joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000de70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov rcx, qword [0x140023d60]
mov rbp, r8
mov r13d, edx
mov r8d, 0x1000
xor edx, edx
mov r15, r9
xor edi, edi
mov r14d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x14000e043
movzx edx, word [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
nop dword [rax]
cmp rbp, 0xffffffffffffffff
je 0x14000dee2
test rbp, rbp
je 0x14000dfa4
dec rbp
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x30]
je 0x14000df02
mov r8d, 2
mov rcx, rsi
call fcn.14000e410
mov dword [rsp + 0x34], eax
jmp 0x14000df1f
mov rcx, qword [rsi]
lea r9, [rsp + 0x34]
mov r8d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx edx, word [rsp + 0x30]
cmp eax, 2
jne 0x14000dfa4
test dx, dx
je 0x14000df3a
mov word [rbx], dx
movzx edx, word [rsp + 0x30]
add rbx, 2
mov rdi, rbx
lea eax, [r14 - 1]
sub rdi, r12
movsxd rcx, eax
sar rdi, 1
cmp rdi, rcx
jle 0x14000df80
mov rcx, qword [0x140023d60]
add r14d, 0x800
mov r8, r12
movsxd r9, r14d
mov edx, 8
add r9, r9
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx edx, word [rsp + 0x30]
mov r12, rax
movsxd rax, edi
lea rbx, [r12 + rax*2]
test dx, dx
je 0x14000dfa4
mov edi, 0
test r13d, r13d
jne 0x14000ded0
cmp dx, 0xd
je 0x14000dfa9
cmp dx, 0xa
je 0x14000dfaf
jmp 0x14000ded0
test r13d, r13d
jne 0x14000dfb3
cmp dx, 0xa
jne 0x14000dfce
sub rbx, 2
xor edi, edi
mov rax, rbx
sub rax, r12
sar rax, 1
mov qword [r15], rax
mov word [rbx], di
mov rbx, qword [rsp + 0x70]
mov rax, r12
jmp 0x14000e046
cmp dx, 0xd
jne 0x14000dfb3
sub rbx, 2
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x30]
je 0x14000dffa
mov r8d, 2
mov rcx, rsi
call fcn.14000e410
xor edi, edi
mov dword [rsp + 0x34], eax
jmp 0x14000e013
mov rcx, qword [rsi]
xor edi, edi
lea r9, [rsp + 0x34]
lea r8d, [rdi + 2]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [rsp + 0x30], 0xa
je 0x14000dfb5
cmp qword [rsi + 8], 0
je 0x14000e028
add dword [rsi + 0x14], 2
jmp 0x14000dfb5
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
lea edx, [r9 - 3]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x14000dfb5
mov rax, rdi
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000e070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [0x140023d60]
mov rsi, r8
mov r12d, edx
mov r13d, 0x1000
xor edx, edx
mov r8d, r13d
mov r14, r9
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14000e225
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
cmp rsi, 0xffffffffffffffff
je 0x14000e0da
test rsi, rsi
je 0x14000e197
dec rsi
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r15
je 0x14000e0f9
mov r8d, 1
mov rcx, rdi
call fcn.14000e410
mov dword [rsp + 0x34], eax
jmp 0x14000e116
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx r8d, byte [rsp + 0x30]
cmp eax, 1
jne 0x14000e197
test r8b, r8b
je 0x14000e132
mov byte [rbx], r8b
movzx r8d, byte [rsp + 0x30]
inc rbx
lea eax, [r13 - 1]
mov rdx, rbx
movsxd rcx, eax
sub rdx, rbp
cmp rdx, rcx
jle 0x14000e174
mov rcx, qword [0x140023d60]
add r13d, 0x1000
mov r8, rbp
mov edx, 8
movsxd r9, r13d
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
movsxd rbx, ebx
mov rbp, rax
add rbx, rax
test r8b, r8b
je 0x14000e197
test r12d, r12d
jne 0x14000e0c8
cmp r8b, 0xd
je 0x14000e19c
cmp r8b, 0xa
jne 0x14000e0c8
dec rbx
jmp 0x14000e20f
test r12d, r12d
jne 0x14000e20f
cmp r8b, 0xa
jne 0x14000e1a7
dec rbx
jmp 0x14000e20f
cmp r8b, 0xd
jne 0x14000e20f
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r15
je 0x14000e1cf
mov r8d, 1
mov rcx, rdi
call fcn.14000e410
mov dword [rsp + 0x34], eax
jmp 0x14000e1e8
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x14000e20f
cmp qword [rdi + 8], r15
je 0x14000e1fa
inc dword [rdi + 0x14]
jmp 0x14000e20f
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, rbx
sub rax, rbp
mov qword [r14], rax
mov byte [rbx], r15b
mov rbx, qword [rsp + 0x70]
mov rax, rbp
jmp 0x14000e228
mov rax, r15
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000e250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1c], 1
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
jne 0x14000e29a
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov r9d, 1
neg edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x1c], 0
mov dword [rbx + 0x14], eax
mov ecx, dword [rbx + 0x14]
cmp ecx, edi
jle 0x14000e2d6
mov eax, dword [rbx + 0x10]
mov edx, edi
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rbx + 8]
dec edx
je 0x14000e2cf
dec edx
je 0x14000e2c7
cmp edx, 2
je 0x14000e2c1
mov rdx, rsi
jmp 0x14000e324
mov eax, dword [rsi]
mov dword [rcx], eax
jmp 0x14000e32c
movzx eax, word [rsi]
mov word [rcx], ax
jmp 0x14000e32c
movzx eax, byte [rsi]
mov byte [rcx], al
jmp 0x14000e32c
mov rcx, rbx
call fcn.14000d4c0
mov r11d, dword [rbx + 0x10]
mov rdx, rsi
cmp edi, r11d
jl 0x14000e319
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
sub r11d, dword [rbx + 0x14]
movsxd rcx, r11d
add rcx, qword [rbx + 8]
mov r8, rdi
call sub.msvcrt.dll_memcpy
sub dword [rbx + 0x14], edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x14000e410
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp dword [rcx + 0x1c], r12d
jne 0x14000e444
call fcn.14000d4c0
mov dword [rbx + 0x1c], 1
mov dword [rbx + 0x14], r12d
movsxd rcx, dword [rbx + 0x14]
mov eax, dword [rbx + 0x18]
sub eax, ecx
mov rbp, rcx
cmp rcx, rdi
jl 0x14000e4a9
movsxd rcx, eax
mov rax, rdi
add rcx, qword [rbx + 8]
dec rax
je 0x14000e49f
dec rax
je 0x14000e491
cmp rax, 2
je 0x14000e485
mov rdx, rcx
mov r8, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
movsxd rax, edi
jmp 0x14000e524
mov eax, dword [rcx]
mov dword [rsi], eax
movsxd rax, edi
jmp 0x14000e524
movzx eax, word [rcx]
mov word [rsi], ax
movsxd rax, edi
jmp 0x14000e524
movzx eax, byte [rcx]
mov byte [rsi], al
movsxd rax, edi
jmp 0x14000e524
movsxd rdx, eax
mov r8, rcx
mov rcx, rsi
add rdx, qword [rbx + 8]
call sub.msvcrt.dll_memcpy
movsxd r8, dword [rbx + 0x10]
mov rcx, qword [rbx]
sub rdi, rbp
add rsi, rbp
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
cmp rdi, r8
jl 0x14000e4f1
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x50]
mov dword [rbx + 0x14], r12d
add eax, ebp
cdqe
jmp 0x14000e527
mov rdx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd r11, dword [rsp + 0x50]
mov rdx, qword [rbx + 8]
cmp rdi, r11
mov rcx, rsi
mov dword [rbx + 0x14], r11d
cmovg rdi, r11
mov dword [rbx + 0x18], r11d
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea eax, [rbp + rdi]
cdqe
sub dword [rbx + 0x14], edi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14000f6e0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140024a50], eax
add rsp, 0x28
ret

Function at 0x14000f72c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x14000f7a1
mov eax, dword [rcx + 0xf4]
mov dword [rcx + 0x108], eax
mov eax, dword [rcx + 0xf8]
mov dword [rcx + 0x10c], eax
call qword [rbx + 0xb0]
mov rdi, rax
test rax, rax
jne 0x14000f7a1
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x14000f779
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x140023d60]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x140024a50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x140024a60], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f7c8
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov r12d, ecx
mov ecx, dword [0x140024a50]
mov edi, r9d
mov esi, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [rsp + 0x60]
mov rbx, rax
cmp edx, dword [rax + 0x120]
je 0x14000f816
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + pe_nt_image_headers64]
mov ecx, dword [rbx + 0x104]
mov r9d, esi
mov dword [rsp + 0x20], edi
lea r8d, [rbp + rcx]
mov ecx, dword [rbx + 0x100]
lea edx, [r12 + rcx]
mov rcx, rbx
call qword [rbx + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x14000f854
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x140024a50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [rax + 0x11c], ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000f874
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x140024a50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [rax + 0x118], ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000f894
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140024a50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [rax + 0xc8]
Function at 0x14000f8bc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
mov ecx, dword [0x140024a50]
mov rdi, r8
mov esi, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [rax + 0x118]
mov rbx, rax
cmp edx, dword [rax + 0x120]
je 0x14000f903
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + pe_nt_image_headers64]
mov edx, dword [rbx + 0x11c]
cmp edx, dword [rbx + 0x124]
je 0x14000f91c
mov rcx, rbx
mov dword [rbx + 0x124], edx
call qword [rbx]
mov eax, dword [rbx + 0x104]
mov r9, rdi
mov rcx, rbx
lea r8d, [rsi + rax]
mov eax, dword [rbx + 0x100]
lea edx, [rbp + rax]
mov rax, qword [rbx + 0x60]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp rax

