joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401df760
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1404b15b8]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, 0x3d
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.1401b9270
mov rcx, qword [rsp + 0x40]
call fcn.1401e02a0
mov rcx, qword [rax + 8]
mov qword [rcx + 7], rbx
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.1401e02d0
mov rbx, rax
mov r8d, 0x498
add r8, qword [rdi + 0x708]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x40]
mov rcx, r14
call fcn.14019d940
mov rax, qword [rbx]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2e0]
lea rax, [0x14040c108]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
call fcn.140006ee0
mov rcx, r14
call fcn.140177590
mov rax, qword [rsp + 0x38]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401df869
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14029fd30
int3

Function at 0x1401e04c0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rsi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x1404b15b8]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x48]
mov edx, 0x3e
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.1401b9270
mov rcx, qword [rsp + 0x48]
call fcn.1401e0490
mov rcx, qword [rax + 8]
movsd qword [rcx + 7], xmm6
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.1401e05e0
mov rbx, rax
mov r8d, 0x498
add r8, qword [rdi + 0x708]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x48]
mov rcx, r14
call fcn.14019d940
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2e0]
lea rax, [0x14040c108]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x60]
call fcn.140006ee0
mov rcx, r14
call fcn.140177590
mov rax, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401e05da
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14029fd30
int3
Function at 0x1401e0770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
test r8, r8
je 0x1401e0983
mov rcx, qword [rcx + 8]
mov r9, qword [rcx - 1]
and r9d, 0xfffff000
cmp r9d, 0x5e000
jne 0x1401e07c9
test r8, r8
jle 0x1401e0983
add rcx, rdx
add rcx, 0xf
mov edx, r8d
and edx, 3
cmp r8, 4
jae 0x1401e0809
xor eax, eax
jmp 0x1401e0893
mov r9, qword [rcx - 1]
and r9d, 0xfffff000
cmp r9d, 0x5f000
jne 0x1401e09bb
test r8, r8
jle 0x1401e0983
lea rcx, [rcx + rdx*2]
add rcx, 0xf
mov edx, r8d
and edx, 3
cmp r8, 4
jae 0x1401e08c8
xor eax, eax
jmp 0x1401e0953
movabs rax, 0x7ffffffffffffffc
and r8, rax
xor eax, eax
nop dword [rax + rax]
movzx r9d, byte [rcx]
add r9d, eax
mov eax, r9d
shl eax, 0xa
add eax, r9d
mov r9d, eax
shr r9d, 6
xor r9d, eax
movzx eax, byte [rcx + 1]
add eax, r9d
mov r9d, eax
shl r9d, 0xa
add r9d, eax
mov eax, r9d
shr eax, 6
xor eax, r9d
movzx r9d, byte [rcx + 2]
add r9d, eax
mov eax, r9d
shl eax, 0xa
add eax, r9d
mov r9d, eax
shr r9d, 6
xor r9d, eax
movzx eax, byte [rcx + 3]
add eax, r9d
mov r9d, eax
shl r9d, 0xa
add r9d, eax
mov eax, r9d
shr eax, 6
xor eax, r9d
add rcx, 4
add r8, 0xfffffffffffffffc
jne 0x1401e0820
test rdx, rdx
je 0x1401e0983
xor r8d, r8d
nop
movzx r9d, byte [rcx + r8]
add r9d, eax
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov eax, r10d
shr eax, 6
xor eax, r10d
inc r8
cmp rdx, r8
jne 0x1401e08a0
jmp 0x1401e0983
movabs rax, 0x7ffffffffffffffc
and r8, rax
xor eax, eax
nop word [rax + rax]
movzx r9d, word [rcx]
add r9d, eax
mov eax, r9d
shl eax, 0xa
add eax, r9d
mov r9d, eax
shr r9d, 6
xor r9d, eax
movzx eax, word [rcx + 2]
add eax, r9d
mov r9d, eax
shl r9d, 0xa
add r9d, eax
mov eax, r9d
shr eax, 6
xor eax, r9d
movzx r9d, word [rcx + 4]
add r9d, eax
mov eax, r9d
shl eax, 0xa
add eax, r9d
