joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048230
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov r10, r8
mov rsi, rcx
mov eax, dword [rsp + 0x110]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xc0], xmm0
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x34], pe_nt_image_headers64
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r10
mov r9d, eax
call sub.WS2_32.dll_recvfrom
cmp eax, 0xffffffff
je 0x140048307
mov ecx, dword [rsp + 0x34]
movzx edx, word [rsp + 0x50]
cmp edx, 0x17
je 0x140048361
cmp edx, 2
jne 0x140048355
cmp ecx, 0x10
jb 0x140048475
movzx ecx, word [rsp + 0x52]
rol cx, 8
mov edx, dword [rsp + 0x54]
mov word [rsp + 0x3c], cx
mov dword [rsp + 0x38], edx
xor r11d, r11d
jmp 0x1400483ab
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x1400483dd
mov eax, dword [rsp + 0x34]
movzx ecx, word [rsp + 0x50]
cmp ecx, 0x17
je 0x1400483f0
cmp ecx, 2
jne 0x140048355
cmp eax, 0x10
jb 0x140048475
movzx eax, word [rsp + 0x52]
rol ax, 8
mov ecx, dword [rsp + 0x54]
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x38], ecx
xor r10d, r10d
jmp 0x140048439
lea rax, str.invalid_argumentx
jmp 0x1400483e5
cmp ecx, 0x1c
jb 0x14004848f
movzx ecx, word [rsp + 0x52]
rol cx, 8
movdqu xmm0, xmmword [rsp + 0x58]
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x68]
movq r10, xmm0
pshufd xmm1, xmm0, 0xee
movq r9, xmm1
shld r9, r10, 0x20
movdqu xmmword [rsp + 0x3a], xmm0
pshufd xmm0, xmm0, 0xff
movd r10d, xmm0
mov r11w, 1
cdqe
movzx edi, word [rsp + 0x3c]
mov word [rsi + 0xe], di
mov edi, dword [rsp + 0x38]
mov dword [rsi + 0xa], edi
mov qword [rsi], rax
mov word [rsi + 8], r11w
mov qword [rsi + 0x10], r9
mov dword [rsi + 0x18], r10d
mov dword [rsi + 0x1c], r8d
mov dword [rsi + 0x20], edx
mov word [rsi + 0x24], cx
jmp 0x14004846b
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov word [rsi + 8], 2
jmp 0x14004846b
cmp eax, 0x1c
jb 0x14004848f
movzx eax, word [rsp + 0x52]
rol ax, 8
movdqu xmm0, xmmword [rsp + 0x58]
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x68]
movq r9, xmm0
pshufd xmm1, xmm0, 0xee
movq r8, xmm1
shld r8, r9, 0x20
movdqu xmmword [rsp + 0x3a], xmm0
pshufd xmm0, xmm0, 0xff
movd r9d, xmm0
mov r10w, 1
movzx r11d, word [rsp + 0x3c]
mov word [rsi + 0xe], r11w
mov r11d, dword [rsp + 0x38]
mov dword [rsi + 0xa], r11d
mov qword [rsi], 0
mov word [rsi + 8], r10w
mov qword [rsi + 0x10], r8
mov dword [rsi + 0x18], r9d
mov dword [rsi + 0x1c], edx
mov dword [rsi + 0x20], ecx
mov word [rsi + 0x24], ax
add rsp, 0xd8
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x1400ca400]
mov edx, 0x42
call fcn.14009a1a0
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x1400ca460]
mov edx, 0x43
call fcn.14009a1a0
ud2
Function at 0x14004ba10
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x14004bae5
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x34], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x34]
lea eax, [rsp + 0x34]
lea r8, [0x1400c6540]
mov rcx, rsi
call fcn.1400a0b00

Function at 0x14004c580
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14004c68d
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14004c5b8
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x14004c650
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x14004c66f
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x14004c60d
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x14004c629
jmp 0x14004c61e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
je 0x14004c624
cmp eax, 0x6d
jne 0x14004c640
mov byte [rsi + 1], 0
jmp 0x14004c634
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14004c636
mov r8d, 0x10
mov rcx, rbx
call fcn.1400108e0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x14004c5c5
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400108e0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x14004c5c5
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140009290
ud2
Function at 0x140051340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400535a0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x1400513b5
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.1400433b0
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x1400513c3
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1400513e3
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x1400513d4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.140007320
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rdx, xmm6
test rdx, rdx
je 0x1400513d4
add rdx, rdx
mov r8d, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.140001c30

Function at 0x140051e10
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140051e46
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x14002adb0]
mov qword [rsp + 0x48], rax
lea rax, [0x1400c9658]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.14009a120
ud2

Function at 0x140052a20
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1400f1368]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.140001c20
test rax, rax
je 0x140052ae2
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140052b40]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140052ad5
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140052aae
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140001c30
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call fcn.140001c30
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.14008b2c0
ud2
Function at 0x140052d60
