joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140135780
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebp, r9d
mov rsi, r8
mov r14, rdx
mov rbx, rcx
mov ecx, dword [0x1403aadb8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401357c4
mov rdi, rax
cmp byte [rax + 8], 0
jne 0x1401357d5
mov rcx, rdi
call fcn.1400726b0
mov rdi, rax
test rax, rax
jne 0x1401357d5
call fcn.1401a2410
mov rdi, rax
test rax, rax
je 0x14013586f
movzx r15d, byte [rsp + 0x88]
movzx r12d, byte [rsp + 0x80]
test r15b, r15b
je 0x1401357fb
jmp 0x140135824
mov rcx, qword [r14 + 8]
xor edx, edx
call fcn.1401a29a0
mov rax, qword [rbx + 0x3a0]
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x28], 0
jle 0x140135813
cmp qword [rcx + 0x20], 0
jne 0x1401357f0
mov rax, qword [rax + 0x10]
cmp dword [rax + 0x28], 0
jle 0x140135824
cmp qword [rax + 0x20], 0
jne 0x1401357f0
test r12b, r12b
je 0x14013583f
mov rcx, qword [rbx + 0x398]
test rsi, rsi
je 0x140135876
mov rdx, rsi
call fcn.1401dbef0
jmp 0x140135880
mov rcx, qword [rbx + 0x398]
mov edx, ebp
call fcn.1401dbe90
mov rsi, rax
mov qword [rax + 0x50], 0
mov qword [rax + 0x770], rbx
mov qword [rax + 0x88], 0
jmp 0x140135988
xor esi, esi
jmp 0x1401359d3
mov edx, ebp
call fcn.1401dbe90
mov rsi, rax
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x770], rbx
mov qword [rsi + 0x88], 0
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x140135988
test r12b, r12b
je 0x140135988
mov rax, qword [rax + 0x410]
mov rax, qword [rax + 7]
mov qword [rsi + 0x690], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x418]
mov rax, qword [rax + 7]
mov qword [rsi + 0x698], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x420]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6a0], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x428]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6a8], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x430]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6b0], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x438]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6b8], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x440]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6c0], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x448]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6c8], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x450]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6d0], rax
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x458]
mov rax, qword [rax + 7]
mov qword [rsi + 0x6d8], rax
mov rax, qword [rbx + 0x3b8]
mov qword [rsi + 0x90], rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x708], 0
movzx eax, r15b
shl rax, 5
xchg qword [rsi + 0x710], rax
mov qword [rsi + 0xb8], 3
mov qword [rdi + 0x60], rsi
mov rcx, rsi
call fcn.1401a24f0
mov rcx, rdi
call fcn.1401a2280
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14013c400
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x14], 0
jne 0x14013c427
call fcn.140279b2c
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14013c47c
mov rcx, qword [rdi + 0x770]
lea rsi, [0x1403af4a8]
test rcx, rcx
je 0x14013c4c5
mov rdx, qword [0x1403af498]
test rdx, rdx
je 0x14013c4a7
mov rax, qword [rcx + 0x380]
mov rcx, qword [rax + 8]
call fcn.14027c7d8
test rax, rax
jne 0x14013c4bd
jmp 0x14013c4c5
mov ecx, dword [0x1403aadb8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14013c4a0
cmp byte [rax + 8], 0
jne 0x14013c4c1
mov rcx, rax
call fcn.1400726b0
test rax, rax
jne 0x14013c4c1
call fcn.1401a2410
jmp 0x14013c4c1
mov rax, qword [0x1403af210]
cmp qword [rax + 0x58], rcx
je 0x14013c4bd
call fcn.140135e90
test al, al
jne 0x14013c4c5
mov rax, qword [rdi + 0x10]
mov rsi, qword [rax + 0x40]
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1401528d0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 7]
mov rax, rdx
sar rax, 1
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
je 0x140152902
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5f000
jne 0x140152968
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
jne 0x14015291c
add rcx, 0xf
jmp 0x140152920
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x1401529cb
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
inc rcx
dec rax
cmp rax, 1
ja 0x140152940
jmp 0x1401529c7
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5e000
jne 0x140152982
add rcx, 0xf
jmp 0x140152986
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x1401529cb
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, word [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
add rcx, 2
dec rax
cmp rax, 1
