joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cf480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movdqa xmmword [rsp + 0x50], xmm8
movapd xmmword [rsp + 0x40], xmm7
movapd xmmword [rsp + 0x30], xmm6
mov rbx, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov ecx, 0x20
call fcn.1400f045c
mov r14, rax
mov ebp, dword [rbx + 0x1c]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
inc ebp
je 0x1400cf6b1
lea rsi, [rbp*4]
mov rcx, rsi
call fcn.1400f045c
mov rdi, rax
mov qword [r14], rax
lea rax, [rax + rbp*4]
mov qword [r14 + 0x10], rax
test rsi, rsi
je 0x1400cf6a9
mov rcx, rdi
xor edx, edx
mov r8, rsi
call fcn.1400f5b50
mov r15, rdi
add r15, rsi
mov qword [r14 + 8], r15
mov dword [r14 + 0x1c], 0
mov esi, dword [rbx + 0x14]
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rbx + 0x18]
call fcn.14010b800
mov dword [rdi + 4], esi
mov r12, r15
sub r12, rdi
sar r12, 2
lea rbx, [r12 - 1]
cmp rbx, 3
jb 0x1400cf5e8
movapd xmm6, xmm0
add rbx, 0xfffffffffffffffe
lea rbp, [rdi + 8]
lea r13, [rsp + 0x20]
movdqa xmm8, xmmword [0x1401c8a60]
movapd xmm7, xmmword [0x1401c8a70]
nop
mov qword [rsp + 0x20], 0xffffffffffffffff
xorps xmm0, xmm0
cvtsi2sd xmm0, esi
call fcn.14010b800
movsd qword [rsp + 0x20], xmm0
mov rcx, r13
call fcn.1400bcb60
movsd xmm1, qword [rsp + 0x20]
movapd xmm0, xmm6
subsd xmm0, xmm1
movq xmm2, rbx
punpckldq xmm2, xmm8
subpd xmm2, xmm7
movapd xmm3, xmm2
unpckhpd xmm3, xmm2
addsd xmm3, xmm2
divsd xmm0, xmm3
addsd xmm0, xmm1
call fcn.140109ce0
call fcn.140121bdc
cvttsd2si eax, xmm0
cmp esi, eax
lea ecx, [rsi + 1]
cmovl ecx, eax
mov dword [rbp], ecx
add rbp, 4
mov esi, ecx
add rbx, 0xffffffffffffffff
jne 0x1400cf570
mov dword [rdi + r12*4 - 4], 0x7fffffff
mov r8, r15
sub r8, rdi
je 0x1400cf6bb
mov rax, r8
shr rax, 2
mov rcx, rdi
not rcx
add rcx, r15
jne 0x1400cf613
xor edx, edx
jmp 0x1400cf658
mov rcx, r8
and rcx, 0xfffffffffffffffe
xor edx, edx
lea rbx, [0x1401d5910]
nop word cs:[rax + rax]
nop dword [rax]
movzx esi, al
movzx ebp, byte [rdi + rdx]
xor ebp, esi
shr eax, 8
xor eax, dword [rbx + rbp*4]
movzx ebp, al
movzx esi, byte [rdi + rdx + 1]
xor esi, ebp
shr eax, 8
xor eax, dword [rbx + rsi*4]
add rdx, 2
cmp rcx, rdx
jne 0x1400cf630
test r8b, 1
je 0x1400cf674
movzx ecx, al
movzx edx, byte [rdi + rdx]
xor edx, ecx
lea rcx, [0x1401d5910]
shr eax, 8
xor eax, dword [rcx + rdx*4]
mov dword [r14 + 0x18], eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
mov rax, r14
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, rdi
jmp 0x1400cf515
xor r15d, r15d
xor edi, edi
jmp 0x1400cf519
xor eax, eax
jmp 0x1400cf674
Function at 0x1400d1430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
movapd xmmword [rsp + 0x40], xmm8
movapd xmmword [rsp + 0x30], xmm7
movapd xmmword [rsp + 0x20], xmm6
mov r14, rcx
mov ecx, 0x20
call fcn.1400f045c
mov r12, rax
mov ebx, dword [r14 + 0x1c]
xorpd xmm0, xmm0
movupd xmmword [rax], xmm0
mov qword [rax + 0x10], 0
inc ebx
je 0x1400d1652
lea r15, [rbx*4]
mov rcx, r15
call fcn.1400f045c
mov rdi, rax
mov qword [r12], rax
lea rax, [rax + rbx*4]
mov qword [r12 + 0x10], rax
test r15, r15
je 0x1400d164a
mov rcx, rdi
xor edx, edx
mov r8, r15
call fcn.1400f5b50
mov rax, rdi
add rax, r15
mov qword [r12 + 8], rax
mov dword [r12 + 0x1c], 0
mov rdx, rax
sub rdx, rdi
sar rdx, 2
lea rcx, [rdx - 1]
cmp rcx, 2
jb 0x1400d159a
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [r14 + 0x14]
cvtsi2sd xmm1, dword [r14 + 0x18]
add rdx, 0xfffffffffffffffd
movq xmm2, rdx
punpckldq xmm2, xmmword [0x1401c8a60]
subpd xmm2, xmmword [0x1401c8a70]
haddpd xmm2, xmm2
add rcx, 0xfffffffffffffffe
xor edx, edx
movdqa xmm3, xmmword [0x1401c8a60]
movapd xmm4, xmmword [0x1401c8a70]
movsd xmm8, qword [0x1401bba18]
nop dword [rax]
movq xmm6, rcx
punpckldq xmm6, xmm3
subpd xmm6, xmm4
movapd xmm7, xmm6
unpckhpd xmm7, xmm6
addsd xmm7, xmm6
mulsd xmm7, xmm0
movq xmm5, rdx
punpckldq xmm5, xmm3
subpd xmm5, xmm4
movapd xmm6, xmm5
unpckhpd xmm6, xmm5
addsd xmm6, xmm5
mulsd xmm6, xmm1
addsd xmm6, xmm7
divsd xmm6, xmm2
addsd xmm6, xmm8
cvttsd2si ebx, xmm6
mov dword [rdi + rdx*4 + 4], ebx
mov rdi, qword [r12]
add rdx, 1
add rcx, 0xffffffffffffffff
jb 0x1400d1530
sub rax, rdi
sar rax, 2
dec rax
mov rcx, rax
mov dword [rdi + rcx*4], 0x7fffffff
mov rsi, qword [r12]
mov rdx, qword [r12 + 8]
mov r8, rdx
sub r8, rsi
je 0x1400d165b
mov rax, r8
shr rax, 2
mov rcx, rsi
not rcx
add rcx, rdx
jne 0x1400d15cc
xor ebx, ebx
jmp 0x1400d1608
mov r9, r8
and r9, 0xfffffffffffffffe
xor ebx, ebx
lea rdi, [0x1401d5910]
nop dword [rax]
movzx ecx, al
movzx edx, byte [rsi + rbx]
xor edx, ecx
shr eax, 8
xor eax, dword [rdi + rdx*4]
movzx ecx, al
movzx edx, byte [rsi + rbx + 1]
xor edx, ecx
shr eax, 8
xor eax, dword [rdi + rdx*4]
add rbx, 2
cmp r9, rbx
jne 0x1400d15e0
test r8b, 1
je 0x1400d1624
movzx ecx, al
movzx edx, byte [rsi + rbx]
xor edx, ecx
lea rcx, [0x1401d5910]
shr eax, 8
xor eax, dword [rcx + rdx*4]
mov dword [r12 + 0x18], eax
mov rax, r12
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, rdi
jmp 0x1400d14b8
xor edi, edi
xor eax, eax
jmp 0x1400d14bd
xor eax, eax
jmp 0x1400d1624
Function at 0x1400d4c60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov r14d, r9d
mov r15, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
movaps xmm6, xmmword [0x1401c8a80]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea rbp, [rsp + 0x40]
mov rcx, rbp
mov r9d, 0x73
call fcn.1400d4e70
mov rcx, rdi
mov rdx, rbp
xor r8d, r8d
call fcn.1400d4e90
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xb0], 0
mov rcx, qword [0x1401feac8]
test rcx, rcx
jne 0x1400d4da2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
lea rdi, [rsp + 0x3c]
mov dword [rdi], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rbp
mov rdx, r15
mov r8d, r14d
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov ebx, dword [rdi]
cmp qword [rsp + 0xb0], 0
jne 0x1400d4dcf
test byte [0x1401f7030], 0x19
jne 0x1400d4dfa
xor edi, edi
cmp esi, 1
sbb edi, edi
or edi, ebx
lea rcx, [rsp + 0x60]
call fcn.1400dcbb0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x1400d4d13
movsxd r9, r14d
lea rdx, str.File::Write
lea rcx, [rsp + 0xb0]
mov r8, rbx
call fcn.140142c60
jmp 0x1400d4d13
mov rcx, qword [0x1401feac8]
test rcx, rcx
je 0x1400d4d56
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x1400d4d56
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], r12
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x1401f7030]
lea r9, [0x1401d1322]
mov rcx, rdi
mov dl, 0x45
call fcn.1400c3ef0
mov rbp, qword [rdi]
test rbp, rbp
je 0x1400d4e5a
mov r14, qword [rsp + 0x48]
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
call fcn.1400ec270
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], r14
mov rcx, rdi
call fcn.1400c3f10
lea rcx, [rsp + 0x40]
call fcn.1400ec280
jmp 0x1400d4d63
Function at 0x1400d6090
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov eax, dword [0x1401fea08]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400d60dd
lea rcx, [0x1401fe678]
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400d6110
lea rcx, [0x1401fea08]