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x140052de5
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x140052e26
cmp dword [rsp + 0x2c], 0
je 0x140052e0a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140052e4e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1401031a8]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1401031a8], rsi
jne 0x140052dc0
mov byte [0x1401031a0], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140052e1c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x140052e9a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x140052e0f
mov edi, dword [rsp + 0x28]
jmp 0x140052e1c
mov edi, dword [rsi + 0x18]
jmp 0x140052e1a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x1400c9b88]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.140009320
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x1400c3d30]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.14009a120
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x1400c3d30]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140009240
ud2
Function at 0x140055110
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x140103178]
cmp rax, 3
jne 0x140055204
cmp rbx, 0x17f
ja 0x140055216
lea r15, [rsp + 0x70]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, r15
mov r8, rbx
call fcn.1400972b0
cmp qword [rsp + 0x28], 0
je 0x140055194
lea rax, str.0u_f_
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140055227
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x1400551ec
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x140055227
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x140055227
call fcn.14003b690
cmp rbx, 0x17f
jbe 0x14005514a
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
call case.0x140041aab.138
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400557d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call sub.WS2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x14005587f
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x14005588e
cmp ecx, 0x17
jne 0x1400558b5
cmp eax, 0x1c
jb 0x1400558ce
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x1400558bc
cmp eax, 0x10
jb 0x1400558e8
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argumentx
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x1400ca460]
mov edx, 0x43
call fcn.14009a1a0
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x1400ca400]
mov edx, 0x42
call fcn.14009a1a0
ud2
Function at 0x14005a8d0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rdi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.140043c30
mov rsi, rdx
test rax, rax
je 0x14005a942
mov rcx, rax
mov rdx, rsi
call fcn.1400041a0
mov qword [rdi], 0
jmp 0x14005aaaa
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140043e60
cmp dword [rsp + 0x40], 2
jne 0x14005a9c8
mov rax, qword [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x14005a9a9
test rcx, rcx
je 0x14005a9a9
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, r14
call qword [r15]
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x14005a996
mov r8, qword [r15 + 0x10]
mov rcx, r14
call fcn.140001c30
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call fcn.140001c30
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400bdc14
mov r12, qword [rsp + 0x78]
test rsi, rsi
je 0x14005aa1a
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x14005aa96
mov rbx, qword [rsp + 0x40]
jmp 0x14005aa1c
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x14005aa85
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call fcn.1400bdc14
test r15, r15
je 0x14005aa85
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x14005aaa2
mov qword [rdi], 0
mov rcx, rbx
call fcn.1400bdc14
jmp 0x14005aaa2
call sub.KERNEL32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call fcn.1400bdc14
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14005cd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1400c0068]
test ecx, ecx
je 0x14005cdb0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005cdc9
cmp qword [rax + 8], 0
je 0x14005cdc9
add rax, 0x10
jmp 0x14005ce91
lea rcx, [0x1400c0050]
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005cda0
mov ecx, dword [0x1400c0068]
test ecx, ecx
je 0x14005ce72
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005ce8f
mov rdi, rax
test rax, rax
jne 0x14005ce3b
mov rax, qword [0x1400f1368]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call fcn.140001c20
test rax, rax
je 0x14005cea8
mov rdi, rax
lea rax, [0x1400c0050]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1400c0068]
test ecx, ecx
je 0x14005ce98
dec ecx
mov rdx, rdi
call fcn.1400bd924
xor ecx, ecx
test rsi, rsi
je 0x14005ce5b
mov rax, qword [rsi]
mov qword [rsi], 0
cmp rax, 1
jne 0x14005ce5b
mov rdx, qword [rsi + 8]
mov ecx, dword [rsi + 0x10]
jmp 0x14005ce5d
xor edx, edx
mov qword [rdi + 8], 1
lea rax, [rdi + 0x10]
mov qword [rdi + 0x10], rdx
mov byte [rdi + 0x18], cl
jmp 0x14005ce91
lea rcx, [0x1400c0050]
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005cde8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400c0050]
call fcn.140052d60
mov ecx, eax
jmp 0x14005ce33
mov ecx, 8
mov edx, 0x20
call fcn.14008b2c0
ud2
Function at 0x14005cec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov ecx, dword [0x1400c0088]
test ecx, ecx
je 0x14005cfee
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005cef2
mov rdi, rax
cmp qword [rax + 8], 0
jne 0x14005cfe8
mov ecx, dword [0x1400c0088]
test ecx, ecx
je 0x14005d010
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005d02d
mov rdi, rax
test rax, rax
jne 0x14005cf7c
mov qword [rsp + 0x28], 0
lea rax, [0x1400c0070]
mov qword [rsp + 0x20], rax
mov rax, qword [0x1400f1368]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call fcn.140001c20
test rax, rax
je 0x14005d04c
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x1400c0088]
test ecx, ecx
je 0x14005d039
dec ecx
mov rdx, rdi
call fcn.1400bd924
lea rax, [rdi + 8]
test rsi, rsi
je 0x14005cfa1
mov rcx, qword [rsi]
mov qword [rsi], 0
mov rdx, rcx
test rcx, rcx
je 0x14005cfa5
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
jmp 0x14005cfa5
xor ecx, ecx
xor edx, edx
mov r8, qword [rax + 0x10]
mov qword [rsp + 0x30], r8
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rdx
cmp qword [rsp + 0x20], 0
je 0x14005cfe8
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14005cfe8
lock dec qword [rax]
jne 0x14005cfe8
lea rcx, [rsp + 0x30]
call fcn.14000f800
add rdi, 0x10
jmp 0x14005d02f
lea rcx, [0x1400c0070]
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005cee4
jmp 0x14005cef2
lea rcx, [0x1400c0070]
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005cf11
xor edi, edi
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
lea rcx, [0x1400c0070]
call fcn.140052d60
mov ecx, eax
jmp 0x14005cf74
mov ecx, 8
mov edx, 0x20
call fcn.14008b2c0
ud2
Function at 0x14005d080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1400c00a8]
test ecx, ecx
je 0x14005d0af
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005d0c8
cmp byte [rax + 8], 0
je 0x14005d0c8
add rax, 9
jmp 0x14005d170
lea rcx, case.0x1400361e4.293
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005d0a0
mov ecx, dword [0x1400c00a8]
test ecx, ecx
je 0x14005d151
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005d16e
mov rdi, rax
test rax, rax
jne 0x14005d12e
mov rax, qword [0x1400f1368]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.140001c20
test rax, rax
je 0x14005d187
mov rdi, rax
lea rax, case.0x1400361e4.293
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov ecx, dword [0x1400c00a8]
test ecx, ecx
je 0x14005d177
dec ecx
mov rdx, rdi
call fcn.1400bd924
xor ecx, ecx
test rsi, rsi
je 0x14005d144
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rdi + 9]
mov byte [rdi + 8], 1
mov byte [rdi + 9], cl
jmp 0x14005d170
lea rcx, case.0x1400361e4.293
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005d0e3
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, case.0x1400361e4.293
call fcn.140052d60
mov ecx, eax
jmp 0x14005d126
mov ecx, 8
mov edx, 0x10
call fcn.14008b2c0
ud2

Function at 0x14005d1a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1400c00c8]
test ecx, ecx
je 0x14005d1cf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005d1e8
cmp byte [rax + 8], 0
je 0x14005d1e8
add rax, 9
jmp 0x14005d290
lea rcx, case.0x1400361e4.293
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005d1c0
mov ecx, dword [0x1400c00c8]
test ecx, ecx
je 0x14005d271
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005d28e
mov rdi, rax
test rax, rax
jne 0x14005d24e
mov rax, qword [0x1400f1368]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.140001c20
test rax, rax
je 0x14005d2a7
mov rdi, rax
lea rax, case.0x1400361e4.293
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov ecx, dword [0x1400c00c8]
test ecx, ecx
je 0x14005d297
dec ecx
mov rdx, rdi
call fcn.1400bd924
xor ecx, ecx
test rsi, rsi
je 0x14005d264
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rdi + 9]
mov byte [rdi + 8], 1
mov byte [rdi + 9], cl
jmp 0x14005d290
lea rcx, case.0x1400361e4.293
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005d203
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, case.0x1400361e4.293
call fcn.140052d60
mov ecx, eax
jmp 0x14005d246
mov ecx, 8
mov edx, 0x10
call fcn.14008b2c0
ud2
Function at 0x14005d460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x1400c0108]
test ecx, ecx
je 0x14005d576
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14005d492
mov rdi, rax
cmp qword [rax + 8], 0
jne 0x14005d570
mov ecx, dword [0x1400c0108]
test ecx, ecx
je 0x14005d598
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14005d5b5
mov rdi, rax
test rax, rax
jne 0x14005d51c
mov qword [rsp + 0x28], 0
lea rax, [0x1400c00f0]
mov qword [rsp + 0x20], rax
mov rax, qword [0x1400f1368]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.140001c20
test rax, rax
je 0x14005d5d4
mov rdi, rax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov ecx, dword [0x1400c0108]
test ecx, ecx
je 0x14005d5c1
dec ecx
mov rdx, rdi
call fcn.1400bd924
test rsi, rsi
je 0x14005d536
mov rax, qword [rsi]
mov qword [rsi], 0
test rax, rax
je 0x14005d538
mov rax, qword [rsi + 8]
jmp 0x14005d538
xor eax, eax
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rax
test rdx, rdx
je 0x14005d570
test rcx, rcx
je 0x14005d570
lock dec qword [rcx]
jne 0x14005d570
lea rcx, [rsp + 0x28]
call fcn.14000f960
add rdi, 0x10
jmp 0x14005d5b7
lea rcx, [0x1400c00f0]
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14005d484
jmp 0x14005d492
lea rcx, [0x1400c00f0]
call fcn.140052d60
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14005d4b1
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x1400c00f0]
call fcn.140052d60
mov ecx, eax
jmp 0x14005d514
mov ecx, 8
mov edx, 0x18
call fcn.14008b2c0
ud2