ja 0x1401529a0
lea r8d, [rdx + rdx*8]
mov eax, r8d
shr eax, 0xb
xor eax, r8d
mov ecx, eax
shl ecx, 0xf
add ecx, eax
and ecx, 0x3fffffff
mov eax, 1
cmovne eax, ecx
ret
Function at 0x14017f360
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x14017f378
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14017f37f
xor r8d, r8d
jmp 0x14017f409
xor eax, eax
jmp 0x14017f438
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x14017f390
test rax, rax
je 0x14017f434
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x14017f410
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov edx, ecx
shl edx, 0xf
add edx, ecx
and edx, 0x3fffffff
mov eax, 1
cmovne eax, edx
ret

Function at 0x14017f460
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x14017f478
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14017f47f
xor r8d, r8d
jmp 0x14017f509
xor eax, eax
jmp 0x14017f538
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x14017f490
test rax, rax
je 0x14017f534
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x14017f510
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov edx, ecx
shl edx, 0xf
add edx, ecx
and edx, 0x3fffffff
mov eax, 1
cmovne eax, edx
ret
Function at 0x1401a2640
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1403acd78]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0x18
call fcn.140279780
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x1401a2570]
xor esi, esi
xor ecx, ecx
mov edx, 0x100000
mov r9, rax
call fcn.140298a10
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x1401a26b1
call fcn.14028bed8
mov esi, dword [rax]
jmp 0x1401a26ba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140279500
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401a26e0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov rax, qword [0x1403acd78]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1401a2725
mov esi, eax
mov ecx, eax
mov rdx, rdi
call fcn.1401a2760
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140279500
mov eax, esi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsAlloc_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.140023590
int3

Function at 0x1401a28f0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1403acd78]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401a2920
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140279500
nop
add rsp, 0x38
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsSetValue_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.140023590
int3
Function at 0x1401a6390
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403acd78]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov byte [r8 + 8], 0
mov qword [rcx + 0x30], r8
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x14], 0
jne 0x1401a63ee
call fcn.140279b2c
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rdi + 0x20], rax
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.1401b5380
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x128]
mov dword [rsp + 0xa6], 0
mov byte [rsp + 0xaa], 0
mov dword [rsp + 0xac], 0
mov byte [rsp + 0xb0], 0
mov dword [rsp + 0xb2], 0
mov byte [rsp + 0xb6], 0
mov qword [rsp + 0xb8], 0
mov byte [rsp + 0xc0], 0
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x9d], 0
mov qword [rsp + 0xc8], WSAGetLastError
mov dword [rsp + 0xd0], 0xffffffff
mov rax, qword [r14]
lea r8, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x30]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401a6539
lea r14, [rsp + 0x60]
nop dword [rax]
lea rcx, [rax - 1]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdx + rax*8 - 8]
mov rax, qword [rcx]
mov rdx, rdi
mov r8, r14
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x1401a6510
cmp byte [rdi + 0x39], 0
je 0x1401a6551
mov rcx, 0xffffffffffffffff
lea rdx, str.RegExp_too_big
xor eax, eax
jmp 0x1401a656e
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1401b7030
mov rcx, qword [rsp + 0x28]
call fcn.1401a65b0
mov rcx, qword [rdi + 8]
xor edx, edx
mov qword [rsi], rdx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140279500
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401a77b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15, qword [rsp + 0xb0]
cmp qword [r15], 0
je 0x1401a7893
mov rsi, r9
mov r12, r8
mov r14, rdx
mov rax, qword [rcx]
cmp dword [r9 + 0x70], 0
sete byte [rsp + 0x20]
xor r13d, r13d
mov rdx, r15
mov r8, r14
xor r9d, r9d
call qword [rax + 0x20]
cmp byte [r15 + 0x28], 0
jne 0x1401a7896
movzx eax, byte [r14 + 0x38]
test al, al
mov ecx, 0xffff
mov edx, 0xff
cmove edx, ecx
mov qword [r15 + 0x20], 0
mov r9, qword [r15]
xor r13d, r13d
