joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005bc20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov dword [rsp + 0x58], 0
mov rdx, rcx
mov rbx, r8
mov rcx, qword [0x1400e8c20]
call fcn.14005fcbc
test rax, rax
je 0x14005bc88
cmp qword [rax + 8], 0
mov rdx, rdi
je 0x14005bc6e
mov r8, rbx
mov rcx, rax
call fcn.14005bdb0
cdqe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14005bca0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x14005bd9a
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x14005bcfb
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x14005bd5c
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x14005bd54
sub edx, 1
je 0x14005bd4b
cmp edx, 2
je 0x14005bd44
mov r8, rbx
mov rdx, r14
call fcn.140029110
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x14005bd2a
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x14005bd2a
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x14005bd2a
mov rcx, rsi
call fcn.14005bb30
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x14005bd8b
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x14005bd30
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x14005bd25
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005bdb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov rdi, r8
mov r15, rdx
mov r14, rcx
cmp dword [rcx + 0x1c], ebp
jne 0x14005bde7
call fcn.14005bb30
mov dword [r14 + 0x1c], 1
mov dword [r14 + 0x14], ebp
movsxd r12, dword [r14 + 0x14]
mov eax, dword [r14 + 0x18]
mov rbx, r12
sub eax, r12d
movsxd rdx, eax
add rdx, qword [r14 + 8]
cmp r12, rdi
jl 0x14005be60
mov rax, rdi
sub rax, 1
je 0x14005be51
sub rax, 1
je 0x14005be3e
cmp rax, 2
je 0x14005be2d
mov r8, rdi
mov rcx, r15
call fcn.140029110
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14005beda
mov eax, dword [rdx]
mov dword [r15], eax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14005beda
movzx eax, word [rdx]
mov word [r15], ax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14005beda
movzx eax, byte [rdx]
mov byte [r15], al
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14005beda
mov r8, rbx
mov rcx, r15
call fcn.140029110
movsxd r8, dword [r14 + 0x10]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
add r15, rbx
sub rdi, rbx
mov qword [rsp + 0x20], rbp
cmp rdi, r8
jl 0x14005bea0
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
add eax, r12d
mov dword [r14 + 0x14], ebp
jmp 0x14005bed8
mov rdx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x60]
mov rcx, r15
mov rdx, qword [r14 + 8]
cmp rdi, rax
mov rbx, rax
mov dword [r14 + 0x14], eax
cmovle rbx, rdi
mov dword [r14 + 0x18], eax
mov r8, rbx
call fcn.140029110
sub dword [r14 + 0x14], ebx
lea eax, [rbx + r12]
cdqe
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14005cee0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r14d, dword [rsp + 0x48]
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r14b, 0x10
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov esi, r9d
mov r11d, edx
cmove rbx, rax
mov r10, rcx
mov r12, r8
mov r15, r8
test edx, edx
jle 0x14005cfd1
lea eax, [r9 - 4]
mov r13d, 0x3d3d
movsxd rdi, eax
nop dword [rax + rax]
mov rdx, r8
sub rdx, r15
cmp r11d, 3
jae 0x14005d048
mov r9d, r14d
and r9d, 0x20
cmp r11d, 2
jne 0x14005cff8
test r9d, r9d
je 0x14005cf71
lea eax, [rsi - 3]
movsxd rcx, eax
cmp rdx, rcx
jmp 0x14005cf74
cmp rdx, rdi
jge 0x14005d0c4
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10]
add r10, 2
shl rcx, 8
or rcx, rax
shl rcx, 2
mov rax, rcx
shr rax, 0xc
movzx eax, byte [rax + rbx]
mov byte [r8], al
mov rax, rcx
shr rax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r8 + 1], al
movzx eax, byte [rcx + rbx]
mov byte [r8 + 2], al
add r8, 3
test r9d, r9d
jne 0x14005d0b2
mov byte [r8], 0x3d
inc r8
mov byte [r8], 0
sub r8, r12
mov rax, r8
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
test r9d, r9d
je 0x14005d008
lea eax, [rsi - 2]
movsxd rcx, eax
cmp rdx, rcx
jmp 0x14005d00b
cmp rdx, rdi
jge 0x14005d0c4
movzx ecx, byte [r10]
inc r10
shl rcx, 4
mov rax, rcx
and ecx, 0x3f
shr rax, 6
movzx eax, byte [rax + rbx]
mov byte [r8], al
movzx eax, byte [rcx + rbx]
mov byte [r8 + 1], al
add r8, 2
test r9d, r9d
jne 0x14005d0b2
mov word [r8], r13w
add r8, 2
jmp 0x14005d0b2
cmp rdx, rdi
jge 0x14005d0c4
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10 + 2]
movzx r9d, byte [r10]
add r10, 3
shl r9, 8
or r9, rax
shl r9, 8
or r9, rcx
mov rax, r9
shr rax, 6
and eax, 0x3f
movsx edx, byte [rax + rbx]
mov rax, r9
and eax, 0x3f
movsx ecx, byte [rax + rbx]
mov rax, r9
shr rax, 0xc
and eax, 0x3f
shl ecx, 8
or edx, ecx
shr r9, 0x12
shl edx, 8
movsx eax, byte [rax + rbx]
or edx, eax
movsx eax, byte [r9 + rbx]
shl edx, 8
or edx, eax
mov dword [r8], edx
add r8, 4
sub r11d, 3
test r11d, r11d
jg 0x14005cf40
jmp 0x14005cfd1
xor eax, eax
jmp 0x14005cfdb
Function at 0x14005de90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14005e0e0
mov r11d, eax
lea edx, [rax*4]
movsxd r9, edx
test edx, edx
jle 0x14005df0d
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rcx, [rbx + 8]
nop
mov edx, dword [rcx - 8]
add r10, 4
mov eax, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rcx - 8], eax
lea rcx, [rcx + 0x10]
mov eax, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rcx - 0x14]
mov dword [rcx - 0x14], eax
mov eax, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rcx - 0x10]
mov dword [rcx - 0x10], eax
mov eax, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rcx - 0xc]
mov dword [rcx - 0xc], eax
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x14005dec0
cmp r11d, 1
jle 0x14005e0c9
mov qword [rsp + 0x30], rdi
lea r10d, [r11 - 1]
lea rdi, [0x140000000]
add rbx, 4
nop dword [rax + rax]
mov r9d, dword [rbx + 0x10]
lea rbx, [rbx + 0x10]
mov edx, dword [rbx - 4]
movzx eax, byte [rbx - 3]
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0xc6ad0]
movzx eax, byte [rdi + rax*4 + 0xc5ed0]
xor r8d, dword [rdi + rax*4 + 0xc62d0]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
movzx eax, byte [rbx - 2]
xor r8d, dword [rdi + rcx*4 + 0xc6ed0]
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xc66d0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0xc5ed0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xc66d0]
movzx eax, byte [rdi + rcx*4 + 0xc5ed0]
xor r8d, dword [rdi + rax*4 + 0xc6ad0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
movzx eax, r9b
mov r9d, dword [rbx + 4]
xor r8d, dword [rdi + rcx*4 + 0xc62d0]
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xc6ed0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx], r8d
movzx edx, byte [rdi + rcx*4 + 0xc5ed0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xc66d0]
movzx eax, byte [rdi + rcx*4 + 0xc5ed0]
xor r8d, dword [rdi + rax*4 + 0xc6ad0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
movzx eax, r9b
mov r9d, dword [rbx + 8]
xor r8d, dword [rdi + rcx*4 + 0xc62d0]
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xc6ed0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [rbx + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0xc5ed0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xc66d0]
movzx eax, byte [rdi + rcx*4 + 0xc5ed0]
xor r8d, dword [rdi + rax*4 + 0xc6ad0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xc62d0]
movzx ecx, byte [rdi + rax*4 + 0xc5ed0]
xor r8d, dword [rdi + rcx*4 + 0xc6ed0]
mov dword [rbx + 8], r8d
sub r10, 1
jne 0x14005df30
mov rdi, qword [rsp + 0x30]
mov eax, r11d
add rsp, 0x20
pop rbx
ret
Function at 0x14005f760
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
bt r8d, 0x10
jae 0x14005f96f
mov r11, rsp
push r12
push r14
sub rsp, 0xe8
mov rax, qword [0x1400e3aa8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, rdx
mov r14, rcx
test rcx, rcx
je 0x14005f954
mov eax, dword [rcx]
mov qword [r11 + 0x18], rbx
cdq
mov qword [r11 - 0x18], rbp
and edx, 7
mov ebp, dword [rsp + 0x120]
add eax, edx
sar eax, 3
mov qword [r11 - 0x20], rsi
test r9, r9
mov qword [r11 - 0x28], rdi
lea rdi, [0x1400ad080]
mov qword [r11 - 0x30], r13
cmovne rdi, r9
mov qword [r11 - 0x38], r15
movsxd r15, dword [rcx + 4]
movsxd r13, eax
cmp ebp, 0x18
jne 0x14005f7fb
mov rcx, rdi
call fcn.140062660
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14005f7f0
jmp 0x14005f83a
cmp ebp, 0x19
jne 0x14005f81f
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14005f810
add rbx, rbx
jmp 0x14005f83a
mov rcx, rdi
call fcn.1400622c0
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14005f831
mov rdx, rdi
cmp rbx, r15
jle 0x14005f88d
mov r8d, ebx
mov rcx, r14
call qword [r12 + 0x18]
mov rcx, r14
call qword [r12 + 0x20]
lea rdx, [r14 + 8]
mov r8, r13
lea rcx, [rsp + 0x20]
call fcn.140029110
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, r13d
add rcx, r13
movsxd r8, eax
xor edx, edx
call fcn.1400276e0
mov edx, 1
mov rcx, r14
call qword [r12 + InitCommonControls]
jmp 0x14005f8b1
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.140029110
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, ebx
add rcx, rbx
movsxd r8, eax
xor edx, edx
call fcn.1400276e0
lea rcx, [r14 + 0x48]
mov r8, r15
lea rdx, [rsp + 0x20]
call fcn.140029110
mov r13, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x110]
test r15d, r15d
jle 0x14005f908
xor r9d, r9d
lea rcx, [rsp + 0x20]
mov rax, r14
sub rax, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, r9
inc r9
xor byte [rdx], 0x36
xor byte [rax + rdx + 0x48], 0x5c
cmp r9, r15
jl 0x14005f8f0
mov r8d, r15d
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [r12 + 0x18]
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xd8]
cmp ebp, 0x18
jne 0x14005f937
mov rcx, rdi
call fcn.140062650
jmp 0x14005f944
cmp ebp, 0x19
je 0x14005f944
mov rcx, rdi
call fcn.1400622b0
mov rbp, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140062750
add rsp, 0xe8
pop r14
pop r12
ret
Function at 0x14005fab4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400e81b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14005fb35
mov r8, qword [0x1400e81b0]
lea edx, [rax + 8]
mov rcx, qword [0x1400e5fb0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400e81b8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1400e81a8]
jmp 0x14005fb21
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14005fb1e
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14005fb0c
mov rdx, rdi
lea rcx, [0x14005fa18]
call fcn.1400087dc
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14005fb4c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbp, r8
mov rsi, rdx
and ecx, 7
je 0x14005fb76
mov eax, 8
sub eax, ecx
add edi, eax
mov rbx, qword [0x1400e81b0]
test rbx, rbx
jne 0x14005fbbc
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x1400e5fb0]
lea edx, [rbx + 8]
movsxd rdi, edi
mov r8, rdi
mov dword [0x1400e81b8], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400e81b8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1400e81b0]
jmp 0x14005fbbf
movsxd rdi, edi
mov ecx, dword [0x1400e81b8]
lea rax, [rdi + rbx]
mov qword [0x1400e81b0], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x1400e81b0]
mov edx, 8
mov rcx, qword [0x1400e5fb0]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1400e81b8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rsi, rsi
jne 0x14005fc0e
test rbp, rbp
je 0x14005fc35
mov edx, 0x28
lea rcx, [0x1400e81a8]
call fcn.140060744
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
test rsi, rsi
je 0x14005fc35
lea rcx, [rdi + rbx]
call rsi
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140061090
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e4754]
cmp ecx, 0xffffffff
jne 0x1400610a6
call fcn.140061580
jmp 0x1400610b6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400610d5
call fcn.1400619b0
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1400610e0]
add rsp, 0x28
jmp fcn.1400087dc
add rsp, 0x28
ret
Function at 0x1400611d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1400e4754]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rbx, qword [rax + rcx*8 + 0x18]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140061220
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rax, qword [rax + rcx*8 + 0x18]
mov qword [rdx + 0x10], rax
add rsp, 0x28
ret

Function at 0x140061250
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rdx, qword [rax + rcx*8 + 0x18]
mov qword [rax + 0x10], rdx
mov rax, qword [rax]
add rax, rdx
add rsp, 0x28
ret

Function at 0x140061290
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rax, qword [rax + rcx*8 + 0x18]
add rax, qword [rdx]
add rsp, 0x28
ret

Function at 0x1400612c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rax + 0x338]
mov rcx, qword [rax + 0x10]
mov qword [rax + rdx*8 + 0x18], rcx
inc qword [rax + 0x338]
add rsp, 0x28
ret

Function at 0x140061320
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
movsxd rbx, edx
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x1400e8ca0]
xor edx, edx
mov rsi, rax
mov rax, qword [r14]
mov r8d, dword [rsi + 0x10]
sub r8d, ebx
movsxd rdi, r8d
lea r9, [rdi + 0xa]
test rax, rax
jne 0x140061374
mov r8, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x14006137d
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [r14], rax
mov rcx, rax
mov rdx, qword [rsi]
shr rdi, 1
add rdx, rbx
mov r8d, edi
call fcn.140061800
mov rdi, qword [rsp + 0x40]
mov qword [rsi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x1400613d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add qword [rax + 0x10], 2
add rsp, 0x28
ret
Function at 0x1400613f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1400e4754]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov qword [rax + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]

Function at 0x140061580
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400e8ca0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400e4754], eax
add rsp, 0x28
jmp fcn.1400619b0

Function at 0x1400615b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov ecx, edi
mov edx, 0xffffffff
call fcn.140061620
movzx r9d, word [rbx]
mov rcx, rax
mov r8d, edi
test r9w, r9w
je 0x1400615fc
sub rbx, rax
nop
test r8d, r8d
je 0x1400615fc
mov word [rax], r9w
dec r8d
movzx r9d, word [rbx + rax + 2]
add rax, 2
test r9w, r9w
jne 0x1400615e0
xor edx, edx
mov word [rax], dx
sub rax, rcx
sar rax, 1
sub edi, eax
mov ecx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400616d0

Function at 0x140061620
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, ecx
mov esi, edx
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp esi, 0xffffffff
jne 0x140061650
mov esi, dword [rax + 0x10]
mov eax, dword [rax + 0x10]
mov r8, qword [rbx + 8]
lea edx, [rax + rbp*2]
movsxd rax, edx
lea rcx, [r8 - 4]
cmp rax, rcx
jl 0x140061671
lea eax, [rdx + 0x4000]
movsxd r9, eax
jmp 0x140061683
mov eax, 0x100000
cmp r8, rax
jle 0x1400616a0
cmp edx, eax
cmovl edx, eax
mov r9d, edx
mov r8, qword [rbx]
xor edx, edx
mov qword [rbx + 8], r9
add r9, 0xa
mov rcx, qword [0x1400e8ca0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbx], rax
mov rax, qword [rbx]
movsxd rdx, esi
mov rsi, qword [rsp + 0x40]
add rax, rdx
lea rcx, [rdx + rbp*2]
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400616d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [rbx + rbx]
movsxd rdx, ecx
sub qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
ret

Function at 0x140061790
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x1400617c4
mov rdx, qword [rax + 0x10]
add rdx, rcx
cmp rbx, rdx
ja 0x1400617c4
sub ebx, ecx
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400617d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec rbx
mov rax, qword [rax]
add rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140061840
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x1400e4754]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rbx, qword [rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400619b0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1400e8ca0]
xor edx, edx
mov r8d, 0x340
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x1400e8ca0]
xor edx, edx
mov rbx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], InitCommonControls
mov rdx, rbx
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x338], rax
mov ecx, dword [0x1400e4754]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x140821058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408211df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140821089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14082106f
add dl, dl
jne 0x140821096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408210f6
xor eax, eax
add dl, dl
jne 0x1408210a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408211ad
add dl, dl
jne 0x1408210b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408210c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408210d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408210dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408210ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14082107e
mov eax, 1
add dl, dl
jne 0x140821106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140821113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408210fb
sub eax, ebx
mov ebx, 1
jne 0x14082114c
mov ecx, 1
add dl, dl
jne 0x14082112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14082113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140821123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14082107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140821168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140821175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14082115d
cmp eax, 0x7d00
jae 0x14082119b
cmp eax, 0x500
jb 0x140821196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14082107e
cmp eax, 0x7f
ja 0x14082119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14082107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408211d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14082107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20