mov r9d, eax
shr r9d, 6
xor r9d, eax
movzx eax, word [rcx + 6]
add eax, r9d
mov r9d, eax
shl r9d, 0xa
add r9d, eax
mov eax, r9d
shr eax, 6
xor eax, r9d
add rcx, 8
add r8, 0xfffffffffffffffc
jne 0x1401e08e0
test rdx, rdx
je 0x1401e0983
xor r8d, r8d
nop dword [rax + rax]
movzx r9d, word [rcx + r8*2]
add r9d, eax
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov eax, r10d
shr eax, 6
xor eax, r10d
inc r8
cmp rdx, r8
jne 0x1401e0960
lea eax, [rax + rax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401e09b5
add rsp, 0x38
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_object.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x5d86
lea rdx, str.unreachable_code
lea rcx, [rsp + 0x20]
call fcn.1402d94a0
int3
Function at 0x1401e0e70
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x1401e0e88
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x1401e0e8f
xor r8d, r8d
jmp 0x1401e0f19
xor eax, eax
jmp 0x1401e0f48
movabs r8, 0x7ffffffffffffffc
and rdx, r8
xor r8d, r8d
nop
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x1401e0ea0
test rax, rax
je 0x1401e0f44
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x1401e0f20
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret

Function at 0x1401e0f70
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x1401e0f88
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x1401e0f8f
xor r8d, r8d
jmp 0x1401e1019
xor eax, eax
jmp 0x1401e1048
movabs r8, 0x7ffffffffffffffc
and rdx, r8
xor r8d, r8d
nop
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x1401e0fa0
test rax, rax
je 0x1401e1044
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x1401e1020
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x1401e13f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 7]
sar rcx, 1
mov r9, qword [rdx + 8]
cmp r9, qword [0x1404a6c80]
jne 0x1401e1422
xor edx, edx
jmp 0x1401e1429
mov rdx, qword [r9 + 7]
sar rdx, 1
cmp rcx, rdx
mov r10, rdx
cmovl r10, rcx
mov r8, 0xffffffffffffffff
test r10, r10
jle 0x1401e14bf
xor r11d, r11d
nop word cs:[rax + rax]
mov rsi, qword [rax - 1]
shr esi, 0xc
cmp esi, 0x5f
je 0x1401e1490
cmp esi, 0x5e
jne 0x1401e14fe
movzx esi, byte [rax + r11 + 0xf]
mov rdi, qword [r9 - 1]
shr edi, 0xc
cmp edi, 0x5f
jne 0x1401e14a2
movzx ebx, word [r9 + r11*2 + 0xf]
mov dil, 1
cmp si, bx
jae 0x1401e14b5
jmp 0x1401e14c9
movzx esi, word [rax + r11*2 + 0xf]
mov rdi, qword [r9 - 1]
shr edi, 0xc
cmp edi, 0x5f
je 0x1401e1477
cmp edi, 0x5e
jne 0x1401e14fe
movzx ebx, byte [r9 + r11 + 0xf]
mov dil, 1
cmp si, bx
jb 0x1401e14c9
ja 0x1401e14c3
inc r11
cmp r10, r11
jne 0x1401e1450
xor edi, edi
jmp 0x1401e14c9
mov r8d, 1
xor eax, eax
cmp rcx, rdx
setg al
test dil, dil
cmovne rax, r8
cmp rcx, rdx
cmovl rax, r8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401e14f8
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_object.h
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x34c3
lea rdx, str.unreachable_code
lea rcx, [rsp + 0x28]
call fcn.1402d94a0
int3
Function at 0x1401e1e80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm11
movdqa xmmword [rsp + 0x80], xmm10
movdqa xmmword [rsp + 0x70], xmm9
movdqa xmmword [rsp + 0x60], xmm8
movdqa xmmword [rsp + 0x50], xmm7
movdqa xmmword [rsp + 0x40], xmm6
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rcx, qword [0x1404a7eb8]
xor rcx, rsp
mov qword [rsp + 0x38], rcx
test rax, rax
jle 0x1401e2025
cmp rax, 3
ja 0x1401e1eeb
mov r10b, 1
xor ecx, ecx
mov rdx, rax
jmp 0x1401e1ff5
movabs rcx, 0x7ffffffffffffffc
and rcx, rax
movq xmm1, rax
pxor xmm0, xmm0
xor edx, edx
movdqa xmm4, xmmword [0x14039f8a0]
movdqa xmm5, xmmword [0x140410550]
movdqa xmm6, xmmword [0x140410560]
movdqa xmm7, xmmword [0x140410570]
movdqa xmm8, xmmword [0x14039f900]
pxor xmm3, xmm3
pxor xmm2, xmm2
nop word cs:[rax + rax]
movq xmm9, qword [r8 + rdx*4]
movq xmm10, qword [r8 + rdx*4 + 8]
pshufd xmm11, xmm9, 0x50
pxor xmm11, xmm4
pcmpgtd xmm11, xmm5
por xmm3, xmm11
pshufd xmm11, xmm10, 0x50
pxor xmm11, xmm4
pcmpgtd xmm11, xmm5
por xmm2, xmm11
pshufd xmm9, xmm9, 0xd4
paddd xmm9, xmm6
pxor xmm9, xmm4
movdqa xmm11, xmm7
pcmpgtd xmm11, xmm9
pand xmm11, xmm8
paddq xmm1, xmm11
pshufd xmm9, xmm10, 0xd4
paddd xmm9, xmm6
pxor xmm9, xmm4
movdqa xmm10, xmm7
pcmpgtd xmm10, xmm9
pand xmm10, xmm8
paddq xmm0, xmm10
add rdx, 4
cmp rcx, rdx
jne 0x1401e1f40
paddq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq rdx, xmm1
por xmm2, xmm3
psllq xmm2, 0x3f
movmskpd r10d, xmm2
test r10d, r10d
sete r10b
jmp 0x1401e201b
mov r11d, dword [r8 + rcx*4]
cmp r11d, 0x100
setb bl
and r10b, bl
add r11d, 0xffff0000
cmp r11d, 0x100000
adc rdx, 0
inc rcx
cmp rax, rcx
jne 0x1401e1ff5
test r10b, r10b
je 0x1401e2037
lea rcx, [rsp + 0x30]
mov rdx, r8
mov r8, rax
call fcn.1401e20a0
jmp 0x1401e2049
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x30]
mov r9, rax
call fcn.1401e2250
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401e2097
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm9, xmmword [rsp + 0x70]
movaps xmm10, xmmword [rsp + 0x80]
movaps xmm11, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rsi
ret
call fcn.14029fd30
int3
Function at 0x1402025f0
Capabilities:
Allocate thread local storage

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1402026e7
mov esi, eax
test rdi, rdi
je 0x1402026c0
mov rbx, qword [0x1404abfa8]
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov r15, qword [0x1404abfb0]
mov r14, qword [r15]
cmp r14, qword [r15 + 8]
jge 0x14020264e
mov rax, qword [r15 + 0x10]
jmp 0x1402026a4
mov rax, r14
shr rax, 1
or rax, r14
mov rcx, rax
shr rcx, 2
or rcx, rax
mov rax, rcx
shr rax, 4
or rax, rcx
mov rcx, rax
shr rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x10
or rax, rcx
mov r12, rax
shr r12, 0x20
or r12, rax
inc r12
mov rcx, qword [r15 + 0x10]
mov rdx, r12
shl rdx, 4
call fcn.140006690
mov qword [r15 + 0x10], rax
mov qword [r15 + 8], r12
inc r14
mov qword [r15], r14
shl r14, 4
mov dword [rax + r14 - 0x10], esi
mov qword [rax + r14 - 8], rdi
mov rcx, rbx
call fcn.140006ee0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1402026e1
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsAlloc_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.1402d94a0
int3

Function at 0x140202800
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140202839
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140202833
add rsp, 0x38
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsSetValue_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.1402d94a0
int3
Function at 0x14021dc90
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1404b15b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rax, qword [rsi + 0x20]
mov rbx, qword [rax + 0x2d8]
mov rdx, qword [0x1404a6c80]
mov r8d, 4
mov rcx, rdi
call fcn.14015dc50
mov qword [rsp + 0x40], rax
mov rcx, rdi
call fcn.140165a80
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.140165aa0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov r13d, 1
lea rbp, [0x140423270]
lea rdi, [rsp + 0x40]
lea rbx, [rsp + 0x28]
lea r12, [0x1404ad590]
jmp 0x14021dd62
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8 + 0x27]
mov qword [r14 + 8], rax
mov qword [r12 + r13*8], r14
inc r13
cmp r13, 0x2b5
je 0x14021ddb0
mov ecx, 0x5d
call fcn.140186110
mov r14, rax
mov r15, qword [rbp + r13*8]
mov rcx, r15
call fcn.1402c0ec0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], rax
mov rcx, r15
mov rdx, rax
call fcn.1401e0e70
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1402203a0
cmp rax, 0xffffffffffffffff
jne 0x14021dd40
mov rax, qword [0x1404a6c80]
jmp 0x14021dd4e
lea r13, [0x1404acd90]
xor ebp, ebp
lea rdi, [rsp + 0x27]
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x28]
jmp 0x14021de02
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8 + 0x27]
mov qword [r15 + 8], rax
mov rax, qword [r15 + 8]
mov qword [r13], rax
mov qword [r12 + rbp*8 + 0x15a8], r15
inc rbp
add r13, 8
cmp rbp, 0x100
je 0x14021de4e
mov byte [rsp + 0x27], bpl
mov ecx, 0x5d
call fcn.140186110
mov r15, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], 1
mov edx, 1
mov rcx, rdi
call fcn.1401e0e70
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov rdx, r14
call fcn.1402203a0
cmp rax, 0xffffffffffffffff
jne 0x14021ddd0
mov rax, qword [0x1404a6c80]
jmp 0x14021ddde
mov rax, qword [rsi + 0x20]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], 0
mov rcx, qword [rcx + 8]
mov qword [rax + 0x2d8], rcx
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14021de85
mov rcx, qword [0x1404a6c80]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14021dea7
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3
Function at 0x140223c20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.14003c550
test rax, rax
je 0x140223ce4
mov rcx, rsi
call fcn.14003c550
mov rbx, qword [rax + 0x720]
mov rdi, qword [rsi + 0x50]
test rbx, rbx
je 0x140223c73
mov rcx, rsi
call fcn.14003c550
mov rcx, qword [rax + 0x708]
mov rcx, qword [rcx + 0x3b0]
mov rdx, rax
call fcn.14023bd70
cmp eax, 4
jne 0x140223c85
test rbx, rbx
setne r8b
mov rcx, rdi
mov rdx, rsi
call fcn.1401970b0
mov rcx, rsi
call fcn.14003c550
mov rdi, rax
mov qword [rsi], rax
mov rcx, rax
call 0x140223f00
mov eax, 1
cmp dword [rdi + 0xc40], 1
je 0x140223ccb
cmp qword [rdi + 0x810], 0
setle al
cmp qword [rdi + 0x818], 0
setg cl
and cl, al
movzx eax, cl
shl eax, 4
or rax, 5
xor ecx, ecx
lock cmpxchg qword [rdi + 0x790], rcx
jne 0x140223db7
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [rsi + 0x50]
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.1401970b0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call fcn.140223e10
mov rdi, rax
mov dword [rax + 0x7d0], 1
mov rax, qword [rax + 0x708]
mov rcx, qword [rax + 0x378]
test rcx, rcx
je 0x140223d76
call fcn.14023a710
mov qword [rdi + 0x730], rax
mov qword [rdi + 0x40], send
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x380]
call fcn.14023a710
mov qword [rdi + 0x738], rax
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x388]
call fcn.14023a710
mov qword [rdi + 0x740], rax
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x3c0]
call fcn.14023a140
mov qword [rdi + 0x728], rax
mov rax, qword [rsi + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rdi + 0x60], rax
mov qword [rsi + 8], rdi
mov rdx, qword [rsi + 0x50]
mov rcx, rdi
call fcn.140225ae0
mov qword [rsi], rdi
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140223f00
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x3b0]
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14023bcc0
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx + 0x748], 3
mov qword [rcx + 0x788], 0
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140223f44
cmp byte [rax + 8], 0
jne 0x140223f49
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140223f49
call fcn.1402021d0
mov qword [rsi + 0x10], rax