call fcn.1400f0548
cmp dword [0x1401fea08], 0xffffffff
jne 0x1400d60c1
lea rcx, [0x1401fe678]
call fcn.14001abc0
lea rcx, [0x1401fea08]
call fcn.1400f07ac
jmp 0x1400d60c1
Function at 0x1400dcbb0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.1400f04a8
mov r15d, dword [rax]
call fcn.1400f04a8
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [0x1401febb8]
cmp rbx, 1
jbe 0x1400dccce
mov rbp, qword [rsi + 8]
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400dcd17
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rbp
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400dcc83
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.1400f04a8
mov dword [rax], r15d
cmp byte [rsi + 0x38], 0
je 0x1400dcc5c
mov rdi, qword [rsi + 0x48]
test rdi, rdi
jne 0x1400dcc91
add rsi, 0x18
mov rcx, rsi
call fcn.1400c18e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f32c0
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp qword [rsi + 8], 0
jne 0x1400dcc3d
call fcn.1400ee4a0
jmp 0x1400dcc3d
lea rbx, [rsp + 0x28]
mov rcx, rbx
call qword [fcn.1400e87b0]
mov rdx, qword [rsi + 0x40]
mov r8, qword [rbx]
mov rcx, rdi
call fcn.1400dcd40
mov rdi, qword [rsi + 0x48]
test rdi, rdi
je 0x1400dcc5c
lock dec dword [rdi]
jne 0x1400dcc5c
mov rcx, rdi
call fcn.14000dc70
mov rcx, rdi
call fcn.1400f0498
jmp 0x1400dcc5c
lea rcx, [0x1401febb8]
call fcn.14000d630
test al, al
je 0x1400dcd2a
mov qword [0x1401febc0], 0
lea r14, [0x1401febb8]
lea rbx, [0x1401febc0]
mov rcx, rbx
xor edx, edx
call fcn.14000d6e0
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.14000d5b0
jmp 0x1400dcc02
test rbp, rbp
je 0x1400dcc35
call fcn.140001340
jmp 0x1400dcc1c
mov rbx, qword [0x1401febb8]
jmp 0x1400dcc02
Function at 0x1400e0920
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400e0a13
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400e09a9
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400e0984
mov qword [rsi], rdi
call fcn.1400c18d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x1400e0a17
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400c18d0
mov r14, qword [rsi]
cmp qword [0x1401fec08], 0
je 0x1400e09d3
mov rcx, qword [0x1401fec08]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400e0972
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1401d60e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e0a1a
mov rcx, rax
lea rax, [sym.chrome.exe_GetHandleVerifier]
cmp rcx, rax
je 0x1400e0a0d
call rcx
mov rcx, rax
xor edx, edx
call fcn.140013e30
jmp 0x1400e09bb
xor ecx, ecx
mov dl, 1
jmp 0x1400e0a06
mov byte [rsi + 8], 1
int3
xor ecx, ecx
jmp 0x1400e0a04
Function at 0x1400e44c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov eax, dword [0x140200ad8]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e4531
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x1400e4521
movsxd rdx, dword [0x140200ad0]
shl rdx, 4
mov esi, dword [rax + rdx + 8]
cmp esi, dword [0x140200ad4]
jne 0x1400e4521
mov rax, qword [rax + rdx]
test rax, rax
jne 0x1400e452d
mov dword [rdi], ecx
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, dword [rax]
jmp 0x1400e4521
lea rcx, [0x140200ad8]
call fcn.1400f0548
cmp dword [0x140200ad8], 0xffffffff
jne 0x1400e44ea
mov qword [0x140200ad0], 0
lea rcx, [0x140200ad0]
xor edx, edx
call fcn.14000d6e0
lea rcx, [0x140200ad8]
call fcn.1400f07ac
jmp 0x1400e44ea
Function at 0x1400e6160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
test r8, r8
je 0x1400e626b
mov r11, qword [rcx + 8]
movsxd rcx, dword [r11 + 0x3c]
cmp dword [r11 + rcx + 0x84], 0
je 0x1400e626b
add rcx, r11
xor eax, eax
mov rbp, rcx
add rbp, 0x88
je 0x1400e6293
cmp word [rcx + 0x14], 0x78
jb 0x1400e6293
mov r10d, dword [rbp]
test r10, r10
je 0x1400e626b
add r10, r11
je 0x1400e626b
cmp rdx, 0xffff
jbe 0x1400e629c
mov eax, dword [r10 + 0x18]
mov ecx, dword [r10 + 0x20]
lea r9, [r11 + rcx]
test rcx, rcx
cmove r9, rcx
lea rcx, [rax*4]
test rcx, rcx
je 0x1400e626b
lea rax, [r9 + rax*4]
mov r14b, byte [rdx]
inc rdx
mov rsi, r9
mov rdi, rax
sub rdi, rsi
mov rcx, rdi
sar rcx, 2
shr rdi, 0x3f
add rdi, rcx
and rdi, 0xfffffffffffffffe
mov ecx, dword [rsi + rdi*2]
lea rbx, [r11 + rcx]
test rcx, rcx
cmove rbx, rcx
test r14b, r14b
je 0x1400e6243
mov rcx, rdx
mov ebp, r14d
nop dword [rax]
cmp bpl, byte [rbx]
jne 0x1400e6245
inc rbx
mov bpl, byte [rcx]
inc rcx
test bpl, bpl
jne 0x1400e6230
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ecx, bpl
movzx ebx, byte [rbx]
mov ebp, ecx
sub ebp, ebx
lea r15, [rdi + 4]
test ebp, ebp
cmovg rsi, r15
cmp ecx, ebx
cmovs rax, rdi
je 0x1400e626f
cmp rsi, rax
jne 0x1400e61fc
xor eax, eax
jmp 0x1400e6293
mov eax, dword [r10 + 0x24]
add r11, rax
test rax, rax
cmove r11, rax
sub rdi, r9
sar rdi, 1
movzx eax, word [r11 + rdi]
add ax, word [r10 + 0x10]
mov word [r8], ax
mov al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov word [r8], dx
jmp 0x1400e6291

Function at 0x1400e6c90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400e6cc8
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x1400e6cd2
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400e6cd9
add rdi, rbx
sub rsi, rbx
jne 0x1400e6caa
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x1400e6cb2
int3

Function at 0x1400e6ce0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400e6d2f
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rsi
add rsp, 0x30
pop rsi
ret
int3
Function at 0x1400e6dc0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x140200268]
cmp rbx, 1
jbe 0x1400e6e14
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e6e5a
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140200268]
call fcn.14000d630
test al, al
je 0x1400e6e66
mov qword [0x140200270], 0
lea r14, [0x140200268]
lea rbx, [0x140200270]
mov rcx, rbx
xor edx, edx
call fcn.14000d6e0
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.14000d5b0
jmp 0x1400e6ddc
test rdi, rdi
je 0x1400e6e07
call fcn.140001340
jmp 0x1400e6dee
mov rbx, qword [0x140200268]
jmp 0x1400e6ddc

Function at 0x1400e6e80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e6eb4
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400e6eb4
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1400e6eae

Function at 0x1400e6ec0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401fccd0]
cmp rsi, 1
jbe 0x1400e6f05
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e6f4b
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400e6f4b
mov rax, qword [rax + rcx]
test rax, rax
je 0x1400e6f4b
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401fccd0]
call fcn.14000d630
test al, al
je 0x1400e6f4e
mov qword [0x1401fccd8], 0
lea rdi, [0x1401fccd0]
lea rsi, [0x1401fccd8]
mov rcx, rsi
xor edx, edx
call fcn.14000d6e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14000d5b0
jmp 0x1400e6ed3
int3
mov rsi, qword [0x1401fccd0]
jmp 0x1400e6ed3

Function at 0x1400e8640
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401fe500]
cmp rsi, 1
jbe 0x1400e8685
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e86cb
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400e86cb
mov rax, qword [rax + rcx]
test rax, rax
je 0x1400e86cb
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401fe500]
call fcn.14000d630
test al, al
je 0x1400e86ce
mov qword [0x1401fe508], 0
lea rdi, [0x1401fe500]
lea rsi, [0x1401fe508]
mov rcx, rsi
xor edx, edx
call fcn.14000d6e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14000d5b0
jmp 0x1400e8653
int3
mov rsi, qword [0x1401fe500]
jmp 0x1400e8653
Function at 0x1400e86e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140200af8]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e8745
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e8781
movsxd rcx, dword [0x140200af0]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x140200af4]
movsxd rdx, dword [0x140200af0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140200af8]
call fcn.1400f0548
cmp dword [0x140200af8], 0xffffffff
jne 0x1400e8709
mov qword [0x140200af0], 0
lea rcx, [0x140200af0]
xor edx, edx
call fcn.14000d6e0
lea rcx, [0x140200af8]
call fcn.1400f07ac
jmp 0x1400e8709
test rsi, rsi
je 0x1400e873f
call fcn.140001340
jmp 0x1400e871b
Function at 0x1400e9130
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x1400e93af
mov rsi, rcx
mov byte [rsp + 0x37], 0xaa
lea r14, [rcx + 0x718]
lea rbx, [rcx + 8]
mov edi, 1
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x1400e91b3
jmp 0x1400e938e
pause
dec eax
jne 0x1400e9191
add ebp, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r12d
cmp ebp, 0x3e8
jl 0x1400e9182
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rax, qword [r14]
mov rdi, qword [rax]
test rdi, rdi
je 0x1400e935e
mov byte [rsp + 0x37], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e9387
mov rdx, rcx
not rdx
cmp qword [rdi + 8], rdx
jne 0x1400e93b2
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xorps xmm6, xmm6
movups xmmword [rdi + 0x2d8], xmm6
movups xmmword [rdi + 0x2c8], xmm6
movups xmmword [rdi + 0x2b8], xmm6
movups xmmword [rdi + 0x2a8], xmm6
movups xmmword [rdi + 0x298], xmm6
mov qword [rdi + 0x2e8], 0
xor r14d, r14d
mov r8d, 0x291
mov rcx, rdi
xor edx, edx
call fcn.1400f5b50
mov qword [rdi + 0x2f0], rsi
movups xmmword [rdi + 0x2f8], xmm6
mov ebp, 1
lea rbx, [0x1401f82b0]
mov r12d, 0x40
mov rcx, rbx
call r15
test al, al
jne 0x1400e9291
jmp 0x1400e939d
pause
dec eax
jne 0x1400e9269
add r14d, ebp
add ebp, ebp
cmp ebp, 0x40
cmovge ebp, r12d
cmp r14d, 0x3e8
jl 0x1400e925a
lea rcx, [0x1401f82b0]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov qword [rdi + 0x300], 0
mov rax, qword [0x1401f82b8]
mov qword [0x1401f82b8], rdi
mov qword [rdi + 0x2f8], rax
test rax, rax
je 0x1400e92bd
mov qword [rax + 0x300], rdi
lea rcx, [0x1401f82b0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add rsi, 0x10
mov eax, 0xa
jmp 0x1400e92ed
mov dword [rdi + rax - 2], 0
add rax, 0x10
add rsi, 0x28
cmp rax, 0x29a
je 0x1400e932b
cmp qword [rsi], 0
je 0x1400e92d5
mov ecx, dword [rsi + 0x18]
cmp ecx, 0x10000
jae 0x1400e93ac
mov word [rdi + rax], cx
cmp ecx, 0x80
jbe 0x1400e931d
cmp ecx, 0x100
ja 0x1400e9324
mov byte [rdi + rax - 1], 0x40
jmp 0x1400e92dd
mov byte [rdi + rax - 1], 0x80
jmp 0x1400e92dd
mov byte [rdi + rax - 1], 0x20
jmp 0x1400e92dd
mov ecx, dword [0x1402003c0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x308
mov rcx, r14
mov rdx, rsi
mov r8d, 2
call fcn.1400c21b0
mov rdi, rax
jmp 0x1400e91ed
xor ecx, ecx
jmp 0x1400e91e3
mov eax, edi
test edi, edi
jg 0x1400e9191
jmp 0x1400e9199
mov eax, ebp
test ebp, ebp
jg 0x1400e9269
jmp 0x1400e9272
int3
int3
call 0x140152a70
int3