test r9, r9
jle 0x1401a7896
xor ecx, ecx
test al, al
sete cl
lea r8, [r15 + 0xa]
lea r10d, [rcx*8 + 8]
mov r11d, 1
mov qword [rsp + 0x30], r9
mov rax, r9
xor ebx, ebx
xor ebp, ebp
xor edi, edi
movzx r9d, word [r8 - 2]
test r9b, r9b
movzx edi, dil
cmovne edi, r11d
and r9d, edx
mov ecx, r13d
shl r9d, cl
or ebp, r9d
mov dword [r15 + 0x20], ebp
movzx r9d, word [r8]
and r9d, edx
shl r9d, cl
or ebx, r9d
mov dword [r15 + 0x24], ebx
add r8, 6
add r13d, r10d
dec rax
jne 0x1401a7850
test dil, 1
jne 0x1401a78aa
xor r13d, r13d
mov eax, r13d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [r14 + 0x30]
mov rcx, qword [rsp + 0x30]
cmp qword [rsi + 0x28], rcx
je 0x1401a78e3
movzx r9d, byte [rsp + 0xa0]
xor r9b, 1
mov r8, qword [r12 + 0x10]
mov rdx, qword [rsi]
mov rax, qword [r13]
mov qword [rsp + 0x20], rcx
mov rcx, r13
call qword [rax + 0x100]
mov rcx, qword [r15]
cmp rcx, 2
je 0x1401a7907
cmp rcx, 1
jne 0x1401a7914
cmp byte [r14 + 0x38], 0
mov eax, 0xffff
mov ecx, 0xff
cmove ecx, eax
and ebp, ecx
cmp ebp, ecx
jmp 0x1401a7917
cmp byte [r14 + 0x38], 0
je 0x1401a7914
cmp bp, 0xffff
jmp 0x1401a7917
cmp ebp, 0xffffffff
setne al
movzx ecx, byte [rsp + 0xb8]
test cl, cl
je 0x1401a7944
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x1401a7961
mov r8d, ebp
mov r9, qword [rsp + 0xa8]
call qword [r10 + 0x48]
jmp 0x1401a7979
mov r9, qword [rsi + 0x10]
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x1401a796f
mov r8d, ebp
call qword [r10 + 0x88]
jmp 0x1401a7979
mov r8, qword [rsp + 0xa8]
call qword [r10 + 0x40]
jmp 0x1401a7979
mov r8, r9
call qword [r10 + 0x80]
mov r13b, 1
jmp 0x1401a7896
Function at 0x1401a8950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1403acd78]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x50], 0
movzx eax, byte [rsp + 0xd0]
setne bpl
or bpl, al
mov rax, qword [rcx + 0x48]
mov r12, qword [rax]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov byte [rsp + 0x20], bpl
call qword [rax + 0x20]
cmp r12, 2
jl 0x1401a8b00
lea r13, [rsp + 0x50]
lea rax, [rsi + rsi*2]
add rax, rax
add rax, 0xc
mov qword [rsp + 0x28], rax
mov r15d, 1
jmp 0x1401a89f6
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmm2, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
inc r15
cmp r15, r12
je 0x1401a8b00
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
mov dword [rsp + 0x3e], 0
mov byte [rsp + 0x42], 0
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x4a], 0
mov byte [rsp + 0x4e], 0
mov byte [r13 + 8], 0
mov qword [r13], 0
mov rax, qword [r14 + 0x48]
mov rax, qword [rax + 0x10]
mov rcx, r15
shl rcx, 4
mov rcx, qword [rax + rcx]
mov rax, qword [rcx]
mov byte [rsp + 0x20], bpl
lea rdx, [rsp + 0x30]
mov r8, rdi
mov r9, rsi
call qword [rax + 0x20]
cmp byte [rsp + 0x58], 0
jne 0x1401a89ea
cmp byte [rbx + 0x28], 0
jne 0x1401a89d0
mov rax, qword [rsp + 0x28]
mov rcx, rsi
cmp qword [rbx], rsi
jg 0x1401a8ace
jmp 0x1401a89ea
mov byte [rbx + rax], 0
mov r11d, r10d
and r11d, r9d
mov r9d, r8d
and r9d, r11d
mov word [rsp + rax + 0x2e], r9w
xor r8d, edx
not r8d
and r8d, r11d
mov word [rbx + rax - 4], r8w
and r8d, edx
mov word [rbx + rax - 2], r8w
inc rcx
add rax, 6
cmp rcx, qword [rbx]
jge 0x1401a89ea
movzx r9d, word [rbx + rax - 4]
movzx edx, word [rbx + rax - 2]
movzx r10d, word [rsp + rax + 0x2c]
movzx r8d, word [rsp + rax + 0x2e]
cmp r9w, r10w
jne 0x1401a8a90
cmp dx, r8w
jne 0x1401a8a90
cmp byte [rsp + rax + 0x30], 0
mov r8d, edx
mov r11d, r9d
jne 0x1401a8a97
jmp 0x1401a8a90
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140279500
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401bb5f0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.1401bb460
mov rax, qword [rsi + 0x60]
cmp rax, 1
je 0x1401bb641
test rax, rax
jne 0x1401bb64d
mov eax, dword [0x1403afd68]
mov ecx, dword [0x1403b3e60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1401bb713
mov rsi, qword [0x1403afd60]
jmp 0x1401bb706
mov rax, qword [rsi + 0x70]
mov rsi, qword [rax]
jmp 0x1401bb706
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.1401188e0
mov rdi, rax
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x14], 0
jne 0x1401bb67e
call fcn.140279b2c
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], rax
cmp qword [rsi + 0x60], 0
jle 0x1401bb6eb
xor ebx, ebx
nop word [rax + rax]
mov r14, qword [rsi + 0x70]
mov rdx, qword [rdi]
inc rdx
mov rcx, rdi
call fcn.140105ee0
mov rax, qword [r14 + rbx*8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov qword [rdx + rcx*8 - 8], rax
inc rbx
cmp rbx, qword [rsi + 0x60]
jl 0x1401bb6c0
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.1401188e0
mov rsi, rax
mov rcx, rax
mov rdx, rdi
call fcn.1401b7c50
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1403afd68]
call fcn.140279988
cmp dword [0x1403afd68], 0xffffffff
jne 0x1401bb635
mov ecx, 8
call fcn.140279780
lea rcx, [0x14032f0e0]
mov qword [rax], rcx
mov qword [0x1403afd60], rax
lea rcx, [0x1403afd68]
call fcn.140279928
jmp 0x1401bb635
Function at 0x1401c0a70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x1403acd78]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x14], 0
jne 0x1401c0ab5
call fcn.140279b2c
mov eax, dword [0x1403b3e60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], 0x200000
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x78], 1
mov dword [rsp + 0x7c], ebx
mov dword [rsp + 0x80], 0
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 7]
cmp rcx, 2
jl 0x1401c0b38
lea rcx, [rsp + 0x30]
mov dl, 1
call fcn.1401bbca0
mov dword [rsp + 0x58], eax
jmp 0x1401c0b54
mov dword [rsp + 0x58], 0x200000
mov rax, qword [rax + 7]
sar rax, 1
inc rax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x78], 0
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401bc0b0
mov rdi, rax
mov rcx, rbx
call fcn.1401bd800
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x98]
test al, al
je 0x1401c0ba9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x90]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 7]
sar rcx, 1
cmp qword [rax], rcx
jne 0x1401c0ba9
mov byte [rsp + 0x80], 1
mov qword [rsi], rdi
mov rbx, qword [rsp + 0x68]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x98]
cmp byte [rsp + 0x80], 0
setne cl
test rbx, rbx
sete dl
and dl, cl
and dl, al
mov byte [rsi + 0x10], dl
movzx eax, byte [rsp + 0x81]
mov byte [rsi + 0x11], al
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
call fcn.1401bfe00
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov qword [rsi + 0x28], rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140279500
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401db750
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1403aadb8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401db77c
cmp byte [rax + 8], 0
jne 0x1401db781
mov rcx, rax
call fcn.1400726b0
test rax, rax
jne 0x1401db781
call fcn.1401a2410
mov rax, qword [rax + 0x68]
test rax, rax
je 0x1401db793
cmp qword [rax + 0x10], rsi
sete al
jmp 0x1401db795
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1401db7a0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1403acd78]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1403aadb8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401db7df
cmp byte [rax + 8], 0
jne 0x1401db7e4
mov rcx, rax
call fcn.1400726b0
test rax, rax
jne 0x1401db7e4
call fcn.1401a2410
mov rbx, qword [rax + 0x68]
test rbx, rbx
je 0x1401db88c
lea rdi, [rsi + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov byte [rbx + 0x28], 1
mov rax, qword [rsi + 0x98]
test rax, rax
je 0x1401db8a4
inc rax
mov qword [rsi + 0x98], rax
lea r14, [rsi + 0x48]
cmp qword [rsi + 0x48], r14
jne 0x1401db8a4
cmp qword [rsi + 0x68], 0
je 0x1401db8a4
mov ecx, 0x30
call fcn.140279780
mov rbx, rax
mov qword [rax + 0x10], rsi
mov rax, qword [0x14032dc78]
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], 0
mov byte [rbx + 0x28], 0
mov qword [rbx], r14
mov rax, qword [rsi + 0x50]
mov qword [rbx + 8], rax
mov qword [rsi + 0x50], rbx
mov qword [rax], rbx
inc qword [rsi + 0x28]
mov rcx, rdi
call fcn.1400a7660
lea rcx, str.DartWorker
lea rdx, [0x1401dbd20]
mov r8, rbx
call fcn.1401a2640
test eax, eax
jne 0x1401db8c2
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140279500
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140279500
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400a7660
lea rcx, str..._.._runtime_vm_thread_pool.cc
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], 0x12b
lea rdx, str.Could_not_start_worker_thread:_result___d.
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.140023590
int3

Function at 0x1401db8f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1403aadb8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401db91e
cmp byte [rax + 8], 0
jne 0x1401db923
mov rcx, rax
call fcn.1400726b0
test rax, rax
jne 0x1401db923
call fcn.1401a2410
mov rbx, qword [rax + 0x68]
test rbx, rbx
je 0x1401db967
lea rdi, [rsi + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
cmp byte [rbx + 0x28], 0
je 0x1401db958
mov byte [rbx + 0x28], 0
mov rax, qword [rsi + 0x98]
test rax, rax
je 0x1401db958
dec rax
mov qword [rsi + 0x98], rax
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400a7660
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret