joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401028f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rdi, rdx
xor esi, esi
mov rcx, qword [rdx + 0x18]
mov qword [rbp - 8], rcx
mov rax, qword [rdx + 0x28]
mov qword [rbp + 8], rax
mov rax, qword [rcx + 8]
add rdx, 8
lea rcx, [rbp - 0x18]
call rax
nop
mov rax, qword [rdi + 0x30]
mov qword [rbp + 0x10], rax
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.140108f30
nop
mov rax, qword [rbp + 0x10]
mov rbx, qword [rax + 0x20]
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x18]
lea rcx, [rbp - 0x18]
call rdx
lea r8, [0x1403f7ec8]
mov rdx, rax
lea rcx, [rsp + 0x50]
call rbx
nop
mov rcx, qword [rsp + 0x60]
mov qword [rbp + 0x28], rcx
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x38], rax
lea rax, fcn.140009110
mov qword [rsp + 0x60], rax
lea rax, [0x1404048f8]
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x18]
call rax
mov qword [rsp + 0x68], rsi
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x40], rax
lea rax, [0x140403eb0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
lea rax, [fcn.140009110]
cmp rdx, rax
je 0x1401029f1
lea rcx, [rsp + 0x50]
call rdx
nop
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0x48]
call fcn.1400fdc50
mov rdi, rax
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140102a35
lea rcx, [0x14010b320]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call rax
jmp 0x140102ac0
mov r14, qword [rcx + 0x10]
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x80]
call fcn.140108f30
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140102a67
mov rsi, qword [rax + 8]
mov r8d, 0x78
mov rdx, rsi
call fcn.140100af0
mov rbx, rax
lea rcx, [rax + 8]
lea rdx, [rbp - 0x80]
call fcn.140108f30
lea rax, [0x14010bd90]
mov qword [rbx], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
lea rcx, [rbp - 0x78]
call rdx
nop
lea rdx, [rsp + 0x30]
mov rcx, rdi
call r14
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140102ac0
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp + 0x58]
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call rdx
nop
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
lea rcx, [rbp + 0x18]
call rdx
nop
mov rax, qword [rbp + 0x98]
mov rdx, qword [rax]
lea rcx, [rbp + 0x88]
call rdx
nop
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
lea rcx, [rbp - 0x18]
call rdx
nop
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14028bc60
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140102b30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rbx, r9
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rbx
lea rdx, [r9 + 0x18]
mov ecx, 0x268
call fcn.1400789f0
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x140102b8d
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lock inc dword [rdx + 0xc]
mov r9, qword [rsp + 0xc0]
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140103fb0
mov rbx, rax
mov qword [rsp + 0x70], rax
xor r14d, r14d
test ebp, ebp
je 0x140102bf3
sub ebp, 1
je 0x140102be8
cmp ebp, 1
je 0x140102bdd
lea rcx, [rax + 0x38]
mov edx, 0x2726
call fcn.1400d6f40
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.140079200
jmp 0x140102cd6
mov r8d, 2
jmp 0x140102cc8
mov r8d, 1
jmp 0x140102cc8
test byte [rsi + 8], 0x10
je 0x140102cc5
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], r14
mov rax, qword [rdi + 8]
lock inc dword [rax + 0x30]
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
jne 0x140102c32
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.140079d60
jmp 0x140102cd6
mov dword [rsp + 0xb0], r14d
mov dword [rsp + 0xa8], r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov r8d, 1
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x140102c86
mov eax, 0x2746
jmp 0x140102c93
mov ecx, 0x274d
cmp eax, 0x4d2
cmove eax, ecx
test esi, esi
je 0x140102cb7
cmp eax, 0x3e5
je 0x140102cb7
mov r9d, dword [rsp + 0xb0]
mov r8d, eax
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.140079d60
jmp 0x140102cd6
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.140079cc0
jmp 0x140102cd6
xor r8d, r8d
mov r9, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14007e9d0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x60]
call fcn.1401049d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140103c60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rbp + 0xf8], rax
mov rdi, rdx
xor esi, esi
mov rax, qword [rcx + 0x28]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x40]
call rbx
nop
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0xd8], rcx
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0xe8], rax
lea rax, fcn.140009110
mov qword [rsp + 0x50], rax
lea rax, [0x1404048f8]
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc8]
call rax
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0xf0], rax
lea rax, [0x140403eb0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
lea rax, [fcn.140009110]
cmp rdx, rax
je 0x140103d30
lea rcx, [rsp + 0x40]
call rdx
nop
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140103d64
lea rcx, [0x14010b460]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xc8]
call rax
jmp 0x140103e65
mov r14, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400f9e60
movups xmm0, xmmword [rdi + 0x138]
movups xmmword [rbp + 0xa8], xmm0
movsd xmm1, qword [rdi + 0x148]
movsd qword [rbp + 0xb8], xmm1
mov rax, qword [rdi + 0x150]
mov qword [rbp + 0xc0], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140103dc0
mov rsi, qword [rax + 8]
mov r8d, 0x168
mov rdx, rsi
call fcn.140100af0
mov rdi, rax
lea rdx, [rsp + 0x70]
lea rcx, [rax + 8]
call fcn.1400f9e60
movups xmm0, xmmword [rbp + 0xa8]
movups xmmword [rdi + 0x140], xmm0
movsd xmm1, qword [rbp + 0xb8]
movsd qword [rdi + 0x150], xmm1
mov rcx, qword [rbp + 0xc0]
mov qword [rdi + 0x158], rcx
lea rax, [0x14010be30]
mov qword [rdi], rax
mov qword [rsp + 0x20], rdi
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140103e38
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x140103e38
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rsp + 0x70]
call fcn.1400f0e80
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xc8]
call r14
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140103e65
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp + 0xd8]
mov rdx, qword [rax]
lea rcx, [rbp + 0xc8]
call rdx
nop
mov rcx, qword [rbp + 0xf8]
xor rcx, rsp
call fcn.14028bc60
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140104900
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x14010494b
lea rbx, [rax + 8]
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14010493b
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010493b
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, rbx
call fcn.1400f0e80
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140104998
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140104987
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140104987
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1401049a3
inc ecx
inc rax
cmp rax, 6
jl 0x140104975
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x148]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140106fc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
xor r14d, r14d
mov rax, qword [rcx + 0x28]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rbp - 0x79]
call rbx
nop
mov rcx, qword [rbp - 0x69]
mov qword [rbp + 0x1f], rcx
mov rax, qword [rbp - 0x59]
mov qword [rbp + 0x2f], rax
lea rax, fcn.140009110
mov qword [rbp - 0x69], rax
lea rax, [0x1404048f8]
mov qword [rbp - 0x59], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 0xf]
call rax
mov qword [rbp - 0x61], r14
mov rax, qword [rbp - 0x51]
mov qword [rbp + 0x37], rax
lea rax, [0x140403eb0]
mov qword [rbp - 0x51], rax
mov rax, qword [rbp - 0x69]
mov rdx, qword [rax]
lea rax, [fcn.140009110]
cmp rdx, rax
je 0x140107074
lea rcx, [rbp - 0x79]
call rdx
nop
mov rcx, qword [rbp + 0x2f]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1401070a2
lea rcx, [0x14010bf20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xf]
call rax
jmp 0x14010719e
mov rsi, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.1400d3e20
mov rax, qword [rdi + 0x30]
mov qword [rbp - 0x19], rax
mov rax, qword [rdi + 0x38]
mov qword [rbp - 0x11], rax
mov qword [rdi + 0x38], r14
mov qword [rdi + 0x30], r14
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rbp - 9], xmm0
movsd xmm1, qword [rdi + 0x50]
movsd qword [rbp + 7], xmm1
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401070fc
mov rdx, qword [rax + 8]
jmp 0x1401070ff
mov rdx, r14
mov r8d, 0x68
call fcn.140100af0
mov rdi, rax
lea rdx, [rbp - 0x49]
lea rcx, [rax + 8]
call fcn.1400d3e20
mov rcx, qword [rbp - 0x19]
mov qword [rdi + 0x38], rcx
mov rcx, qword [rbp - 0x11]
mov qword [rdi + 0x40], rcx
mov qword [rbp - 0x11], r14
mov qword [rbp - 0x19], r14
movups xmm0, xmmword [rbp - 9]
movups xmmword [rdi + 0x48], xmm0
movsd xmm1, qword [rbp + 7]
movsd qword [rdi + 0x58], xmm1
lea rax, [0x14010c0e0]
mov qword [rdi], rax
mov qword [rsp + 0x20], rdi
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140107172
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x140107172
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rbp - 0x39]
mov rdx, qword [rax]
lea rcx, [rbp - 0x49]
call rdx
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf]
call rsi
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14010719e
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp + 0x1f]
mov rdx, qword [rax]
lea rcx, [rbp + 0xf]
call rdx
nop
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14028bc60
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140108610
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rbp + 0x148], rax
mov rdi, rdx
xor esi, esi
mov rax, qword [rcx + 0x28]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x40]
call rbx
nop
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0x128], rcx
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x138], rax
lea rax, fcn.140009110
mov qword [rsp + 0x50], rax
lea rax, [0x1404048f8]
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x118]
call rax
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x140], rax
lea rax, [0x140403eb0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
lea rax, [fcn.140009110]
cmp rdx, rax
je 0x1401086e0
lea rcx, [rsp + 0x40]
call rdx
nop
mov rcx, qword [rbp + 0x138]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140108714
lea rcx, [0x140109e00]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x118]
call rax
jmp 0x14010881d
mov r14, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400fecd0
movups xmm0, xmmword [rdi + 0x190]
movups xmmword [rbp + 0x100], xmm0
movsd xmm1, qword [rdi + 0x1a0]
movsd qword [rbp + 0x110], xmm1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140108762
mov rsi, qword [rax + 8]
mov r8d, 0x1b8
mov rdx, rsi
call fcn.140100af0
mov rdi, rax
lea rdx, [rsp + 0x70]
lea rcx, [rax + 8]
call fcn.1400fecd0
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rdi + 0x198], xmm0
movsd xmm1, qword [rbp + 0x110]
movsd qword [rdi + 0x1a8], xmm1
lea rax, [0x14010b350]
mov qword [rdi], rax
mov qword [rsp + 0x20], rdi
cmp byte [rbp + 0xb0], 0
je 0x1401087d2
mov rax, qword [rbp + 0xc8]
mov rdx, qword [rax]
lea rcx, [rbp + 0xb8]
call rdx
nop
mov byte [rbp + 0xb0], 0
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1401087f0
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1401087f0
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rsp + 0x78]
call fcn.1400f0e80
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x118]
call r14
