joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b9a0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400ba6c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x14000b9c0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x14000b9c8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x14000b9c0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000ba08
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000b9ff
test rcx, rcx
je 0x14000b9c0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x14000b9f0
xor eax, eax
ret

Function at 0x14000ba10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400ba6c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14000ba30
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14000ba38
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x14000ba50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x1400ba6c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14000ba70
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14000ba78
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x14000ba70
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000ba70
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000bab4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000bac8
add rax, 0x28
cmp r9, rax
jne 0x14000baa0
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x14000bae0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400ba6c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x14000bb02
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x14000bb10
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000bb02
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x14000bb02
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x14000bb02
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14000bb5d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x14000bb70
add rdx, 0x28
cmp r10, rdx
jne 0x14000bb48
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14000bb7f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000bb8f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000bb66
test ecx, ecx
jg 0x14000bb78
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140015380
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rbx
test rax, rax
je 0x1400153c8
mov rcx, r12
mov qword [dbg.init_rand_s], rax
add rsp, 0x28
pop rbx
pop r12
jmp rax
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rbx
mov qword [0x1400e2cc0], rax
lea rax, [dbg.mingw_rand_s]
jmp 0x1400153af

Function at 0x1400173b0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400b2178], eax
cmp eax, 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
ret

Function at 0x1400173d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x1400174e2
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x1400174ba
add rax, 1
cmp rax, 0x6b
je 0x1400174d7
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x1400174b0
cmp edx, 0x6a
je 0x1400174d7
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sym.abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x1400174cb

Function at 0x140017890
Capabilities:
Allocate thread local storage

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea rcx, [0x1400e2d40]
call sym.enterOnceObject
lea r13, [rax + 8]
mov r12, rax
mov rcx, r13
call sym.pthread_mutex_lock
mov ebx, dword [0x1400e2d40]
test ebx, ebx
jne 0x140017900
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400b2178], eax
cmp eax, 0xffffffff
je sym._pthread_once_raw.part.0.constprop.0.isra.0.cold
mov dword [0x1400e2d40], 1
mov rcx, r13
call sym.pthread_mutex_unlock
test r12, r12
je 0x140017936
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.leaveOnceObject.part.0
cmp ebx, 1
je 0x1400178dd
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r9d, ebx
lea r8, [0x1400e2d40]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sym.fprintf
mov rcx, r13
call sym.pthread_mutex_unlock
test r12, r12
jne 0x1400178ea
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x140017940
Capabilities:
Set thread local storage value

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
call sym.pop_pthread_mem
cmp qword [sym.__dyn_tls_pthread], 0
mov r12, rax
je 0x140017a70
test rax, rax
je 0x140017a70
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [r12 + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [r12 + 0x68]
mov qword [r12 + 0x38], 0xffffffffffffffff
mov qword [r12 + 0x30], rax
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140017a81
mov qword [r12 + 0x68], 0xffffffffffffffff
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [r12 + 0xb8], 0
mov qword [r12 + 0x28], 0
call rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13, rax
call rsi
mov dword [rsp + 0x30], 2
mov r8, rbx
mov rdx, r13
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [r12 + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je sym.__pthread_self_lite.part.0.cold
mov rcx, qword [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x1400b2178]
mov rdx, r12
mov dword [r12 + 0xbc], 0
mov dword [r12 + 0xc0], eax
movzx eax, byte [r12 + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [r12 + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140017a87
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
call sym.replace_spin_keys.part.0
nop
jmp sym.__pthread_self_lite.part.0.cold

Function at 0x140017a90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
je 0x140017aa2
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140017ac0
add rsp, 0x28
ret
add rsp, 0x28
jmp sym.__pthread_self_lite.part.0
Function at 0x140017c10
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
push r12
push rsi
push rbx
sub rsp, 0x28
mov qword [rbp + 0x10], rcx
call dbg._fpreset
lea rcx, [0x1400b2168]
call sym.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
lea r12, [rax + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
cmp dword [0x1400e2d40], 1
je 0x140017c4f
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov rdx, qword [rbp + 0x10]
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rbx, qword [rbp + 0x10]
mov rcx, r12
mov dword [rbx + 0x70], eax
call sym.pthread_mutex_unlock
mov rax, qword [rbp + 0x10]
mov rdx, rbp
lea rcx, [rax + 0xd0]
call sym._setjmp
test eax, eax
je 0x140017d20
lea rcx, [0x1400b2168]
call sym.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
lea r12, [rax + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x30]
mov rbx, qword [rax + 8]
test rcx, rcx
je 0x140017cc2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x10]
cmp qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
je 0x140017d7e
mov rcx, r12
call sym.pthread_mutex_unlock
mov rcx, r12
call sym.pthread_mutex_destroy
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov dword [rax + 0xbc], 1
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
lea rsi, [0x1400b2168]
mov rcx, rsi
call sym.pthread_mutex_unlock
test eax, eax
jne 0x140017d76
xor ecx, ecx
call r12
jmp 0x140017d0d
lea rcx, [0x1400b2168]
call sym.pthread_mutex_unlock
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140017db4
mov rsi, qword [rbp + 0x10]
mov rcx, qword [rsi + 8]
call rax
mov r12, rax
nop
nop
lea rcx, [0x1400b2168]
call sym.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x1d8]
mov qword [rax + 8], r12
test rcx, rcx
je 0x140017c9b
call sym._pthread_cleanup_dest.part.0
jmp 0x140017c9b
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__endthreadex]
mov rax, qword [rbp + 0x10]
mov rcx, r12
mov dword [rax], 0xdeadbeef
call sym.pthread_mutex_unlock
mov rcx, r12
call sym.pthread_mutex_destroy
mov rcx, qword [rbp + 0x10]
call sym.push_pthread_mem
mov ecx, dword [0x1400b2178]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140017cff
mov r12d, pe_nt_image_headers64
jmp 0x140017d46
Function at 0x140017dc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
test edx, edx
jne 0x140017df0
test r8, r8
je 0x140017eb0
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
cmp edx, 1
je 0x140017ee0
cmp edx, 3
jne 0x140017dd7
mov ecx, dword [0x1400b2178]
cmp ecx, 0xffffffff
je 0x140017dd7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140017dd7
test byte [rax + 0x40], 0x30
je 0x140017f10
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x140017e32
call sym._pthread_cleanup_dest.part.0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x140017e65
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140017e53
call r13
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140017fa4
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x140018010
mov ecx, dword [0x1400b2178]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140017dd7
mov rcx, qword [0x1400e2d00]
test rcx, rcx
je 0x140017dd7
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov qword [0x1400e2d00], 0
jmp 0x140017dd7
lea rdx, [sym.SetThreadName_VEH]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x1400e2d00], rax
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, qword [rax + 0x30]
mov eax, dword [rax + 0xbc]
test eax, eax
jne 0x140017fb0
test rcx, rcx
je 0x140017f2d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x1d8]
mov qword [r12 + 0x30], 0
mov dword [r12 + 0xbc], 1
test rcx, rcx
je 0x140017f54
call sym._pthread_cleanup_dest.part.0
lea r14, [r12 + 0x38]
lea r13, [r12 + 0x68]
test byte [r12 + 0x44], 4
je 0x140017ff0
mov rcx, qword [r12 + 0x28]
mov dword [r12], 0xdeadbeef
test rcx, rcx
je 0x140017f82
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r14
call sym.pthread_mutex_destroy
mov rcx, r13
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x140017e82
call sym.replace_spin_keys.part.0
nop dword [rax]
test rcx, rcx
je 0x140017fbb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140017fa4
mov qword [r12 + 0x68], 0xffffffffffffffff
jmp 0x140017dd7
mov rcx, r14
call sym.pthread_mutex_destroy
mov rcx, r13
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x140017fdd
jmp 0x140017fa4
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x140017e9a
Function at 0x1400182c0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx]
mov rbx, rcx
mov rsi, rdx
test rdx, rdx
je 0x1400183f8
cmp eax, 1
je 0x140018319
call sym.enterOnceObject
lea r13, [rax + 8]
mov r12, rax
mov rcx, r13
call sym.pthread_mutex_lock
mov edi, dword [rbx]
test edi, edi
je 0x140018330
cmp edi, 1
jne 0x1400183d0
mov rcx, r13
call sym.pthread_mutex_unlock
test r12, r12
je 0x140018319
mov rcx, r12
call sym.leaveOnceObject.part.0
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rax, [sym._pthread_once_cleanup]
cmp dword [0x1400e2d40], 1
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
je 0x14001834f
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rdi
test rax, rax
je 0x140018438
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
mfence
cmp dword [0x1400e2d40], 1
je 0x140018381
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call rdi
test rax, rax
je 0x140018420
lea rdx, [rsp + 0x20]
mov qword [rax + 0x18], rdx
mfence
call rsi
cmp dword [0x1400e2d40], 1
je 0x1400183ae
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call rdi
test rax, rax
je 0x140018410
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov dword [rbx], 1
jmp 0x140018304
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r9d, edi
mov r8, rbx
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sym.fprintf
jmp 0x140018304
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x1400183bb
jmp sym.pthread_once.cold
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140018392
jmp 0x1400b198e
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140018367
jmp 0x1400b1984
mov rax, qword [class.std::ios_base]
ud2
lea rax, [rsp + 0x20]
mov qword [0], rax
ud2

Function at 0x1400186d0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1400e2d40], 1
mov r12d, eax
je 0x1400186f5
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140018750
lea r13, [rbx + 0x68]
xor r14d, r14d
mov rcx, r13
call sym.pthread_spin_lock
cmp dword [rbx + 0x48], esi
jbe 0x14001872f
mov rax, qword [rbx + 0x58]
cmp byte [rax + rsi], 0
je 0x14001872f
mov rax, qword [rbx + 0x50]
mov r14, qword [rax + rsi*8]
mov rcx, r13
call sym.pthread_spin_unlock
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r14
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x140018709
Function at 0x140018760
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1400e2d40], 1
mov r12d, eax
je 0x14001878c
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140018868
lea r13, [rbx + 0x68]
mov rcx, r13
call sym.pthread_spin_lock
cmp dword [rbx + 0x48], esi
jbe 0x1400187f0
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], rbp
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call sym.pthread_spin_unlock
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sym.realloc
mov rdi, rax
test rax, rax
je 0x140018875
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sym.realloc
mov r14, rax
test rax, rax
je 0x140018875
mov eax, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
sub r8d, eax
lea rcx, [rdi + rax*8]
shl r8, 3
call sym.memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sym.memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x1400187b9
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x1400187a4
mov rcx, r13
call sym.pthread_spin_unlock
mov eax, 0xc
jmp 0x1400187d8

Function at 0x1400188b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
je 0x1400188c2
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400188e8
mov r8, qword [rax + 0x1d8]
mov rax, r8
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
xor r8d, r8d
test rax, rax
jne 0x1400188d3
mov rax, r8
add rsp, 0x28
ret

Function at 0x140018900
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
je 0x140018912
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018930
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140018923
add rsp, 0x28
ret

Function at 0x1400189a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
je 0x1400189b2
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400189d0
add rax, 0x18
add rsp, 0x28
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x1400189c3
jmp 0x1400189c7
Function at 0x140018af0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400e2d48]
test eax, eax
jne 0x140018b08
xor eax, eax
add rsp, 0x28
ret
cmp dword [0x1400e2d40], 1
je 0x140018b16
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018b40
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x140018afe
test byte [rax + 0x40], 3
je 0x140018afe
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140018b00
call sym.__pthread_self_lite.part.0
test rax, rax
je 0x140018afe
jmp 0x140018b27

Function at 0x140018b50
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400e2d40], 1
mov ebx, ecx
je 0x140018b65
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018ba0
add rax, 0x20
test ebx, ebx
jle 0x140018b90
lock add dword [rax], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax], 1
add rsp, 0x20
pop rbx
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140018b76
add rsp, 0x20
pop rbx
ret

Function at 0x140018ca0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
je 0x140018cb5
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140018d20
test byte [rbx + 0x40], 0xc
jne 0x140018cd9
mov eax, dword [0x1400e2d48]
test eax, eax
jne 0x140018ce8
add rsp, 0x28
pop rbx
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140018d0b
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140018d0b
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140018d35
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp sym.pthread_mutex_unlock
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x140018cc9
add rsp, 0x28
pop rbx
pop r12
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140018d53
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r12
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140018d70
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
xor r12d, r12d
test rcx, rcx
je 0x140018d96
call sym._pthread_time_in_ms_from_timespec
mov edx, 0xfffffffe
mov r12d, 0xffffffff
cmp rax, rdx
cmovbe r12d, eax
cmp dword [0x1400e2d40], 1
je 0x140018da4
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140018e08
test r12d, r12d
je 0x140018de8
call sym.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018e18
mov edx, r12d
call sym._pthread_wait_for_single_object
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x140018db8
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018dd3

Function at 0x140018e30
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
cmp dword [0x1400e2d40], 1
mov r12d, ecx
je 0x140018e48
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x1400b2178]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140018eb0
test r12d, r12d
je 0x140018e90
call sym.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018ec0
mov edx, r12d
call sym._pthread_wait_for_single_object
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x140018e5c
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018e77