Function at 0x14000f988
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x140024a50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14000f9ea
mov rcx, rax
call qword [rax + 0xb8]
mov r11, qword [rbx + 0xe0]
test r11, r11
je 0x14000f9c2
mov edx, 1
mov rcx, rbx
call r11
mov rcx, qword [0x140023d60]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x140024a50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x140024a60], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14000f9f0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov r12d, ecx
mov ecx, dword [0x140024a50]
mov edi, r9d
mov esi, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp edi, dword [rax + 0x120]
je 0x14000fa3c
mov edx, edi
mov rcx, rax
mov dword [rax + 0x120], edi
call qword [rax + pe_nt_image_headers64]
mov eax, dword [rbx + 0x104]
mov r10, qword [rbx + 0x18]
mov r9d, esi
lea r8d, [rbp + rax]
mov eax, dword [rbx + 0x100]
mov rcx, rbx
lea edx, [r12 + rax]
test r10, r10
je 0x14000fa65
call r10
jmp 0x14000fa6c
mov dword [rsp + 0x20], esi
call qword [rbx + 0x70]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14000fa88
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov r12d, ecx
mov ecx, dword [0x140024a50]
mov edi, r9d
mov esi, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [rsp + 0x60]
mov rbx, rax
cmp edx, dword [rax + 0x120]
je 0x14000fad6
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + pe_nt_image_headers64]
mov ecx, dword [rbx + 0x104]
mov edx, dword [rbx + 0x100]
lea r10d, [rcx + rdi]
lea r9d, [rdx + rsi]
lea r8d, [rcx + rbp]
add edx, r12d
mov rcx, rbx
mov dword [rsp + 0x20], r10d
call qword [rbx + 0x90]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x14000fb1c
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov r12d, ecx
mov ecx, dword [0x140024a50]
mov ebx, r9d
mov edi, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add r12d, dword [rax + 0x100]
add ebp, dword [rax + 0x104]
mov rsi, rax
test edi, edi
je 0x14000fbae
test ebx, ebx
je 0x14000fbae
test edi, edi
jns 0x14000fb6c
inc edi
jmp 0x14000fb6e
dec edi
test ebx, ebx
jns 0x14000fb76
inc ebx
jmp 0x14000fb78
dec ebx
mov edx, dword [rsp + 0x60]
cmp edx, dword [rax + 0x120]
je 0x14000fb93
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + pe_nt_image_headers64]
lea eax, [rbp + rbx]
lea r9d, [r12 + rdi]
mov r8d, ebp
mov edx, r12d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [rsi + 0x90]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x14000fbcc
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x140024a50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [rax + 0x40]

Function at 0x140011dd4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400247f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140011e56
mov r8, qword [0x140024800]
mov rcx, qword [0x140023d60]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400247f0]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1400247f8]
jmp 0x140011e42
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140011e3f
mov rax, qword [rbx + 0x10]
lea rcx, [rdi + rax]
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140011e2c
lea rcx, [0x140011d80]
mov rdx, rdi
call fcn.1400138b0
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140011e6c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
and ecx, 7
mov rbp, r8
mov rsi, rdx
je 0x140011e96
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x140024800]
test rcx, rcx
jne 0x140011ed9
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x140023d60]
movsxd r8, ebx
mov edx, 8
mov dword [0x1400247f0], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400247f0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140024800]
mov rdi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x140024800], rcx
mov ecx, dword [0x1400247f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x140024800]
mov rcx, qword [0x140023d60]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1400247f0]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rsi, rsi
jne 0x140011f2d
test rbp, rbp
je 0x140011f54
lea rcx, [0x1400247f8]
mov edx, 0x28
call fcn.1400127b8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
test rsi, rsi
je 0x140011f54
lea rcx, [rbx + rdi]
call rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140012800
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x140024ba0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14002253c], eax
call fcn.140012eb0
add rsp, 0x28
ret

Function at 0x140012870
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400128c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140012920
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret
Function at 0x140012950
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x14002253c], 0xffffffff
jne 0x14001297f
call fcn.140012800
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1400129c0]
call fcn.1400138b0
jmp 0x1400129b0
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400129b0
call fcn.140012eb0
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1400129c0]
call fcn.1400138b0
add rsp, 0x28
ret

Function at 0x140012a10
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140012a76
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x140024ba0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x140012aa1
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140024ba0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.140012e30
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140012af0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140012c70
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x140012ca0
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x140012d10
mov eax, dword [rsp + 0x28]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x30]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140024ba0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
add rax, qword [rcx]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x140012d50
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140012d90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x140012deb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x140012deb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x140012ded
xor eax, eax
add rsp, 0x38
ret

Function at 0x140012e00
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret
Function at 0x140012eb0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x140024ba0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x140024ba0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x14002253c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret