
nop
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rsp + 0x40], 0
jne 0x4687f7
jmp 0x46880a
lea rcx, str.internal_error:_entered_unreachable_codecalled__Option::unwrap____on_a__None__value
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.00426e80
jmp 0x468869
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rdi
mov r8, rax
call fcn.00426ae0
ud2
Function at 0x46bae0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x004833e0]
test ecx, ecx
je 0x46bbc0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x46bb14
mov rdi, rax
cmp qword [rax + 8], 0
je 0x46bb14
add rdi, 0x10
jmp 0x46bbb6
mov ecx, dword [0x004833e0]
test ecx, ecx
je 0x46bbd3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x46bbb4
mov rsi, rax
test rax, rax
jne 0x46bb83
movzx eax, byte [0x0049f150]
mov ecx, 0x18
mov edx, 8
call fcn.00420e50
test rax, rax
je 0x46bbf6
mov rsi, rax
lea rax, [0x004833c8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x004833e0]
test ecx, ecx
je 0x46bbe6
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x46bbb6
test rcx, rcx
je 0x46bbb6
lock dec qword [rcx]
jne 0x46bbb6
call fcn.0046bc10
jmp 0x46bbb6
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x004833c8]
call fcn.00449fb0
mov ecx, eax
jmp 0x46baf6
lea rcx, [0x004833c8]
call fcn.00449fb0
mov ecx, eax
jmp 0x46bb24
lea rcx, [0x004833c8]
call fcn.00449fb0
mov ecx, eax
jmp 0x46bb7b
mov ecx, 8
mov edx, 0x18
call fcn.004227e0
ud2

Function at 0x46caf0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x46cb26
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x004690c0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.00426140
ud2
Function at 0x471510
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x00483400]
test ecx, ecx
je 0x471609
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x471540
cmp qword [rax + 8], 0
je 0x471540
add rax, 0x10
jmp 0x471603
mov ecx, dword [0x00483400]
test ecx, ecx
je 0x47161c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4715e3
mov rsi, rax
test rax, rax
jne 0x4715b3
movzx eax, byte [0x0049f150]
mov ecx, 0x20
mov edx, 8
call fcn.00420e50
test rax, rax
je 0x471642
mov rsi, rax
lea rax, [0x004833e8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00483400]
test ecx, ecx
je 0x47162f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x4715e7
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x4715ef
xor eax, eax
jmp 0x471603
call fcn.0046caf0
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x004833e8]
call fcn.00449fb0
mov ecx, eax
jmp 0x471525
lea rcx, [0x004833e8]
call fcn.00449fb0
mov ecx, eax
jmp 0x471550
lea rcx, [0x004833e8]
call fcn.00449fb0
mov ecx, eax
jmp 0x4715ab
mov ecx, 8
mov edx, 0x20
call fcn.004227e0
ud2

Function at 0x47346d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rsi, rcx
mov ecx, dword [0x00483428]
test ecx, ecx
je 0x4735ab
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x4734a8
mov rbx, rax
cmp qword [rax + 8], 0
je 0x4734a8
add rbx, 0x10
jmp 0x47359d
mov ecx, dword [0x00483428]
test ecx, ecx
je 0x4735be
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x47353b
mov rbx, rax
test rax, rax
jne 0x473516
mov al, byte [0x0049f150]
mov ecx, 0x60
mov edx, 8
call fcn.00420e50
test rax, rax
je 0x4735e4
mov rbx, rax
lea rax, [0x00483410]
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov ecx, dword [0x00483428]
test ecx, ecx
je 0x4735d1
dec ecx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
lea rax, [rbx + 8]
test rsi, rsi
je 0x47353f
lea rcx, [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
lea rsi, [0x00492c38]
cmovne rsi, rcx
jmp 0x473546
xor ebx, ebx
jmp 0x47359d
lea rsi, [0x00492c38]
lea rdx, [rsp + 0x80]
mov ecx, 0xa
mov rdi, rdx
rep movsq qword [rdi], qword [rsi]
lea r8, [rsp + 0x28]
mov ecx, 0xb
mov rdi, r8
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 8], 1
add rbx, 0x10
mov ecx, 0xa
mov rdi, rbx
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
cmp qword [r8], 0
je 0x47359d
cmp dword [rsp + 0x38], 2
je 0x47359d
lea rcx, [rsp + 0x38]
call fcn.004716d2
mov rax, rbx
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x00483410]
call fcn.00449fb0
mov ecx, eax
jmp 0x47348a
lea rcx, [0x00483410]
call fcn.00449fb0
mov ecx, eax
jmp 0x4734b8
lea rcx, [0x00483410]
call fcn.00449fb0
mov ecx, eax
jmp 0x47350e
mov ecx, 8
mov edx, 0x60
call fcn.004227e0
ud2
Function at 0x47375c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x473792
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x47379a
mov esi, dword [rdx]
mov r9d, 4
jmp 0x47379f
xor r10d, r10d
jmp 0x47384d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x4737c2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x4737d9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x4737f9
add r11, r8
jmp 0x47391d
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x4738c1
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x47386f
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x4738d3
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x4738d9
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x4738ff
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x473919
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x473af0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x00483448]
test ecx, ecx
je 0x473bbd
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x473b24
mov rdi, rax
cmp qword [rax + 8], 0
je 0x473b24
add rdi, 8
jmp 0x473bb3
mov ecx, dword [0x00483448]
test ecx, ecx
je 0x473bd0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x473bb1
mov rsi, rax
test rax, rax
jne 0x473b8e
mov al, byte [0x0049f150]
mov ecx, 0x10
mov edx, 8
call fcn.00420e50
test rax, rax
je 0x473bf3
mov rsi, rax
lea rax, [0x00483430]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00483448]
test ecx, ecx
je 0x473be3
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 8]
call fcn.00473aa5
mov rcx, qword [rsi + 8]
mov qword [rsi + 8], rax
test rcx, rcx
je 0x473bb3
lock dec qword [rcx]
jne 0x473bb3
call fcn.00471f5c
jmp 0x473bb3
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x00483430]
call fcn.00449fb0
mov ecx, eax
jmp 0x473b06
lea rcx, [0x00483430]
call fcn.00449fb0
mov ecx, eax
jmp 0x473b34
lea rcx, [0x00483430]
call fcn.00449fb0
mov ecx, eax
jmp 0x473b86
mov ecx, 8
mov edx, 0x10
call fcn.004227e0
ud2
Function at 0x478cb6
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x478cbd
test al, 1
je 0x478cdc
test al, 2
jne 0x478cf1
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x004941f8]
mov edx, 0x23
jmp 0x478d04
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x00494238]
mov edx, 0x25
call fcn.00426e80
ud2
Function at 0x481320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0049f764]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x481440
mov rax, qword [0x0049f768]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x48136c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x481426
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x481350
mov rcx, rsi
call fcn.00481f60
test rax, rax
mov r12, rax
je 0x481478
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0049f768]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.004820b0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x0049f768]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x48145b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x48141f
sub eax, 0x40
and eax, 0xffffffbf
je 0x48141f
add rbx, qword [0x0049f768]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x481447
add dword [0x0049f764], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.ntdll.dll_memcpy
xor ebx, ebx
jmp 0x481377
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004812b0
mov rax, qword [0x0049f768]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.004812b0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.004812b0
nop
nop dword [rax + rax]

Function at 0x481bd0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0049fa40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0049fa20]
test rbx, rbx
je 0x481c24
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x481c1b
test rsi, rsi
je 0x481c1b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x481c00
lea rcx, [0x0049fa40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]