joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d8e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x40
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
xor r14d, r14d
mov rbx, rcx
mov qword [rdx], r14
mov rsi, rdx
mov qword [rdx + 8], r14
mov rbp, r8
mov edx, r14d
mov rcx, qword [rax]
mov r9d, r14d
test rcx, rcx
je 0x14005d947
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r9, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsi], r9
mov qword [rsi + 8], rdx
mov qword [rax], r14
cmp rbp, rdx
jbe 0x14005da64
mov ebx, 6
test r9, r9
je 0x14005d9a9
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14005d971
mov rdx, qword [rax + 8]
jmp 0x14005d974
mov rdx, r14
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
cmp r9, 0x3fc
ja 0x14005d9a1
test rdx, rdx
je 0x14005d9a1
mov ecx, ebx
mov rax, rbx
nop
cmp qword [rdx + rax*8], r14
je 0x14005da0a
inc ecx
inc rax
cmp rax, 8
jl 0x14005d990
mov rcx, r8
call fcn.140019930
mov ecx, dword [0x140308cd0]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdi, [rbp + 3]
shr rdi, 2
test rax, rax
je 0x14005da36
mov r9, qword [rax + 8]
test r9, r9
je 0x14005da36
mov ecx, ebx
lea r8, [r9 + 0x30]
mov rdx, qword [r8]
test rdx, rdx
je 0x14005d9e6
movzx eax, byte [rdx]
cmp rax, rdi
jae 0x14005da1b
inc ecx
add r8, 8
cmp ecx, 8
jl 0x14005d9d6
mov rax, rbx
mov rcx, qword [r9 + rax*8]
test rcx, rcx
jne 0x14005da2a
inc ebx
inc rax
cmp rax, 8
jl 0x14005d9f4
jmp 0x14005da36
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x14005d9a9
movsxd rax, ecx
mov qword [r9 + rax*8], r14
movzx eax, byte [rdx]
mov byte [rdx + rbp], al
jmp 0x14005da58
movsxd rax, ebx
mov qword [r9 + rax*8], r14
call fcn.140019930
lea rcx, [rdi*4 + 1]
call fcn.140156530
cmp rdi, 0xff
movzx ecx, dil
mov rdx, rax
cmova ecx, r14d
mov byte [rax + rbp], cl
mov rdi, qword [rsp + 0x50]
mov qword [rsi], rdx
mov qword [rsi + 8], rbp
mov rax, rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14005dab0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140308a64], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x14005db29
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156510
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.140018450]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156510
add rsp, 0x40
pop rbx
ret
Function at 0x14005de70
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r15d, r15d
mov rdi, r9
mov r14, rdx
mov rsi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14005e031
mov qword [r11 + 0x18], rbx
test r8b, r8b
je 0x14005def8
movzx eax, byte [rdx]
test al, 8
je 0x14005def8
lea rcx, [0x1402a9358]
mov dword [r11 - 0x48], r15d
or al, 8
mov qword [r11 - 0x38], rcx
mov byte [rdx], al
lea r9, [r11 - 0x48]
mov edx, 0xffff
mov qword [r11 - 0x40], r15
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rsp + 0x38]
setne dl
call fcn.14005dde0
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.14005dde0
test ebx, ebx
je 0x14005e02d
mov rcx, qword gs:[0x58]
mov edx, dword [0x140308a4c]
mov qword [rsp + 0x50], rbp
mov ebp, 4
add rbp, qword [rcx]
cmp edx, dword [rbp]
jle 0x14005df6e
lea rcx, [0x140308a4c]
call fcn.1401568cc
mov edx, dword [0x140308a4c]
cmp edx, 0xffffffff
jne 0x14005df6e
lea rcx, [0x1401ae760]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
mov edx, dword [0x140308a4c]
mov rcx, qword [rdi + 8]
mov rax, qword [0x1402a9350]
cmp qword [rcx + 8], rax
jne 0x14005df87
cmp dword [rdi], 0x2733
je 0x14005dfd2
cmp edx, dword [rbp]
jle 0x14005dfb9
lea rcx, [0x140308a4c]
call fcn.1401568cc
cmp dword [0x140308a4c], 0xffffffff
jne 0x14005dfb9
lea rcx, [0x1401ae760]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
mov rdx, qword [rdi + 8]
mov rax, qword [0x1402a9350]
cmp qword [rdx + 8], rax
jne 0x14005e006
cmp dword [rdi], 0x4d5
jne 0x14005e006
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.14005dde0
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140156510
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
ret
mov eax, ebx
jmp 0x14005e00d
mov eax, r15d
jmp 0x14005e015
Function at 0x14005e040
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x44]
xor eax, eax
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 1
lea r8d, [rax + 1]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140308a4c], eax
jle 0x14005e0df
lea rcx, [0x140308a4c]
call fcn.1401568cc
cmp dword [0x140308a4c], 0xffffffff
jne 0x14005e0df
lea rcx, [0x1401ae760]
call fcn.140156e18
lea rcx, [0x140308a4c]
call fcn.140156860
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14005e0f1
mov edx, 0x2746
jmp 0x14005e0fd
cmp eax, 0x4d2
jne 0x14005e107
mov edx, 0x274d
lea rcx, [rsp + 0x58]
call fcn.140062430
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140156510
add rsp, 0x78
ret

Function at 0x14005e470
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x14005e4c0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.14005dcf0
jmp 0x14005e558
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x14005e4e0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.14005dcf0
jmp 0x14005e558
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x14005e54c
cmp eax, 0x3e5
je 0x14005e54c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.14005dcf0
jmp 0x14005e558
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.14005dc60
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140156510
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1400604d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400604f7
mov r8, qword [rax + 8]
jmp 0x1400604fa
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x140060522
test r8, r8
je 0x140060522
mov ecx, 2
mov eax, ecx
nop
cmp qword [r8 + rax*8], 0
je 0x140060534
inc ecx
inc rax
cmp rax, 4
jl 0x140060510
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140019930
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, ecx
mov qword [r8 + rax*8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140060550
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x1400605f4
mov r10, qword [rax + 8]
test r10, r10
je 0x1400605f4
mov r9d, 2
lea r8, [r10 + 0x10]
mov ecx, r9d
mov rdx, qword [r8]
test rdx, rdx
je 0x1400605a3
movzx eax, byte [rdx]
cmp rax, rbx
jae 0x1400605c8
inc ecx
add r8, 8
cmp ecx, 4
jl 0x140060593
mov rax, r9
mov rcx, qword [r10 + rax*8]
test rcx, rcx
jne 0x1400605e8
inc r9d
inc rax
cmp rax, 4
jl 0x1400605b1
jmp 0x1400605f4
movsxd rcx, ecx
mov rax, rdx
mov qword [r10 + rcx*8], rsi
movzx ecx, byte [rdx]
mov byte [rdx + rdi], cl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, r9d
mov qword [r10 + rax*8], rsi
call fcn.140019930
lea rcx, [rbx*4 + 1]
call fcn.140156530
cmp rbx, 0xff
movzx ecx, bl
mov rbx, qword [rsp + 0x30]
cmova ecx, esi
mov rsi, qword [rsp + 0x38]
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
ret
Function at 0x14006dd80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor esi, esi
mov rax, qword [rdx]
mov qword [rdx], rsi
mov qword [rbp - 0x69], rax
lea rdx, [rbp - 0x49]
call fcn.14005d770
nop
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x11]
call fcn.14006e3e0
mov rbx, rax
cmp qword [rax + 0x20], rsi
je 0x14006defa
mov rcx, qword [rax + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14006de00
lea rcx, [0x14006eb60]
mov qword [rbp - 0x59], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x51], rcx
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rax
jmp 0x14006de9f
mov rdi, qword [rcx + 0x10]
mov rax, qword [rbp - 0x69]
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x71], rax
lea rax, [rbp - 0x71]
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x79]
mov qword [rbp + 0x27], rax
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006de37
mov rdx, qword [rax + 8]
jmp 0x14006de3a
mov rdx, rsi
mov r8d, 0x18
call fcn.14006eb80
mov qword [rbp + 0x37], rsi
mov rcx, qword [rbp - 0x71]
mov qword [rbp - 0x71], rsi
mov qword [rax + 8], rcx
lea rcx, [0x14006eed0]
mov qword [rax], rcx
mov qword [rbp - 0x61], rax
mov qword [rbp + 0x2f], rsi
lea rcx, [rbp + 0x27]
call fcn.14006eab0
nop
mov rax, qword [rbp - 0x71]
test rax, rax
je 0x14006de84
mov rdx, qword [rax]
mov rcx, rdx
call qword [rdx + reloc.WS2_32.dll_htonl]
nop
lea rdx, [rbp - 0x61]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14006de9f
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp qword [rbp + 0xf], 0
je 0x14006deb4
mov rax, qword [rbp + 7]
mov rdx, qword [rax]
lea rcx, [rbp - 0x11]
call rdx
nop
cmp qword [rbp - 0x29], 0
je 0x14006dec9
mov rax, qword [rbp - 0x31]
mov rdx, qword [rax]
lea rcx, [rbp - 0x49]
call rdx
nop
mov rax, qword [rbp - 0x69]
test rax, rax
je 0x14006dedb
mov rdx, qword [rax]
mov rcx, rdx
call qword [rdx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp + 0x27]
call fcn.14005d650
nop
lea rcx, [rbp + 0x27]
call fcn.140062400
int3
Function at 0x14006df10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, r8
mov r8, rdx
cmp qword [rcx + 0x20], 0
jne 0x14006df6e
cmp qword [rcx + 0x58], 0
jne 0x14006df6e
mov rdx, rax
mov rcx, r8
call fcn.14006e4d0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
lea rbx, [rcx + 0x38]
cmp qword [rbx + 0x20], 0
je 0x14006e05f
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14006dfa4
lea rcx, [0x14006eec0]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r8
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
jmp 0x14006df4f
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx]
xor esi, esi
mov qword [rdx], rsi
mov qword [rbp - 0x50], rax
movups xmm0, xmmword [rdx + 8]
movups xmmword [rbp - 0x48], xmm0
mov rax, qword [rdx + 0x18]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], rax
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006dfeb
mov rdx, qword [rax + 8]
jmp 0x14006dfee
mov rdx, rsi
mov r8d, 0x30
call fcn.14006eb80
mov qword [rbp - 0x10], rsi
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x50], rsi
mov qword [rax + 8], rcx
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rbp - 0x38]
mov qword [rax + 0x20], rcx
lea rcx, [0x14006ef60]
mov qword [rax], rcx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x18], rsi
lea rcx, [rbp - 0x20]
call fcn.14006ee20
nop
lea rcx, [rbp - 0x50]
call fcn.14006bb90
nop
lea rdx, [rbp - 0x58]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14006e05a
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14006df4f
lea rcx, [rbp - 0x20]
call fcn.14005d650
nop
lea rcx, [rbp - 0x20]
call fcn.140062400
int3

Function at 0x14006e180
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 8]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x78]
test rbx, rbx
je 0x14006e21e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006e21e
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006e1d4
mov rdx, qword [rax + 8]
jmp 0x14006e1d6
xor edx, edx
mov r9, qword [rsp + 0x28]
mov rdi, rbx
mov r8, qword [rsp + 0x20]
cmp r9, 0x3fc
ja 0x14006e20a
test rdx, rdx
je 0x14006e20a
mov ecx, 6
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14006e231
inc ecx
inc rax
cmp rax, 8
jl 0x14006e1f8
mov rcx, r8
call fcn.140019930
mov qword [rdi], 0
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156510
add rsp, 0x40
pop rbx
ret
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x14006e212
Function at 0x14006eab0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x14006eae0
mov rax, qword [rax + 8]
test rax, rax
je 0x14006ead8
mov rax, qword [rax]
mov rcx, rax
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14006eb32
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006eb22
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14006eb22
mov ecx, 4
mov eax, ecx
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14006eb3d
inc ecx
inc rax
cmp rax, 6
jl 0x14006eb10
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x18]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14006ec50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r9, rdx
cmp qword [rcx + 0x20], 0
jne 0x14006ecae
cmp qword [rcx + 0x58], 0
jne 0x14006ecae
lea rdx, [r8 + 0x30]
mov rcx, r9
call fcn.14006f000
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
lea rbx, [rcx + 0x38]
cmp qword [rbx + 0x20], 0
je 0x14006edf3
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14006ece4
lea rcx, [0x14006f130]
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], r9
lea rdx, [rbp - 0x39]
mov rcx, rbx
call rax
jmp 0x14006ec8f
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx]
mov qword [rbp - 0x29], rax
mov rax, qword [rdx + 8]
mov qword [rbp - 0x21], rax
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rbp - 0x19], xmm0
movsd xmm1, qword [rdx + 0x20]
movsd qword [rbp - 9], xmm1
mov eax, dword [rdx + 0x28]
mov dword [rbp - 1], eax
mov rax, qword [rdx + 0x30]
xor esi, esi
mov qword [rdx + 0x30], rsi
mov qword [rbp + 7], rax
movups xmm0, xmmword [rdx + 0x38]
movups xmmword [rbp + 0xf], xmm0
mov rax, qword [rdx + 0x48]
mov qword [rbp + 0x1f], rax
lea rax, [rbp - 0x29]
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x49]
mov qword [rbp + 0x27], rax
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006ed54
mov rdx, qword [rax + 8]
jmp 0x14006ed57
mov rdx, rsi
mov r8d, 0x60
call fcn.14006eb80
mov rdx, rax
mov qword [rbp + 0x37], rsi
mov rcx, qword [rbp - 0x29]
mov qword [rax + 8], rcx
mov rcx, qword [rbp - 0x21]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp - 0x19]
movups xmmword [rax + 0x18], xmm0
movsd xmm1, qword [rbp - 9]
movsd qword [rax + 0x28], xmm1
mov ecx, dword [rbp - 1]
mov dword [rax + 0x30], ecx
mov rax, qword [rbp + 7]
mov qword [rbp + 7], rsi
mov qword [rdx + 0x38], rax
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rdx + 0x40], xmm0
mov rax, qword [rbp + 0x1f]
mov qword [rdx + 0x50], rax
lea rax, [0x14006f160]
mov qword [rdx], rax
mov qword [rbp - 0x41], rdx
mov qword [rbp + 0x2f], rsi
lea rcx, [rbp + 0x27]
call fcn.14006f050
nop
lea rcx, [rbp + 7]
call fcn.14006bb90
nop
lea rdx, [rbp - 0x41]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14006edee
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14006ec8f
lea rcx, [rbp + 0x27]
call fcn.14005d650
nop
lea rcx, [rbp + 0x27]
call fcn.140062400
int3
Function at 0x14006ee20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14006ee47
add rcx, 8
call fcn.14006bb90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14006ee93
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006ee83
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14006ee83
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14006ee9e
inc ecx
inc rax
cmp rax, 6
jl 0x14006ee71
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x30]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14006f050
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14006f077
add rcx, 0x38
call fcn.14006bb90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14006f0c3
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006f0b3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14006f0b3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14006f0ce
inc ecx
inc rax
cmp rax, 6
jl 0x14006f0a1
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x60]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140085be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx]
mov rsi, rcx
mov rdi, qword [0x140308e80]
movd xmm3, dword [rax + 0x40]
movd xmm0, dword [rax + 0x48]
movd xmm1, dword [rax + 0x44]
movd xmm2, dword [rax + 0x4c]
cvtdq2ps xmm3, xmm3
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
addss xmm0, xmm3
movss dword [rsp + 0x30], xmm3
addss xmm2, xmm1
movss dword [rsp + 0x34], xmm1
comiss xmm3, xmm0
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x3c], xmm2
jb 0x140085c47
movss dword [rsp + 0x38], xmm3
comiss xmm1, xmm2
jb 0x140085c52
movss dword [rsp + 0x3c], xmm1
mov ecx, dword [rdi + 0x5c]
mov r8d, dword [rdi + 0x58]
cmp r8d, ecx
jne 0x140085c88
inc r8d
test ecx, ecx
je 0x140085c70
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140085c75
mov eax, 8
cmp eax, r8d
lea rcx, [rdi + 0x58]
cmovg r8d, eax
mov edx, r8d
call fcn.14003f1f0
movsxd rdx, dword [rdi + 0x58]
mov rcx, rdi
mov rax, qword [rdi + 0x60]
add rdx, rdx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + rdx*8], xmm0
inc dword [rdi + 0x58]
movups xmmword [rdi + 0x88], xmm0
call fcn.140046ce0
mov rcx, qword [rsi]
movss xmm2, dword [0x140276204]
movzx eax, byte [rcx + 0x60]
movd xmm0, eax
movzx eax, byte [rcx + 0x61]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
movss dword [rsp + 0x30], xmm0
movd xmm0, eax
movzx eax, byte [rcx + 0x62]
cvtdq2ps xmm0, xmm0
movd xmm1, eax
movzx eax, byte [rcx + 0x63]
mulss xmm0, xmm2
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x34], xmm0
mulss xmm1, xmm2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x38], xmm1
movd xmm1, dword [rcx + 0x5c]
mulss xmm0, xmm2
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x3c], xmm0
movd xmm0, dword [rcx + 0x58]
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x54], xmm1
movd xmm1, dword [rcx + 0x54]
movss dword [rsp + 0x50], xmm0
movd xmm0, dword [rcx + 0x50]
lea rcx, [rsp + 0x30]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x58], xmm0
movss dword [rsp + 0x5c], xmm1
call fcn.14001a8c0
movss xmm0, dword [0x140276294]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140308e80]
lea rdx, [rsp + 0x58]
mov r9d, eax
movss dword [rsp + 0x20], xmm0
call fcn.140049650
mov rcx, qword [0x140308e80]
mov eax, dword [rcx + 0x58]
sub eax, 1
mov dword [rcx + 0x58], eax
jne 0x140085d92
mov rax, qword [rcx + 0x38]
add rax, 0x1c
jmp 0x140085d9e
dec eax
cdqe
shl rax, 4
add rax, qword [rcx + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x88], xmm0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.140046ce0
add rcx, 8
jmp 0x140085be0