mov qword [rax + 0x60], rsi
mov rcx, rsi
call fcn.1402022c0
mov rax, qword [0x1404ab4b0]
test rax, rax
je 0x140223fd2
cmp qword [rsi + 0x700], rax
je 0x140223fd2
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140223f92
cmp byte [rax + 8], 0
jne 0x140223f97
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140223f97
call fcn.1402021d0
mov rbx, qword [rax + 0x58]
add rbx, qword [rax + 0x50]
lea rdi, [rsi + 0x7e8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
test qword [rsi + 0x38], 3
jne 0x140223fbc
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x710], rbx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140006ee0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140223f00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.14003c550
test rax, rax
je 0x140223ce4
mov rcx, rsi
call fcn.14003c550
mov rbx, qword [rax + 0x720]
mov rdi, qword [rsi + 0x50]
test rbx, rbx
je 0x140223c73
mov rcx, rsi
call fcn.14003c550
mov rcx, qword [rax + 0x708]
mov rcx, qword [rcx + 0x3b0]
mov rdx, rax
call fcn.14023bd70
cmp eax, 4
jne 0x140223c85
test rbx, rbx
setne r8b
mov rcx, rdi
mov rdx, rsi
call fcn.1401970b0
mov rcx, rsi
call fcn.14003c550
mov rdi, rax
mov qword [rsi], rax
mov rcx, rax
call 0x140223f00
mov eax, 1
cmp dword [rdi + 0xc40], 1
je 0x140223ccb
cmp qword [rdi + 0x810], 0
setle al
cmp qword [rdi + 0x818], 0
setg cl
and cl, al
movzx eax, cl
shl eax, 4
or rax, 5
xor ecx, ecx
lock cmpxchg qword [rdi + 0x790], rcx
jne 0x140223db7
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [rsi + 0x50]
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.1401970b0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call fcn.140223e10
mov rdi, rax
mov dword [rax + 0x7d0], 1
mov rax, qword [rax + 0x708]
mov rcx, qword [rax + 0x378]
test rcx, rcx
je 0x140223d76
call fcn.14023a710
mov qword [rdi + 0x730], rax
mov qword [rdi + 0x40], send
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x380]
call fcn.14023a710
mov qword [rdi + 0x738], rax
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x388]
call fcn.14023a710
mov qword [rdi + 0x740], rax
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x3c0]
call fcn.14023a140
mov qword [rdi + 0x728], rax
mov rax, qword [rsi + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rdi + 0x60], rax
mov qword [rsi + 8], rdi
mov rdx, qword [rsi + 0x50]
mov rcx, rdi
call fcn.140225ae0
mov qword [rsi], rdi
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140223f00
mov rax, qword [rdi + 0x708]
mov rcx, qword [rax + 0x3b0]
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14023bcc0
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx + 0x748], 3
mov qword [rcx + 0x788], 0
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140223f44
cmp byte [rax + 8], 0
jne 0x140223f49
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140223f49
call fcn.1402021d0
mov qword [rsi + 0x10], rax
mov qword [rax + 0x60], rsi
mov rcx, rsi
call fcn.1402022c0
mov rax, qword [0x1404ab4b0]
test rax, rax
je 0x140223fd2
cmp qword [rsi + 0x700], rax
je 0x140223fd2
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140223f92
cmp byte [rax + 8], 0
jne 0x140223f97
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140223f97
call fcn.1402021d0
mov rbx, qword [rax + 0x58]
add rbx, qword [rax + 0x50]
lea rdi, [rsi + 0x7e8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
test qword [rsi + 0x38], 3
jne 0x140223fbc
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x710], rbx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140006ee0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret