joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003f30
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a1690]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140003f74
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140003f93
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.1400376d0
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140003fa0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a16a0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140003fe4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004003
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.1400376d0
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004010
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a16b0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004054
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004073
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.1400376d0
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004080
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a16c0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400040c4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400040e3
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.1400376d0
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x1400040f0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a16d0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004134
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004153
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.1400376d0
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x140004160
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400a16e0]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400041a4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400041c3
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.1400376d0
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x140027630
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rdx
mov rdi, rcx
lea rdx, [0x140052930]
xor ecx, ecx
call sub.KERNEL32.dll_AddVectoredExceptionHandler
mov dword [rbp - 0x28], 0x5000
lea rcx, [rbp - 0x28]
call sub.KERNEL32.dll_SetThreadStackGuarantee
call sub.KERNEL32.dll_GetCurrentThread
mov r8, qword [0x1400a0008]
lea rdx, [0x1400a8f28]
mov rcx, rax
call r8
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x14002769c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1400276b9
jmp 0x1400276b4
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1400276b9
call fcn.140027af0
mov rbx, rax
mov ecx, 8
mov edx, 0x28
call fcn.14007e4d0
mov r15, rax
mov r14, rdx
test rdx, rdx
je 0x14002777c
mov rax, qword [0x1400c5628]
movzx eax, byte [rax]
mov rcx, r14
mov rdx, r15
call fcn.140003a40
mov rcx, rax
test rcx, rcx
je 0x140027788
mov qword [rcx], 1
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x28], rbx
mov byte [rcx + 0x30], 0
call fcn.140027b60
test rax, rax
jne 0x140027795
mov rcx, rdi
call qword [rsi + 0x28]
movsxd rsi, eax
mov eax, dword [0x1400d8038]
cmp eax, 3
je 0x140027769
mov byte [rbp + 8], 1
lea rax, [rbp + 8]
mov qword [rbp - 0x58], rax
lea rax, str._R_n_
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d8038]
lea r9, [0x1400a6ed8]
lea r8, [rbp - 0x58]
xor edx, edx
call fcn.140055250
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rcx, r15
test rcx, rcx
jne 0x1400276fb
mov rcx, r15
mov rdx, r14
call fcn.1400794ff
ud2
mov rdi, rax
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x10], 0
mov byte [rbp + 0x14], 0
lea rax, str.fatal_runtime_error:_code_running_before_main_must_not_use_thread::current_n
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp + 0x10]
lea rdx, [rbp - 0x28]
call fcn.140035420
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x28]
call fcn.140009210
mov ecx, 7
int 0x29
ud2

Function at 0x140027af0
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400d8128]
nop word cs:[rax + rax]
cmp rax, 0xffffffffffffffff
je 0x140027b53
lea rsi, [rax + 1]
lock cmpxchg qword [0x1400d8128], rsi
jne 0x140027b10
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140027b43
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
jmp 0x140027b31
call fcn.140028410
int3
Function at 0x140027b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], rcx
mov ecx, dword [0x1400d81a0]
test ecx, ecx
je 0x140027b8e
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140027ba6
mov rax, qword [rbp]
jmp 0x140027c34
lea rcx, [0x1400d8188]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140027b85
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140027bcb
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140027be3
mov rcx, rax
mov rax, qword [rbp]
cmp qword [rax + 0x28], rcx
je 0x140027c13
jmp 0x140027c34
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140027bbc
mov rax, qword [rbp]
mov rsi, qword [rax + 0x28]
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140027bf9
dec ecx
jmp 0x140027c07
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [rbp]
mov rcx, qword [0x1400db038]
add rax, 0x10
mov ecx, dword [0x1400d81a0]
test ecx, ecx
je 0x140027c3b
dec ecx
mov rdx, rax
call sub.KERNEL32.dll_TlsSetValue
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
lea rcx, [0x1400d8188]
mov rsi, rax
call fcn.140055ba0
mov ecx, eax
mov rax, rsi
jmp 0x140027c2a
Function at 0x140027cd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
test rcx, rcx
jne 0x140027e17
mov ecx, dword [0x1400d81a0]
test ecx, ecx
je 0x140027dd8
dec ecx
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140027deb
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x140027e0a
mov ecx, 8
mov edx, 0x28
call fcn.14007e4d0
mov r14, rax
mov rbx, rdx
test rdx, rdx
je 0x140027d9c
mov rax, qword [0x1400c5628]
movzx eax, byte [rax]
mov rcx, rbx
mov rdx, r14
call fcn.140003a40
mov rsi, rax
test rsi, rsi
je 0x140027da4
mov qword [rsi], 1
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 2
mov qword [rsi + 0x28], rdi
mov byte [rsi + 0x30], 0
mov qword [rbp - 0x40], rsi
mov rax, qword [0x1400db038]
lock inc qword [rsi]
jle 0x140027e4f
mov ecx, dword [0x1400d81a0]
test ecx, ecx
je 0x140027daf
dec ecx
jmp 0x140027dbd
mov rsi, r14
test rsi, rsi
jne 0x140027d5a
mov rcx, r14
mov rdx, rbx
call fcn.1400794ff
lea rcx, [0x1400d8188]
call fcn.140055ba0
mov ecx, eax
add rsi, 0x10
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [rbp - 0x40]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [0x1400d8188]
call fcn.140055ba0
mov ecx, eax
jmp 0x140027cf8
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
jne 0x140027d23
call fcn.140027af0
mov rdi, rax
jmp 0x140027d23
cmp rcx, 1
je 0x140027e51
lea rax, [0x1400a5400]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x30], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rdx, str.std_src_threadcurrent.rs
lea rcx, [rbp - 0x40]
call fcn.1400871f0
ud2
mov dword [rbp - 0x10], 0
mov byte [rbp - 0xc], 0
lea rax, str.HT_n_
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rax, [rbp - 8]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.140035420
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x48]
call fcn.140009210
mov ecx, 7
int 0x29
ud2
Function at 0x140029c20
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d8], rcx
mov qword [rbp + 0x3e0], 0
mov qword [rbp + 0x3e8], 2
mov qword [rbp + 0x3f0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3d0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140029cb0
jmp 0x140029c9f
jae 0x140029d7a
cmp r8, 0x201
jae 0x140029cb0
mov r14d, 0x200
lea r15, [rbp - 0x50]
mov r12, r8
jmp 0x140029d16
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x140029cee
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3e0]
mov rdx, rbx
call fcn.140017fc0
mov rsi, qword [rbp + 0x3e0]
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x3d0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3f0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3d0]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x140029d3c
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140029de6
mov r8d, r13d
cmp r12, r8
jne 0x140029c90
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140029e19
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140029c9f
jmp 0x140029cb0
cmp r14, r8
jb 0x140029e33
lea rcx, [rbp + 0x3b0]
mov rdx, r15
call fcn.1400376d0
movups xmm0, xmmword [rbp + 0x3b0]
movups xmm1, xmmword [rbp + 0x3c0]
mov rsi, qword [rbp + 0x3d8]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3e0]
test rdx, rdx
je 0x140029dcf
mov rcx, qword [rbp + 0x3e8]
add rdx, rdx
mov r8d, 2
call fcn.140003a50
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3e0]
test rdx, rdx
jne 0x140029dba
jmp 0x140029dcf
lea rcx, str.internal_error:_entered_unreachable_codepF_n_
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140087270
jmp 0x140029e48
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14008da30
ud2
Function at 0x140031910
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, r8
mov rbx, rdx
mov rax, qword [rcx]
mov rsi, qword [rax]
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x14003195f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
je 0x14003197a
mov rax, qword [rsi]
cmp r14, rax
jne 0x14003198a
mov eax, dword [rsi + 8]
cmp eax, 0xffffffff
je 0x140031a13
inc eax
mov dword [rsi + 8], eax
jmp 0x14003199f
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
jne 0x140031944
call fcn.140027af0
mov r14, rax
mov rax, qword [rsi]
cmp r14, rax
je 0x14003194c
mov cl, 1
xor eax, eax
lock cmpxchg byte [rsi + 0xc], cl
jne 0x1400319fa
mov qword [rsi], r14
mov dword [rsi + 8], 1
cmp qword [rsi + 0x10], 0
jne 0x140031a05
mov qword [rsi + 0x10], 0xffffffffffffffff
lea rcx, [rsi + 0x18]
mov rdx, rbx
mov r8, rdi
call fcn.14002e9e0
inc qword [rsi + 0x10]
dec dword [rsi + 8]
jne 0x1400319ef
mov qword [rsi], 0
xor ecx, ecx
xchg byte [rsi + 0xc], cl
cmp cl, 2
jne 0x1400319ef
add rsi, 0xc
mov rcx, rsi
mov rsi, rax
mov rdi, rdx
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rdx, rdi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [rsi + 0xc]
call fcn.140055040
jmp 0x140031995
lea rcx, [0x1400a62e8]
call fcn.140083fa0
ud2
lea rcx, [0x1400a7050]
lea r8, str.vp_n_
mov edx, 0x26
call fcn.140087080
mov rdi, rax
inc qword [rsi + 0x10]
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
mov rdi, rax
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
int3
Function at 0x140031a60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rbx, r8
mov rdi, rdx
mov rax, qword [rcx]
mov rsi, qword [rax]
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140031ab3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
je 0x140031ace
mov rax, qword [rsi]
cmp r14, rax
jne 0x140031ade
mov r9d, dword [rsi + 8]
cmp r9d, 0xffffffff
je 0x140031bb7
inc r9d
mov dword [rsi + 8], r9d
jmp 0x140031afd
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
jne 0x140031a94
call fcn.140027af0
mov r14, rax
mov rax, qword [rsi]
cmp r14, rax
je 0x140031a9c
mov cl, 1
xor eax, eax
lock cmpxchg byte [rsi + 0xc], cl
jne 0x140031b9b
mov qword [rsi], r14
mov dword [rsi + 8], 1
mov r9d, 1
cmp qword [rsi + 0x10], 0
jne 0x140031ba9
mov qword [rsi + 0x10], 0xffffffffffffffff
lea rcx, [rsi + 0x18]
shl rbx, 4
xor r10d, r10d
xor eax, eax
nop dword [rax]
cmp rbx, rax
je 0x140031b56
mov r8d, dword [rdi + rax]
add rax, 0x10
test r8, r8
je 0x140031b20
mov rdx, qword [rdi + rax - 8]
call fcn.14002e9e0
mov r10, qword [rsi + 0x10]
inc r10
mov r9d, dword [rsi + 8]
mov qword [rsi + 0x10], r10
dec r9d
mov dword [rsi + 8], r9d
jne 0x140031b90
jmp 0x140031b67
xor edx, edx
xor eax, eax
mov qword [rsi + 0x10], r10
dec r9d
mov dword [rsi + 8], r9d
jne 0x140031b90
mov qword [rsi], 0
xor ecx, ecx
xchg byte [rsi + 0xc], cl
cmp cl, 2
jne 0x140031b90
add rsi, 0xc
mov rcx, rsi
mov rsi, rdx
mov rdi, rax
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rax, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [rsi + 0xc]
call fcn.140055040
jmp 0x140031aed
lea rcx, [0x1400a6300]
call fcn.140083fa0
ud2
lea rcx, [0x1400a7050]
lea r8, str.vp_n_
mov edx, 0x26
call fcn.140087080
mov rdi, rax
inc qword [rsi + 0x10]
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
mov rdi, rax
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
int3
Function at 0x140031c00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, qword [rcx]
mov rsi, qword [rax]
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140031c46
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x140031c61
mov rax, qword [rsi]
cmp rdi, rax
jne 0x140031c71
mov eax, dword [rsi + 8]
cmp eax, 0xffffffff
je 0x140031ceb
inc eax
mov dword [rsi + 8], eax
jmp 0x140031c86
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
jne 0x140031c2b
call fcn.140027af0
mov rdi, rax
mov rax, qword [rsi]
cmp rdi, rax
je 0x140031c33
mov cl, 1
xor eax, eax
lock cmpxchg byte [rsi + 0xc], cl
jne 0x140031cd2
mov qword [rsi], rdi
mov dword [rsi + 8], 1
cmp qword [rsi + 0x10], 0
jne 0x140031cdd
mov qword [rsi + 0x10], 0xffffffffffffffff
lea rcx, [rsi + 0x18]
call fcn.14002e450
inc qword [rsi + 0x10]
dec dword [rsi + 8]
jne 0x140031cca
mov qword [rsi], 0
xor ecx, ecx
xchg byte [rsi + 0xc], cl
cmp cl, 2
jne 0x140031cca
add rsi, 0xc
mov rcx, rsi
mov rsi, rax
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rax, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsi + 0xc]
call fcn.140055040
jmp 0x140031c7c
lea rcx, [0x1400a6318]
call fcn.140083fa0
ud2
lea rcx, [0x1400a7050]
lea r8, str.vp_n_
mov edx, 0x26
call fcn.140087080
mov rdi, rax
inc qword [rsi + 0x10]
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
mov rdi, rax
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
int3

Function at 0x140031d30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rdi, r8
mov rbx, rdx
mov rax, qword [rcx]
mov rsi, qword [rax]
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140031d7f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
je 0x140031d9a
mov rax, qword [rsi]
cmp r14, rax
jne 0x140031daa
mov eax, dword [rsi + 8]
cmp eax, 0xffffffff
je 0x140031e10
inc eax
mov dword [rsi + 8], eax
jmp 0x140031dbf
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
jne 0x140031d64
call fcn.140027af0
mov r14, rax
mov rax, qword [rsi]
cmp r14, rax
je 0x140031d6c
mov cl, 1
xor eax, eax
lock cmpxchg byte [rsi + 0xc], cl
jne 0x140031e05
mov qword [rsi], r14
mov dword [rsi + 8], 1
mov qword [rbp - 8], rsi
lea rcx, [rbp - 8]
mov rdx, rbx
mov r8, rdi
call fcn.140032290
dec dword [rsi + 8]
jne 0x140031dfa
mov qword [rsi], 0
xor ecx, ecx
xchg byte [rsi + 0xc], cl
cmp cl, 2
jne 0x140031dfa
add rsi, 0xc
mov rcx, rsi
mov rsi, rax
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [rsi + 0xc]
call fcn.140055040
jmp 0x140031db5
lea rcx, [0x1400a7050]
lea r8, str.vp_n_
mov edx, 0x26
call fcn.140087080
mov rdi, rax
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
int3
Function at 0x140031e40
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rdi, r8
mov rbx, rdx
mov rax, qword [rcx]
mov rsi, qword [rax]
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140031e8f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
je 0x140031eaa
mov rax, qword [rsi]
cmp r14, rax
jne 0x140031eba
mov eax, dword [rsi + 8]
cmp eax, 0xffffffff
je 0x140031f20
inc eax
mov dword [rsi + 8], eax
jmp 0x140031ecf
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov r14, rax
test rax, rax
jne 0x140031e74
call fcn.140027af0
mov r14, rax
mov rax, qword [rsi]
cmp r14, rax
je 0x140031e7c
mov cl, 1
xor eax, eax
lock cmpxchg byte [rsi + 0xc], cl
jne 0x140031f15
mov qword [rsi], r14
mov dword [rsi + 8], 1
mov qword [rbp - 8], rsi
lea rcx, [rbp - 8]
mov rdx, rbx
mov r8, rdi
call fcn.140032450
dec dword [rsi + 8]
jne 0x140031f0a
mov qword [rsi], 0
xor ecx, ecx
xchg byte [rsi + 0xc], cl
cmp cl, 2
jne 0x140031f0a
add rsi, 0xc
mov rcx, rsi
mov rsi, rax
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [rsi + 0xc]
call fcn.140055040
jmp 0x140031ec5
lea rcx, [0x1400a7050]
lea r8, str.vp_n_
mov edx, 0x26
call fcn.140087080
mov rdi, rax
mov rcx, rsi
call fcn.140007af0
mov rcx, rdi
call fcn.14009de50
int3
Function at 0x140031f50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov rsi, rdx
mov rax, qword [rcx]
mov rbx, qword [rax]
mov ecx, dword [0x1400d8180]
test ecx, ecx
je 0x140031f9c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
je 0x140031fb7
mov rax, qword [rbx]
cmp rdi, rax
jne 0x140031fc7
mov eax, dword [rbx + 8]
cmp eax, 0xffffffff
je 0x1400320b8
inc eax
mov dword [rbx + 8], eax
jmp 0x140031fe0
lea rcx, [0x1400d8168]
call fcn.140055ba0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
test rax, rax
jne 0x140031f81
call fcn.140027af0
mov rdi, rax
mov rax, qword [rbx]
cmp rdi, rax
je 0x140031f89
mov cl, 1
xor eax, eax
lock cmpxchg byte [rbx + 0xc], cl
jne 0x1400320aa
mov qword [rbx], rdi
mov dword [rbx + 8], 1
mov qword [rbp - 8], rbx
lea rax, [rbp - 8]
mov qword [rbp - 0x18], rax
lea rdi, [rbp - 0x10]
mov qword [rbp - 0x10], 0
lea rdx, [0x1400a5068]
lea rcx, [rbp - 0x18]
mov r8, rsi
call fcn.14008ad20
mov ecx, eax
mov rax, qword [rbp - 0x10]
test cl, cl
je 0x140032029
test rax, rax
je 0x1400320d0
mov rcx, qword [rbp - 8]
dec dword [rcx + 8]
jne 0x14003209f
jmp 0x14003207f
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x140032074
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov r14, qword [rax + 7]
mov rax, qword [r14]
test rax, rax
je 0x14003204c
mov rcx, rdi
call rax
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140032061
mov r8, qword [r14 + 0x10]
mov rcx, rdi
call fcn.140003a50
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
call fcn.140003a50
xor eax, eax
mov rcx, qword [rbp - 8]
dec dword [rcx + 8]
jne 0x14003209f
mov qword [rcx], 0
xor edx, edx
xchg byte [rcx + 0xc], dl
cmp dl, 2
jne 0x14003209f
add rcx, 0xc
mov rsi, rax
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [rbx + 0xc]
call fcn.140055040
jmp 0x140031fd6
lea rcx, [0x1400a7050]
lea r8, str.vp_n_
mov edx, 0x26
call fcn.140087080
lea rax, str.Xf_n_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 1
mov qword [rbp - 0x38], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
lea rdx, [0x1400a66c0]
lea rcx, [rbp - 0x48]
call fcn.1400871f0
ud2