joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140196cac
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x140196e0e
cmp word [rcx], di
je 0x140196e0e
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_wcsncpy
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], di
call sub.msvcrt.dll_wcslen
mov rdx, rax
cdqe
lea rcx, [rsp + rax*2 + 0x1e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x140196d4b
cmp word [rsp + 0x22], 0x3a
jne 0x140196d4b
cmp edx, 2
jne 0x140196d32
lea rdx, [0x1401a43d0]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140196e0e
jmp 0x140196de6
cmp word [rcx], 0x5c
je 0x140196d57
cmp word [rcx], 0x2f
jne 0x140196d60
mov word [rcx], di
sub rcx, 2
jmp 0x140196d4b
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x140196da7
test byte [rbp + 0x130], 0x10
je 0x140196d8c
mov rbx, 0xfffffffffffffffe
jmp 0x140196d9f
mov ebx, dword [rbp + 0x14c]
mov eax, dword [rbp + 0x150]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140196e0e
movzx ecx, word [rsp + 0x20]
movzx eax, word [rsp + 0x22]
cmp cx, 0x5c
jne 0x140196dbc
cmp ax, cx
je 0x140196dd2
cmp cx, 0x2f
jne 0x140196dc7
cmp ax, cx
je 0x140196dd2
cmp cx, 0x2e
jne 0x140196e0e
cmp ax, cx
jne 0x140196e0e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140196def
test al, 0x10
je 0x140196e0e
mov rbx, 0xfffffffffffffffe
jmp 0x140196e0e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
lea r11, [rsp + 0x480]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1401982a4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, str.PB_WindowID
mov rcx, r14
xor ebp, ebp
mov rdi, rax
call qword [sym.imp.USER32.dll_GetPropW]
mov rsi, rax
lea eax, [rbx + 9]
test rsi, rsi
je 0x140198366
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1401984a7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
jne 0x1401984a7
mov rcx, qword [0x1401a8aa0]
lea rdx, [rsi - 1]
call fcn.14019f950
mov ebp, 1
cmp dword [rax + 0x20], 0
mov rbx, rax
jle 0x1401984a7
mov rax, qword [rax + 8]
movsxd r8, dword [rbx + 0x20]
xor edx, edx
xor ecx, ecx
lea r10d, [rbp + 8]
cmp word [rcx + rax + 2], r10w
jne 0x140198357
mov r9d, 0xfa01
cmp word [rcx + rax + 4], r9w
je 0x1401984a0
inc rdx
add rcx, 6
cmp rdx, r8
jl 0x14019833d
mov eax, r10d
mov sil, pe_nt_image_headers64
test rdi, rdi
je 0x140198439
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x140198439
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140198439
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140198439
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140198439
lea rdx, [rsp + 0x20]
mov r8d, 0x10
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x140198439
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x140198405
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140198424
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x1401984b1
lea rdx, str.Scintilla
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1401984b1
test r14, r14
je 0x14019847b
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14019846e
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14019846e
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14019847b
mov edx, 1
mov rcx, r14
call fcn.1401984c8
test rdi, rdi
je 0x140198495
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x1401984b1
test rbx, rbx
je 0x1401984b1
mov rax, qword [rbx + 0x10]
jmp 0x1401984b3
xor ebp, ebp
jmp 0x140198363
mov eax, 9
jmp 0x140198366
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140199ac8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140199b61
lea rsi, [0x1401a4358]
test rdi, rdi
cmovne rsi, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov ecx, 0x2002
inc eax
movsxd rbp, eax
add rbp, rbp
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140199b5b
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140199b5b
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rbx + 0xd]
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rbx, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140199b7c
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1401a8d00], eax
add rsp, 0x28
ret
Function at 0x14019f1c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.1401a09a0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.1401a1478
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14019f1f0
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401a0b20

Function at 0x14019f220
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x14019f384
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x1401a4358]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x14019f350
cmp word [r14 + 2], di
je 0x14019f350
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x14019f290
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14019f2bd
cmp word [rbx], bp
je 0x14019f2bd
add rbx, 2
jmp 0x14019f2a0
inc edi
cmp edi, r12d
je 0x14019f2d2
cmp word [rbx], bp
je 0x14019f2db
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x14019f2a0
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.1401a0b60
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x14019f30a
mov ecx, r13d
call fcn.1401a0c80
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.1401a09a0
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x14019f32e
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14019f35d
test ax, ax
jne 0x14019f370
inc edi
cmp edi, edx
je 0x14019f376
test ax, ax
je 0x14019f2de
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x14019f350
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14019f2de
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.1401a0ae0
Function at 0x14019f714
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401a8850]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14019f795
mov r8, qword [0x1401a8848]
mov rcx, qword [0x1401a83e0]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1401a8850]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1401a8840]
jmp 0x14019f781
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14019f77e
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14019f76c
lea rcx, [0x14019f678]
mov rdx, rdi
call fcn.1401a1618
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14019f7ac
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x14019f7d6
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x1401a8848]
test rcx, rcx
jne 0x14019f819
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x1401a83e0]
movsxd r8, ebx
mov edx, 8
mov dword [0x1401a8850], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1401a8850]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1401a8848]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x1401a8848], rcx
mov ecx, dword [0x1401a8850]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x1401a8848]
mov rcx, qword [0x1401a83e0]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1401a8850]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x14019f86d
test rbp, rbp
je 0x14019f894
lea rcx, [0x1401a8840]
mov edx, 0x28
call fcn.1401a0380
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x14019f894
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401a0490
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1401a6128], 0xffffffff
jne 0x1401a04bf
call fcn.1401a07d0
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1401a0440]
call fcn.1401a1618
jmp 0x1401a04f0
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1401a04f0
call fcn.1401a0cb0
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1401a0440]
call fcn.1401a1618
add rsp, 0x28
ret
Function at 0x1401a0560
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x1401a05c6
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x1401a9020]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x1401a05f1
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1401a9020]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.1401a0c00
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1401a07d0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1401a9020], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1401a6128], eax
call fcn.1401a0cb0
add rsp, 0x28
ret

Function at 0x1401a0840
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1401a0890
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1401a0920
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x1401a09a0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x1401a09d0
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x1401a0a42
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1401a9020]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x1401a0aa0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x1401a0aa0
cmp dword [rsp + 0x20], 0x100000
jge 0x1401a0a63
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1401a9020]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1401a0ae0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x1401a0b20
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret
Function at 0x1401a0b60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x1401a0bbb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x1401a0bbb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x1401a0bbd
xor eax, eax
add rsp, 0x38
ret

Function at 0x1401a0bd0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x1401a0c80
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx]
add rsp, 0x38
ret

Function at 0x1401a0cb0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x1401a9020]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x1401a9020]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x1401a6128]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x1401a1618
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1401a8918], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x1401a8928]
jne 0x1401a1665
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x1401a8950], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1401a8918], 1
mov ecx, dword [0x1401a8950]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1401a173a
mov rcx, qword [0x1401a83e0]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1401a1765
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1401a8920]
test rax, rax
je 0x1401a16b5
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1401a8920], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x1401a1780]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x1401a8950]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1401a83e0]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1401a1765
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1409d0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409d01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409d0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409d006f
add dl, dl
jne 0x1409d0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409d00f6
xor eax, eax
add dl, dl
jne 0x1409d00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409d01ad
add dl, dl
jne 0x1409d00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409d00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409d007e
mov eax, 1
add dl, dl
jne 0x1409d0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409d00fb
sub eax, ebx
mov ebx, 1
jne 0x1409d014c
mov ecx, 1
add dl, dl
jne 0x1409d012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409d013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409d0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409d007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409d0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409d0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409d015d
cmp eax, 0x7d00
jae 0x1409d019b
cmp eax, 0x500
jb 0x1409d0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409d007e
cmp eax, 0x7f
ja 0x1409d019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409d007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409d01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409d007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002f50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f9c
xor al, al
add rsp, 0x28
ret