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14010881d
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp + 0x128]
mov rdx, qword [rax]
lea rcx, [rbp + 0x118]
call rdx
nop
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.14028bc60
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140108fe0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x140109049
cmp byte [rbx + 0x148], 0
je 0x140109017
lea rcx, [rbx + 0x150]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov byte [rbx + 0x148], 0
mov rcx, qword [rbx + 0xe8]
test rcx, rcx
je 0x140109038
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x140109038
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rbx + 0x10]
call fcn.1400f0e80
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140109096
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140109085
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140109085
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1401090a1
inc ecx
inc rax
cmp rax, 6
jl 0x140109073
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x1b8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010b1a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x14010b1eb
lea rbx, [rax + 8]
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14010b1db
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b1db
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, rbx
call fcn.1400f0e80
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010b238
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b227
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010b227
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010b243
inc ecx
inc rax
cmp rax, 6
jl 0x14010b215
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x168]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14010b270
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14010b29c
add rcx, 0x10
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010b2e9
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b2d8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010b2d8
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010b2f4
inc ecx
inc rax
cmp rax, 6
jl 0x14010b2c6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x78]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14010b4a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14048a080]
xor rax, rsp
mov qword [rbp + 0x128], rax
mov rdi, rdx
xor esi, esi
mov rax, qword [rcx + 0x28]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x40]
call rbx
nop
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0x108], rcx
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x118], rax
lea rax, fcn.140009110
mov qword [rsp + 0x50], rax
lea rax, [0x1404048f8]
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call rax
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x120], rax
lea rax, [0x140403eb0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
lea rax, [fcn.140009110]
cmp rdx, rax
je 0x14010b570
lea rcx, [rsp + 0x40]
call rdx
nop
mov rcx, qword [rbp + 0x118]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010b5a4
lea rcx, [0x14010c6a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xf8]
call rax
jmp 0x14010b64b
mov r14, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14010c320
mov rdi, rax
mov qword [rsp + 0x30], rax
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b5d2
mov rsi, qword [rax + 8]
mov r8d, 0x198
mov rdx, rsi
call fcn.140100af0
mov rbx, rax
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14010c320
lea rax, [0x14010c840]
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdi + 0x108]
test rcx, rcx
je 0x14010b61f
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b61f
mov rax, qword [rcx]
call qword [rax + select]
lea rcx, [rdi + 0x30]
call fcn.1400f0e80
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf8]
call r14
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14010b64b
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp + 0x108]
mov rdx, qword [rax]
lea rcx, [rbp + 0xf8]
call rdx
nop
mov rcx, qword [rbp + 0x128]
xor rcx, rsp
call fcn.14028bc60
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010b960
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010b9ab
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14010b995
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010b995
mov rax, qword [rcx]
call qword [rax + select]
nop
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax]
lea rcx, [rbx + 8]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010b9f8
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010b9e7
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010b9e7
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010ba03
inc ecx
inc rax
cmp rax, 6
jl 0x14010b9d5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x68]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010ba30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x14010ba95
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x14010ba67
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14010ba67
mov rax, qword [rcx]
call qword [rax + select]
cmp byte [rbx + 0x58], 0
je 0x14010ba7f
lea rcx, [rbx + 0x60]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
call rdx
nop
mov byte [rbx + 0x58], 0
mov rax, qword [rbx + 0x20]
mov rdx, qword [rax]
lea rcx, [rbx + 0x10]
call rdx
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14010bae3
mov ecx, dword [0x140e34fa4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010bad2
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14010bad2
mov ecx, 4
mov eax, ecx
nop
cmp qword [rdx + rax*8], 0
je 0x14010baee
inc ecx
inc rax
cmp rax, 6
jl 0x14010bac0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xf0]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret