joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6a2c
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140e2f620]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [rax + 0x20]

Function at 0x1400d6a50
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140e2f620]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [rax + 0xc8]

Function at 0x1400d6a78
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, ecx
mov ecx, dword [0x140e2f620]
mov ebx, r9d
mov edi, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add r15d, dword [rax + 0x100]
add ebp, dword [rax + 0x104]
mov rsi, rax
test edi, edi
jns 0x1400d6ac5
add r15d, edi
neg edi
test ebx, ebx
jns 0x1400d6acd
add ebp, ebx
neg ebx
mov r14d, dword [rsp + 0x80]
lea eax, [r14 + r14]
cmp eax, edi
jle 0x1400d6ae7
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov r14d, eax
mov r12d, dword [rsp + 0x88]
lea ecx, [r12 + r12]
cmp ecx, ebx
jle 0x1400d6b01
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov r12d, eax
mov edx, dword [rsp + 0x90]
cmp edx, dword [rsi + 0x120]
je 0x1400d6b1f
mov rcx, rsi
mov dword [rsi + 0x120], edx
call qword [rsi + pe_nt_image_headers64]
mov dword [rsp + 0x90], r12d
mov r9d, edi
mov r8d, ebp
mov edx, r15d
mov rcx, rsi
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0x80], ebx
mov rax, qword [rsi + 0x10]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
jmp rax

Function at 0x1400d6b68
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov r15d, ecx
mov ecx, dword [0x140e2f620]
mov edi, r9d
mov rsi, r8
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp edi, dword [rax + 0x120]
je 0x1400d6bb5
mov edx, edi
mov rcx, rax
mov dword [rax + 0x120], edi
call qword [rax + pe_nt_image_headers64]
mov edx, dword [rsp + 0x50]
cmp edx, dword [rbx + 0x124]
je 0x1400d6bcc
mov rcx, rbx
mov dword [rbx + 0x124], edx
call qword [rbx]
mov r8d, dword [rbx + 0x104]
mov edx, dword [rbx + 0x100]
mov r9, rsi
add r8d, r14d
add edx, r15d
mov rcx, rbx
mov rax, qword [rbx + 0x60]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
jmp rax

Function at 0x1400d6c08
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140e2f620], eax
add rsp, 0x28
ret
Function at 0x1400d81bc
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140db38f8]
mov edx, 8
mov r8d, 0x1c0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140e2f620]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x140e2f640], rbx
and dword [rbx + 0x11c], 0
or eax, 0xffffffff
mov dword [rbx + 0x118], 0xffffff
mov dword [rbx + 0xe8], 1
mov dword [rbx + 0x120], eax
mov dword [rbx + 0x124], eax
lea rax, [0x1400d6dc4]
mov qword [rbx], rax
lea rax, [0x1400d6df4]
mov dword [rbx + 0xec], 7
mov qword [rbx + 8], rax
lea rax, [0x1400d7f04]
mov qword [rbx + 0x10], rax
lea rax, [0x1400d6e9c]
mov qword [rbx + 0x18], rax
lea rax, [0x1400d7570]
mov qword [rbx + 0x20], rax
lea rax, [0x1400d7500]
mov qword [rbx + 0x28], rax
lea rax, [0x1400d7548]
mov qword [rbx + 0x30], rax
lea rax, [0x1400d755c]
mov qword [rbx + 0x38], rax
lea rax, [fcn.1400d75e4]
mov qword [rbx + 0x40], rax
lea rax, [0x1400d70f8]
mov qword [rbx + 0x48], rax
lea rax, [fcn.1400d7110]
mov qword [rbx + 0x50], rax
lea rax, [0x1400d6f94]
mov qword [rbx + 0x58], rax
lea rax, [0x1400d7468]
mov qword [rbx + 0x60], rax
lea rax, [0x1400d737c]
mov qword [rbx + 0x68], rax
lea rax, [0x1400d7680]
mov qword [rbx + 0x70], rax
lea rax, [0x1400d77b8]
mov qword [rbx + 0x78], rax
lea rax, [0x1400d78a4]
mov qword [rbx + 0x80], rax
lea rax, [0x1400d795c]
mov qword [rbx + 0x88], rax
lea rax, [0x1400d7ab4]
mov qword [rbx + 0x90], rax
lea rax, [0x1400d7b34]
mov qword [rbx + 0x98], rax
lea rax, [0x1400d7c28]
mov qword [rbx + 0xa0], rax
lea rax, [0x1400d7e14]
mov qword [rbx + 0xa8], rax
lea rax, [0x1400d7f8c]
mov qword [rbx + 0xb0], rax
lea rax, [0x1400d8074]
mov qword [rbx + 0xb8], rax
lea rax, [0x1400d8110]
mov qword [rbx + 0xc0], rax
lea rax, [0x1400d8164]
mov qword [rbx + 0xc8], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400deae0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.1400e2550
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14013f8d4
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x1400deb10
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400e2690

Function at 0x1400decd0
Capabilities:
Get thread local storage value

Disassembly:
mov r10, rcx
test rcx, rcx
je 0x1400ded01
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400dece0
mov ecx, 1
mov r9d, r8d
sub ecx, edx
add eax, ecx
mov rcx, r10
mov r8d, eax
jmp fcn.1400ded10
mov ecx, r8d
jmp fcn.1400e29b0

Function at 0x1400deff0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x1400df154
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x140163f68]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x1400df120
cmp word [r14 + 2], di
je 0x1400df120
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x1400df060
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x1400df08d
cmp word [rbx], bp
je 0x1400df08d
add rbx, 2
jmp 0x1400df070
inc edi
cmp edi, r12d
je 0x1400df0a2
cmp word [rbx], bp
je 0x1400df0ab
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x1400df070
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.1400e29f0
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x1400df0da
mov ecx, r13d
call fcn.1400e2b10
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.1400e2550
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x1400df0fe
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x1400df12d
test ax, ax
jne 0x1400df140
inc edi
cmp edi, edx
je 0x1400df146
test ax, ax
je 0x1400df0ae
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x1400df120
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x1400df0ae
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.1400e29b0
Function at 0x1400e0c70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140e2ea60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x1400e0cf1
mov r8, qword [0x140e2ea58]
mov rcx, qword [0x140db38f8]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140e2ea60]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x140e2ea50]
jmp 0x1400e0cdd
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x1400e0cda
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400e0cc8
lea rcx, [0x1400e0bd4]
mov rdx, rdi
call fcn.14013fab0
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e0d08
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x1400e0d32
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x140e2ea58]
test rcx, rcx
jne 0x1400e0d75
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x140db38f8]
movsxd r8, ebx
mov edx, 8
mov dword [0x140e2ea60], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140e2ea60]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140e2ea58]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x140e2ea58], rcx
mov ecx, dword [0x140e2ea60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x140e2ea58]
mov rcx, qword [0x140db38f8]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x140e2ea60]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x1400e0dc9
test rbp, rbp
je 0x1400e0df0
lea rcx, [0x140e2ea50]
mov edx, 0x28
call fcn.1400e18e4
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x1400e0df0
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e1950
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140e2ead0], 0
jne 0x1400e1975
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140e2ead0], 1
mov dword [0x140e2ead4], eax
mov rcx, qword [0x140db38f8]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140e2ead4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x1400e1b30
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140e2ead0], 0
mov ebx, ecx
jne 0x1400e1b54
call fcn.1400e1950
mov ecx, dword [0x140e2ead4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x1400e1b7c
call fcn.1400e1950
mov ecx, dword [0x140e2ead4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x1400e1b90
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x1400e1bd0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e1b30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140e2ead0], 0
jne 0x1400e1975
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140e2ead0], 1
mov dword [0x140e2ead4], eax
mov rcx, qword [0x140db38f8]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140e2ead4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x1400e1b30
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140e2ead0], 0
mov ebx, ecx
jne 0x1400e1b54
call fcn.1400e1950
mov ecx, dword [0x140e2ead4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x1400e1b7c
call fcn.1400e1950
mov ecx, dword [0x140e2ead4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x1400e1b90
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x1400e1bd0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e1c30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140e2ead0], 0
mov rbx, rcx
jne 0x1400e1c47
call fcn.1400e1950
mov ecx, dword [0x140e2ead4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
test rax, rax
jne 0x1400e1c6f
call fcn.1400e1950
mov ecx, dword [0x140e2ead4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
movsxd r8, dword [r9]
movsxd rdx, dword [r9 + 4]
mov eax, 0x10
mov r10d, dword [r9 + r8*4 + 0x4c]
mov r11d, dword [r9 + r8*4 + 8]
ror r10d, 0xd
add r10d, dword [r9 + rdx*4 + 0x4c]
ror r11d, 5
add r11d, dword [r9 + rdx*4 + 8]
mov dword [r9 + r8*4 + 8], r10d
mov dword [r9 + r8*4 + 0x4c], r11d
dec r8d
mov ecx, r11d
cmovs r8d, eax
dec edx
cmovs edx, eax
mov dword [r9], r8d
mov dword [r9 + 4], edx
inc rbx
je 0x1400e1ce8
mov edx, r10d
mov r8, rbx
mov eax, ebx
shr r8, 0x20
imul rax, rdx
shr rax, 0x20
imul rcx, r8
imul rdx, r8
shr rcx, 0x20
add rax, rcx
add rax, rdx
add rsp, 0x20
pop rbx
ret
mov eax, r10d
shl rax, 0x20
and rax, rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1400e1e10
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x140daeec8], 0xffffffff
jne 0x1400e1e3f
call fcn.1400e24e0
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1400e1dc0]
call fcn.14013fab0
jmp 0x1400e1e70
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400e1e70
call fcn.1400e2e50
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1400e1dc0]
call fcn.14013fab0
add rsp, 0x28
ret

Function at 0x1400e1e80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 0x10]
mov qword [rcx + rax*8 + 0x18], rdx
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
inc rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
add rsp, 0x38
ret

Function at 0x1400e1ee0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + rax*8 + 0x18]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1400e1f50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rax*8 + 0x18]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rsp, 0x38
ret

Function at 0x1400e1fc0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rax*8 + 0x18]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
add rsp, 0x38
ret
Function at 0x1400e2030
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
dec rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x338], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x20]
add rcx, qword [rdx + rax*8 + 0x18]
mov rax, rcx
add rsp, 0x38
ret

Function at 0x1400e2130
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x1400e2196
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x140e2f940]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x1400e21c1
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140e2f940]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.1400e2a90
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1400e2300
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1400e23c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x38
ret

Function at 0x1400e24e0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x140e2f940], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140daeec8], eax
call fcn.1400e2e50
add rsp, 0x28
ret
Function at 0x1400e2550
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x1400e2580
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x1400e25f2
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140e2f940]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x1400e2650
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x1400e2650
cmp dword [rsp + 0x20], 0x100000
jge 0x1400e2613
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140e2f940]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1400e2690
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1400e29b0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140daeec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret