joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035395
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x10
mov edx, 8
call fcn.140025b10
mov qword [rsp + 0x20], rax
xor eax, eax
mov ecx, eax
call fcn.140034e00
mov rax, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x140035850
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov ecx, 0x10
call fcn.14000eb10
mov rdx, qword [rsp + 0x40]
mov r8, rax
mov qword [rsp + 0x48], r8
movabs rax, 0x947fbf3c1391c16f
movabs rcx, 0x947fbf3c1391c16f
xor rax, rcx
sub rax, r8
xor ecx, ecx
sub rcx, rdx
add rax, rcx
xor ecx, ecx
sub rcx, rax
mov qword [rsp + 0x50], rcx
mov rax, rcx
xor rax, rdx
mov r9, rcx
xor r9, r8
movabs rdx, 0xb87435d300a2092c
movabs r10, 0x478bca2cff5df6d3
xor rdx, r10
xor r9, rdx
mov rdx, r8
and rdx, r9
shl rdx, 1
sub rdx, r8
sub rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x1400358ee
call fcn.14000ee80
jmp 0x140035a37
mov rax, qword [rsp + 0x50]
cmp rax, 0
jge 0x140035986
mov eax, dword [0x1402a9688]
xor eax, dword [0x1402a968c]
mov ecx, 0xffffffff
xor ecx, 0xbabe5d24
add eax, ecx
mov ecx, 0x1fd292c5
xor ecx, 0x1fd292c4
add eax, ecx
imul eax, eax, 0xdda8b9e9
sub eax, 0x9f8f0b79
cmp eax, 0xf981231c
jae 0x140035a41
mov eax, dword [0x1402a9690]
add eax, dword [0x1402a9694]
mov ecx, 0xe82be03c
xor ecx, 0xfac0665a
xor edx, edx
div ecx
imul eax, eax, 0x2cfd4377
mov ecx, 0x39949bb5
xor edx, edx
div ecx
mov dword [rsp + 0x34], eax
mov rcx, r8
mov rdx, r8
call fcn.140018506
mov eax, dword [rsp + 0x34]
cmp eax, 0x7b9b6268
ja 0x140035939
jmp 0x140035a37
mov rax, qword [rsp + 0x38]
movabs rcx, 0x22c7c33768da3cfe
movabs rdx, 0x22c7c33768da3cfe
xor rcx, rdx
cmp rax, rcx
jge 0x1400359bb
mov rcx, r8
mov rdx, r8
call fcn.140018506
jmp 0x140035a37
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.1400220a0
mov rcx, rax
mov rax, qword [rsp + 0x48]
xor rcx, 0xffffffffffffffff
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
movabs rdx, 0xc77d3c0430c23412
movabs rcx, 0xa3b4b09ad9cce0b8
xor rdx, rcx
mov rcx, rax
sub rcx, rdx
add rcx, 0xfffffffffffffff0
movabs rdx, 0x64c98c9ee90ed4aa
add rcx, rdx
mov qword [rcx], 0
movabs rdx, 0x5dd2de9266176b8a
movabs r8, 0x5dd2de9266176b8a
xor rdx, r8
mov qword [rcx + 8], rdx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x58
ret
ja 0x140035ac2
push rsp
invalid
push rdx
jae 0x140035ac8
add byte [rax - 0x75], cl
and al, 0x30

Function at 0x140035aa2
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14006ce18
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x1a
xor cl, 0x1a
cmp al, cl
jne 0x140035ae5
mov rcx, qword [rsp + 0x28]
call fcn.14006ce9e
nop
add rsp, 0x38
ret
Function at 0x14003673f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x1400367c7
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, rax
add rcx, 1
xor rax, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
or rax, rdx
add rax, rcx
movabs rcx, 0x529462427548a3f4
movabs rdx, 0x529462427548a3f4
xor rcx, rdx
cmp rax, rcx
jne 0x1400367c7
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
movabs rdx, 0xd541e2c35600f59
movabs r8, 0xd541e2c35600f59
xor rdx, r8
mov qword [rcx], rdx
mov qword [rax], 0
add rsp, 0x38
ret

Function at 0x140037486
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140025b10
mov rcx, rax
mov rax, qword [0x1402c5da0]
mov qword [rcx], rax
lea rax, [0x1402baeee]
mov qword [rcx + 0x10], rax
movabs rax, 0xaeced7291dcdb70
movabs rdx, 0xaeced7291dcdb70
xor rax, rdx
mov qword [rcx + 0x18], rax
lea rax, [0x1402baeb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x772dcb76
lea rdx, [0x1402baeee]
lea r8, [0x1402baecc]
lea r9, [0x1402baed5]
call fcn.140025a43
nop
add rsp, 0x28
ret

Function at 0x14003750e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140025b10
mov rcx, rax
mov rax, qword [0x1402c5d90]
mov qword [rcx], rax
lea rax, [0x1402baec0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x1402baeb0]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x772dcb76
lea rdx, [0x1402baec0]
lea r8, [0x1402baecc]
lea r9, [0x1402baed5]
call fcn.140025a43
nop
add rsp, 0x28
ret

Function at 0x140037583
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.140017ba0
Function at 0x1400378bd
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1400883b0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003790e
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
add rsp, 0x38
ret
Function at 0x1400389bc
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x140038b08
mov rax, qword [rsp + 0x40]
movabs rdx, 0x945538063cbfb746
movabs rcx, 0x6baac7f9c34048b6
xor rdx, rcx
mov rcx, rax
and rcx, rdx
shl rcx, 1
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x140038ae7
mov rdx, qword [rsp + 0x38]
movabs rcx, 0xbc498ca269ed90d6
movabs rax, 0x43b6735d96126f26
xor rcx, rax
movabs rax, 0x448482e84c3989
movabs r8, 0xffbb7b7d17b3c676
xor rax, r8
xor rcx, rax
movabs rax, 0x224cae3d35cdb7ea
movabs r8, 0x224cae3d35cdb7ea
xor rax, r8
movabs r8, 0xb218f7862e7761e6
movabs r9, 0xb218f7862e7761e7
xor r8, r9
sub rax, r8
sub rcx, rax
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140038abc
jmp 0x140038ac6
call fcn.14000ee80
jmp 0x140038b08
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14001d8a6
jmp 0x140038b08
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.14001d8a6
mov rcx, qword [rsp + 0x40]
call fcn.14001d970
nop
add rsp, 0x48
ret
Function at 0x140039411
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14003950b
mov rax, qword [rsp + 0x40]
movabs rcx, 0x6e8074385752ece7
movabs rdx, 0x917f8bc7a8ad1317
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x1400394ea
mov rcx, qword [rsp + 0x38]
mov rax, rcx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov r8, rax
xor r8, rcx
xor r8, 0xffffffffffffffff
mov rdx, rcx
and rdx, r8
shl rdx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x1400394bf
jmp 0x1400394c9
call fcn.14000ee80
jmp 0x14003950b
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14001d8a6
jmp 0x14003950b
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.14001d8a6
mov rcx, qword [rsp + 0x40]
call fcn.14001d970
nop
add rsp, 0x48
ret

Function at 0x140039599
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140126f52
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x7d
xor cl, 0x7d
cmp al, cl
jne 0x1400395df
mov rcx, qword [rsp + 0x28]
call fcn.1401270b3
nop
add rsp, 0x38
ret
Function at 0x140039f70
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140125a59
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003a0df
mov eax, dword [0x1402a9858]
xor eax, dword [0x1402a985c]
add eax, 0x7e221252
mov r8d, 0xffffffff
xor r8d, 0x3c43c1b1
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x3c43c1b1
mov r8d, 0xe7036174
xor r8d, 0xdb40a0c5
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x9ce9222
xor ecx, 0xe62a77d8
xor edx, edx
div ecx
cmp eax, 0xc39f0003
je 0x14003a1f2
mov rcx, qword [rsp + 0x28]
mov edx, dword [0x1402a9860]
mov eax, dword [0x1402a9864]
xor eax, 0x31fb571e
xor edx, eax
mov eax, 0x7234d9a1
xor eax, 0x6add8170
and eax, edx
xor eax, 0xffffffff
add edx, 0x18e958d1
mov r8d, 0x7fe48955
xor r8d, 0x7fe48954
add edx, r8d
add edx, eax
mov eax, edx
and eax, 0x585ec761
xor eax, 0xffffffff
mov r8d, 0x2cd3c302
xor r8d, 0x748d0463
add edx, r8d
add edx, 1
add edx, eax
mov eax, edx
or eax, eax
mov r8d, 0x57cfe778
xor r8d, 0xa8301887
xor eax, r8d
mov r8d, 0xffffffff
xor r8d, 0xb5994a41
mov r9d, 0xffffffff
xor r9d, 0xb5994a41
and r8d, r9d
or eax, r8d
xor eax, 0xffffffff
xor edx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xb5994a41
and edx, r8d
mov r8d, 0x60898cf5
xor r8d, 0x9f76730a
xor eax, r8d
xor edx, 0xffffffff
and eax, edx
mov qword [rcx], 0
cmp eax, 0x32a2d9db
je 0x14003a1f2
jmp 0x14003a0df
mov eax, dword [str.C_MJ]
xor edx, edx
div dword [0x1402a986c]
mov ecx, eax
mov eax, 0x8c25c180
xor eax, 0xd8a31e6f
sub ecx, eax
mov eax, ecx
and eax, 0x8a7d52be
or ecx, 0x8a7d52be
add eax, ecx
sub eax, 0x81fd8e24
cmp eax, 0xb56f0dd3
jae 0x14003a1fb
mov ecx, dword [0x1402a9870]
mov eax, 0x273e4128
xor eax, 0xafe92292
xor ecx, eax
mov r8d, dword [0x1402a9874]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, 0x1e976d4b
xor edx, 0x56e4bf9b
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
mov edx, 0xbf9ee894
xor edx, 0xf7ed3a44
or ecx, edx
mov edx, 0xe599f06d
xor edx, 0x1a660f92
xor ecx, edx
xor eax, 0xffffffff
mov edx, 0x88270358
xor edx, 0x77d8fca7
xor ecx, edx
and eax, ecx
mov edx, 0x70779a39
xor edx, 0xad58fbd5
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, 0xdd2f61ec
add eax, ecx
mov edx, 0x4a4434f6
xor edx, 0x7f7cfb45
mov ecx, eax
xor ecx, edx
mov edx, 0x3374b875
xor edx, 0xcc8b478a
xor ecx, edx
and ecx, 0x3538cfb3
shl ecx, 1
mov edx, 0xe775b830
xor edx, 0xd24d7783
sub ecx, edx
sub eax, ecx
cmp eax, 0x56e7a51
jb 0x14003a11a
add rsp, 0x38
ret
xor byte [rbp - 0x2a], cl
clc
jmp 0x14003a00b
cmp al, 0xd
add byte [rbx - 0x17], cl
invalid
Function at 0x14003a748
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60

Function at 0x14003ac50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140127370
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003ad73
mov eax, dword [0x1402a98c8]
or eax, dword [0x1402a98cc]
or eax, 0xdbe079d1
add eax, 0xb5eb08b0
imul eax, eax, 0xe9b2a022
mov ecx, 0x9cd7b018
xor ecx, 0xe1686d6b
cmp eax, ecx
ja 0x14003ad78
mov rdx, qword [rsp + 0x28]
mov eax, dword [0x1402a98d0]
mov r8d, dword [0x1402a98d4]
xor r8d, 0x3a2b7d02
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, r8d
add ecx, eax
mov eax, 0x14f8e321
xor eax, 0x14f8e321
sub eax, ecx
imul ecx, eax, 0x1714d367
mov r8d, 0x93bbf75e
xor r8d, 0x6c4408a1
mov eax, ecx
xor eax, r8d
mov r8d, ecx
xor r8d, 0xffffffff
and eax, r8d
mov r8d, 0xffffffff
xor r8d, 0x925ce02d
mov r9d, 0xffffffff
xor r9d, 0x925ce02d
and r8d, r9d
xor eax, 0xffffffff
xor r8d, 0xffffffff
and eax, r8d
or ecx, 0x925ce02d
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x461d209f
xor ecx, 0xb9e2df60
xor eax, ecx
mov ecx, 0x6052d4d7
xor ecx, 0x4516f3d0
imul eax, ecx
mov ecx, 0x53b4e8fa
xor ecx, 0xfc82ab25
mov qword [rdx], 0
cmp eax, ecx
jbe 0x14003acb5
jmp 0x14003ad73
add rsp, 0x38
ret
ret
Function at 0x14003b520
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1402a9908]
mov edx, dword [0x1402a990c]
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov r9d, 0x34d78e77
xor r9d, 0xcb287188
mov r8d, edx
xor r8d, r9d
mov r9d, edx
xor r9d, 0xffffffff
and r8d, r9d
or eax, r8d
xor eax, 0xffffffff
or ecx, edx
mov edx, 0x698399d5
xor edx, 0x967c662a
xor ecx, edx
or eax, ecx
mov ecx, 0x45ac78e8
xor ecx, 0xba538717
xor eax, ecx
mov ecx, 0x2304f0ef
xor ecx, 0x2304f0ef
sub ecx, eax
mov eax, 0x36d4f9b4
xor eax, 0x36d4f9b4
mov edx, 0xb4748cc9
xor edx, 0xd618547f
sub eax, edx
add ecx, eax
mov eax, 0x9a32b920
xor eax, 0x9a32b920
sub eax, ecx
and eax, 0x6f124b74
mov edx, eax
xor edx, 0xffffffff
and edx, 0x48fd294a
mov r8d, 0x50f74e1c
xor r8d, 0x180a6756
mov ecx, 0x3ad714c6
xor ecx, 0xc528eb39
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x48fd294a
mov r8d, 0xc116bfb1
xor r8d, 0x89eb96fb
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0x92818644
ja 0x14003b737
mov eax, dword [0x1402a9910]
xor eax, 0x6e962758
or eax, dword [0x1402a9914]
or eax, 0x955efa9b
imul eax, eax, 0xe8aea46e
mov ecx, 0xef870de5
xor ecx, 0xadf76fa8
xor eax, ecx
mov dword [rsp + 0x38], eax
mov eax, 0xd97ad6a4
xor eax, 0x7031791d
mov dword [rsp + 0x34], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.1401284c0
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
cmp byte [rdx + 0x60], 0
sete dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
jae 0x14003b60a
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14003b697
jmp 0x14003b732
mov ecx, dword [0x1402a9918]
xor ecx, 0xe502f3ff
mov eax, dword [0x1402a991c]
xor eax, 0x1124fd91
or ecx, eax
xor ecx, 0xa3b73eed
mov eax, ecx
or eax, 0xad0041e8
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xad0041e8
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6fd5974b
xor ecx, 0x29cdae5c
xor edx, edx
div ecx
cmp eax, 0xd53ec4c9
je 0x14003b740
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1402a9920]
sub eax, dword [0x1402a9924]
sub eax, 0x68eaf51c
mov r8d, 0xd9b7cb2b
xor edx, edx
div r8d
add eax, 0xf3663d72
mov dword [rsp + 0x24], eax
call fcn.1401287f6
mov eax, dword [rsp + 0x24]
cmp eax, 0xecff41c3
je 0x14003b6ef
jmp 0x14003b732
add rsp, 0x48
ret
movabs ax, word [0x42fffffecae98fcc]
invalid
invalid
Function at 0x14003be90
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x77], al
je 0x14003bf05
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
call fcn.14002eeec
call fcn.14002ef97
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov dl, 0x94
xor dl, 0x94
mov byte [rax], dl
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rcx
cmp rax, 0
jle 0x14003bfc6
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x14003bfa2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x14003bfa9
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
je 0x14003bf2f
jmp 0x14003c12f
mov r8d, dword [0x1402a9948]
mov eax, dword [0x1402a994c]
xor eax, 0x7d6cdc09
sub r8d, 0xd94e8678
sub r8d, eax
add r8d, 0xd94e8678
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x989c88f3
mov edx, 0x85eedfd5
xor edx, 0x1d725726
mov ecx, 0x96da6590
xor ecx, 0x69259a6f
xor edx, ecx
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0xa23fbf97
and ecx, 0x989c88f3
and edx, 0xa23fbf97
or eax, r8d
or ecx, edx
xor eax, ecx
sub eax, 0xbae59ae1
sub eax, 0xf038c24
add eax, 0xbae59ae1
mov ecx, 0x796d7104
xor ecx, 0xf4a4c585
mov edx, 0x4c58d140
xor edx, 0xb3a72ebf
xor ecx, edx
add eax, ecx
add eax, 1
cmp eax, 0xb76ce500
je 0x14003c134
mov rdx, qword [rsp + 0x60]
mov r8b, byte [rsp + 0x3f]
mov ecx, dword [0x1402a9950]
mov r9d, dword [0x1402a9954]
mov r10d, ecx
xor r10d, 0xffffffff
mov eax, r9d
and eax, r10d
xor r9d, 0xffffffff
and ecx, r9d
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov r9d, 0xd4cb09bb
xor r9d, 0xe7506f09
and ecx, r9d
mov r9d, 0xffffffff
xor r9d, 0x339b66b2
and eax, r9d
sub eax, ecx
mov r9d, 0xffffffff
xor r9d, 0x1d0adf17
mov ecx, eax
and ecx, r9d
mov r9d, eax
xor r9d, 0x1d0adf17
add eax, r9d
sub eax, ecx
mov r9d, eax
xor r9d, 0xda124cf1
mov ecx, 0x1aec01fd
xor ecx, 0xe513fe02
xor r9d, ecx
mov ecx, 0x895b85af
xor ecx, 0x5349c95e
and ecx, r9d
shl ecx, 1
mov r9d, 0xe8043607
xor r9d, 0x32167af6
sub ecx, r9d
sub eax, ecx
mov ecx, 0xa44374b0
xor ecx, 0x528b17f9
mov byte [rdx], r8b
cmp eax, ecx
je 0x14003c134
jmp 0x14003c12f
add rsp, 0x78
ret
lahf
in eax, 0x9d
out dx, eax
jmp 0x14003c064
jmp 0x14003be90
Function at 0x14003c13d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x77], al
je 0x14003bf05
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
call fcn.14002eeec
call fcn.14002ef97
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov dl, 0x94
xor dl, 0x94
mov byte [rax], dl
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rcx
cmp rax, 0
jle 0x14003bfc6
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x14003bfa2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x14003bfa9
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
je 0x14003bf2f
jmp 0x14003c12f
mov r8d, dword [0x1402a9948]
mov eax, dword [0x1402a994c]
xor eax, 0x7d6cdc09
sub r8d, 0xd94e8678
sub r8d, eax
add r8d, 0xd94e8678
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x989c88f3
mov edx, 0x85eedfd5
xor edx, 0x1d725726
mov ecx, 0x96da6590
xor ecx, 0x69259a6f
xor edx, ecx
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0xa23fbf97
and ecx, 0x989c88f3
and edx, 0xa23fbf97
or eax, r8d
or ecx, edx
xor eax, ecx
sub eax, 0xbae59ae1
sub eax, 0xf038c24
add eax, 0xbae59ae1
mov ecx, 0x796d7104
xor ecx, 0xf4a4c585
mov edx, 0x4c58d140
xor edx, 0xb3a72ebf
xor ecx, edx
add eax, ecx
add eax, 1
cmp eax, 0xb76ce500
je 0x14003c134
mov rdx, qword [rsp + 0x60]
mov r8b, byte [rsp + 0x3f]
mov ecx, dword [0x1402a9950]
mov r9d, dword [0x1402a9954]
mov r10d, ecx
xor r10d, 0xffffffff
mov eax, r9d
and eax, r10d
xor r9d, 0xffffffff
and ecx, r9d
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov r9d, 0xd4cb09bb
xor r9d, 0xe7506f09
and ecx, r9d
mov r9d, 0xffffffff
xor r9d, 0x339b66b2
and eax, r9d
sub eax, ecx
mov r9d, 0xffffffff
xor r9d, 0x1d0adf17
mov ecx, eax
and ecx, r9d
mov r9d, eax
xor r9d, 0x1d0adf17
add eax, r9d
sub eax, ecx
mov r9d, eax
xor r9d, 0xda124cf1
mov ecx, 0x1aec01fd
xor ecx, 0xe513fe02
xor r9d, ecx
mov ecx, 0x895b85af
xor ecx, 0x5349c95e
and ecx, r9d
shl ecx, 1
mov r9d, 0xe8043607
xor r9d, 0x32167af6
sub ecx, r9d
sub eax, ecx
mov ecx, 0xa44374b0
xor ecx, 0x528b17f9
mov byte [rdx], r8b
cmp eax, ecx
je 0x14003c134
jmp 0x14003c12f
add rsp, 0x78
ret
lahf
in eax, 0x9d
out dx, eax
jmp 0x14003c064
jmp 0x14003be90
Function at 0x14003c142
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140070b0d
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14003c193
mov ecx, dword [0x1402d10b0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
add rsp, 0x38
ret
Function at 0x14003cc4e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.14003c1a0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14003c5d0

Function at 0x14003cc78
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx]
movabs rcx, 0x244f21a0e0f96285
movabs rdx, 0x244f21a0e0f96285
xor rcx, rdx
cmp rax, rcx
jle 0x14003ce5a
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax