joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002a10
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140002aa9
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword gs:[0x58]
mov edi, eax
mov eax, 8
mov dword [rsp + 0x24], 0
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x1400b5864], ecx
jle 0x140002a90
lea rcx, [0x1400b5864]
call fcn.14004c678
cmp dword [0x1400b5864], 0xffffffff
jne 0x140002a90
lea rcx, [0x140088500]
call fcn.14004c964
lea rcx, [0x1400b5864]
call fcn.14004c60c
lea rax, [0x1400aef80]
mov dword [rsp + 0x20], edi
test edi, edi
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x50]
jne 0x140002abe
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004c5b0
add rsp, 0x40
pop rbx
ret
lea rdx, [0x140096510]
lea rcx, [rsp + 0x20]
call fcn.1400028e0
int3

Function at 0x140002b90
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1400b5868], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140002c09
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004c5b0
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.140002c40]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004c5b0
add rsp, 0x40
pop rbx
ret

Function at 0x140004050
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140004089
mov rdx, qword [rax + 8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400099e0
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400099e0

Function at 0x1400040a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x1400040d0
mov r9, qword [rax + 8]
jmp 0x1400040d3
mov r9, r8
cmp rdi, 0x3fc
ja 0x1400040f7
test r9, r9
je 0x1400040f7
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x140004105
inc r8d
inc rax
cmp rax, 2
jl 0x1400040e4
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp case.0x1400459db.0
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x1400043a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x40
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
xor r14d, r14d
mov rbx, rcx
mov qword [rdx], r14
mov rsi, rdx
mov qword [rdx + 8], r14
mov rbp, r8
mov edx, r14d
mov rcx, qword [rax]
mov r9d, r14d
test rcx, rcx
je 0x140004407
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 8]
mov r9, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsi], r9
mov qword [rsi + 8], rdx
mov qword [rax], r14
cmp rbp, rdx
jbe 0x140004524
mov ebx, 6
test r9, r9
je 0x140004469
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140004431
mov rdx, qword [rax + 8]
jmp 0x140004434
mov rdx, r14
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
cmp r9, 0x3fc
ja 0x140004461
test rdx, rdx
je 0x140004461
mov ecx, ebx
mov rax, rbx
nop
cmp qword [rdx + rax*8], r14
je 0x1400044ca
inc ecx
inc rax
cmp rax, 8
jl 0x140004450
mov rcx, r8
call case.0x1400459db.0
mov ecx, dword [0x1400b5ba0]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdi, [rbp + 3]
shr rdi, 2
test rax, rax
je 0x1400044f6
mov r9, qword [rax + 8]
test r9, r9
je 0x1400044f6
mov ecx, ebx
lea r8, [r9 + 0x30]
mov rdx, qword [r8]
test rdx, rdx
je 0x1400044a6
movzx eax, byte [rdx]
cmp rax, rdi
jae 0x1400044db
inc ecx
add r8, 8
cmp ecx, 8
jl 0x140004496
mov rax, rbx
mov rcx, qword [r9 + rax*8]
test rcx, rcx
jne 0x1400044ea
inc ebx
inc rax
cmp rax, 8
jl 0x1400044b4
jmp 0x1400044f6
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x140004469
movsxd rax, ecx
mov qword [r9 + rax*8], r14
movzx eax, byte [rdx]
mov byte [rdx + rbp], al
jmp 0x140004518
movsxd rax, ebx
mov qword [r9 + rax*8], r14
call case.0x1400459db.0
lea rcx, [rdi*4 + 1]
call fcn.14004c6f0
cmp rdi, 0xff
movzx ecx, dil
mov rdx, rax
cmova ecx, r14d
mov byte [rax + rbp], cl
mov rdi, qword [rsp + 0x50]
mov qword [rsi], rdx
mov qword [rsi + 8], rbp
mov rax, rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004c5b0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140005fd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140005ff7
mov r8, qword [rax + 8]
jmp 0x140005ffa
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x140006022
test r8, r8
je 0x140006022
mov ecx, 2
mov eax, ecx
nop
cmp qword [r8 + rax*8], 0
je 0x140006034
inc ecx
inc rax
cmp rax, 4
jl 0x140006010
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp case.0x1400459db.0
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, ecx
mov qword [r8 + rax*8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006050
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x1400060f4
mov r10, qword [rax + 8]
test r10, r10
je 0x1400060f4
mov r9d, 2
lea r8, [r10 + 0x10]
mov ecx, r9d
mov rdx, qword [r8]
test rdx, rdx
je 0x1400060a3
movzx eax, byte [rdx]
cmp rax, rbx
jae 0x1400060c8
inc ecx
add r8, 8
cmp ecx, 4
jl 0x140006093
mov rax, r9
mov rcx, qword [r10 + rax*8]
test rcx, rcx
jne 0x1400060e8
inc r9d
inc rax
cmp rax, 4
jl 0x1400060b1
jmp 0x1400060f4
movsxd rcx, ecx
mov rax, rdx
mov qword [r10 + rcx*8], rsi
movzx ecx, byte [rdx]
mov byte [rdx + rdi], cl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, r9d
mov qword [r10 + rax*8], rsi
call case.0x1400459db.0
lea rcx, [rbx*4 + 1]
call fcn.14004c6f0
cmp rbx, 0xff
movzx ecx, bl
mov rbx, qword [rsp + 0x30]
cmova ecx, esi
mov rsi, qword [rsp + 0x38]
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
ret
Function at 0x14000a960
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov qword [rbp - 0x59], rdi
lea rax, str.Xl_t_
mov qword [rbp - 0x51], rax
mov rbx, qword [rcx + 0x18]
mov eax, edi
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x14000a9b2
mov rcx, rbx
call fcn.140004ef0
jmp 0x14000aa80
mov dword [rbp + 0x27], edi
lea rcx, [rbp + 0x2f]
call fcn.14003fd18
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
xor eax, eax
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rax
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x29]
mov qword [rbp - 0x41], rax
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x49]
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x29]
mov rcx, rbx
call fcn.140005150
test rax, rax
je 0x14000aa45
nop dword [rax]
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x29]
mov rcx, rbx
call fcn.140005150
test rax, rax
jne 0x14000aa30
mov rdx, qword [rbp - 0x39]
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rbp - 0x29]
mov edi, 0xa
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000aa6d
call case.0x1400459db.0
add rbx, 8
sub rdi, 1
jne 0x14000aa60
lea rcx, [rbp + 0x2f]
call fcn.14003fda4
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14004c5b0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000c2d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r13, r9
mov r12, r8
mov r15, rdx
mov rbp, rcx
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rdi]
mov rbx, qword [rbx + 0x78]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rdi
mov rdx, rdi
mov ecx, 0xc0
call fcn.140004050
mov r14, rax
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rax + 0x20], rcx
lea rax, [0x14000cda0]
mov qword [r14 + 0x28], rax
mov qword [r14], rcx
mov qword [r14 + 8], rcx
mov qword [r14 + 0x10], rcx
mov qword [r14 + 0x18], rcx
mov dword [r14 + 0x30], ecx
movups xmm0, xmmword [r13]
movups xmmword [r14 + 0x38], xmm0
lea rdx, [r14 + 0x48]
mov rax, qword [rdi]
mov qword [rdi], rcx
mov qword [rdx], rax
lea rcx, [r14 + 0x50]
mov r8, rsi
call fcn.14000cb80
mov qword [rsp + 0x40], r14
test rbx, rbx
je 0x14000c3eb
mov r8d, 0x58
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.1400043a0
lea rax, vtable.asio::detail::cancellation_handler_class_asio::detail::win_iocp_handle_service::iocp_op_cancellation_.0
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rax
mov rax, qword [r15]
xor esi, esi
mov qword [rdx + 0x28], rsi
lea r8, [0x1400056a0]
mov qword [rdx + 0x30], r8
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rsi
mov qword [rdx + 0x20], rsi
mov dword [rdx + 0x38], esi
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x48], r14
mov rax, qword [rsp + 0x50]
mov qword [rdx + 0x50], rax
mov qword [rbx], rdx
lea r14, [rdx + 8]
jmp 0x14000c3ed
xor esi, esi
mov rdi, qword [r13]
mov rbx, qword [r13 + 8]
cmp dword [r15 + 8], 0
jne 0x14000c408
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [r15 + 8], eax
jmp 0x14000c41c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [r15 + 8], eax
je 0x14000c41c
mov dword [r15 + 8], 0xffffffff
mov rax, qword [rbp + 0x28]
lock inc dword [rax + 0x30]
cmp qword [r15], 0xffffffffffffffff
jne 0x14000c441
xor r9d, r9d
mov r8d, 0x2719
mov rdx, r14
mov rcx, qword [rbp + 0x28]
call fcn.140005060
jmp 0x14000c4bf
test rbx, rbx
jne 0x14000c45a
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x28]
call fcn.140005060
jmp 0x14000c4bf
mov dword [rsp + 0x58], esi
mov dword [r14 + 0x10], r12d
shr r12, 0x20
mov dword [r14 + 0x14], r12d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x14000c4b3
cmp eax, 0x3e5
je 0x14000c4b3
cmp eax, 0xea
je 0x14000c4b3
mov r9d, dword [rsp + 0x58]
mov r8d, eax
mov rdx, r14
mov rcx, qword [rbp + 0x28]
call fcn.140005060
jmp 0x14000c4bf
mov rdx, r14
mov rcx, qword [rbp + 0x28]
call fcn.140004fd0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x30]
call fcn.14000c8f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004c5b0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000cf30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor esi, esi
mov rax, qword [rdx]
mov qword [rdx], rsi
mov qword [rbp - 0x69], rax
lea rdx, [rbp - 0x49]
call fcn.1400042e0
nop
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x11]
call fcn.14000d3f0
mov rbx, rax
cmp qword [rax + 0x20], rsi
je 0x14000d0aa
mov rcx, qword [rax + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14000cfb0
lea rcx, [0x14000d8a0]
mov qword [rbp - 0x59], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x51], rcx
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rax
jmp 0x14000d04f
mov rdi, qword [rcx + 0x10]
mov rax, qword [rbp - 0x69]
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x71], rax
lea rax, [rbp - 0x71]
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x79]
mov qword [rbp + 0x27], rax
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000cfe7
mov rdx, qword [rax + 8]
jmp 0x14000cfea
mov rdx, rsi
mov r8d, 0x18
call fcn.14000d8c0
mov qword [rbp + 0x37], rsi
mov rcx, qword [rbp - 0x71]
mov qword [rbp - 0x71], rsi
mov qword [rax + 8], rcx
lea rcx, [0x14000da50]
mov qword [rax], rcx
mov qword [rbp - 0x61], rax
mov qword [rbp + 0x2f], rsi
lea rcx, [rbp + 0x27]
call fcn.14000d7f0
nop
mov rax, qword [rbp - 0x71]
test rax, rax
je 0x14000d034
mov rdx, qword [rax]
mov rcx, rdx
call qword [rdx + 8]
nop
lea rdx, [rbp - 0x61]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14000d04f
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp qword [rbp + 0xf], 0
je 0x14000d064
mov rax, qword [rbp + 7]
mov rdx, qword [rax]
lea rcx, [rbp - 0x11]
call rdx
nop
cmp qword [rbp - 0x29], 0
je 0x14000d079
mov rax, qword [rbp - 0x31]
mov rdx, qword [rax]
lea rcx, [rbp - 0x49]
call rdx
nop
mov rax, qword [rbp - 0x69]
test rax, rax
je 0x14000d08b
mov rdx, qword [rax]
mov rcx, rdx
call qword [rdx + 8]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14004c5b0
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp + 0x27]
call fcn.140004140
nop
lea rcx, [rbp + 0x27]
call fcn.140009ab0
int3
Function at 0x14000d180
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, r8
mov r8, rdx
cmp qword [rcx + 0x20], 0
jne 0x14000d1de
cmp qword [rcx + 0x58], 0
jne 0x14000d1de
mov rdx, rax
mov rcx, r8
call fcn.14000d4e0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14004c5b0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
lea rbx, [rcx + 0x38]
cmp qword [rbx + 0x20], 0
je 0x14000d2cf
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14000d214
lea rcx, [0x14000da40]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r8
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
jmp 0x14000d1bf
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx]
xor esi, esi
mov qword [rdx], rsi
mov qword [rbp - 0x50], rax
movups xmm0, xmmword [rdx + 8]
movups xmmword [rbp - 0x48], xmm0
mov rax, qword [rdx + 0x18]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], rax
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000d25b
mov rdx, qword [rax + 8]
jmp 0x14000d25e
mov rdx, rsi
mov r8d, 0x30
call fcn.14000d8c0
mov qword [rbp - 0x10], rsi
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x50], rsi
mov qword [rax + 8], rcx
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rbp - 0x38]
mov qword [rax + 0x20], rcx
lea rcx, [0x14000dae0]
mov qword [rax], rcx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x18], rsi
lea rcx, [rbp - 0x20]
call fcn.14000d9a0
nop
lea rcx, [rbp - 0x50]
call fcn.14000bfb0
nop
lea rdx, [rbp - 0x58]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000d2ca
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14000d1bf
lea rcx, [rbp - 0x20]
call fcn.140004140
nop
lea rcx, [rbp - 0x20]
call fcn.140009ab0
int3

Function at 0x14000d680
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400ae368]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 8]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x78]
test rbx, rbx
je 0x14000d71e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000d71e
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rdi
call qword [rax + 8]
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000d6d4
mov rdx, qword [rax + 8]
jmp 0x14000d6d6
xor edx, edx
mov r9, qword [rsp + 0x28]
mov rdi, rbx
mov r8, qword [rsp + 0x20]
cmp r9, 0x3fc
ja 0x14000d70a
test rdx, rdx
je 0x14000d70a
mov ecx, 6
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14000d731
inc ecx
inc rax
cmp rax, 8
jl 0x14000d6f8
mov rcx, r8
call case.0x1400459db.0
mov qword [rdi], 0
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004c5b0
add rsp, 0x40
pop rbx
ret
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x14000d712
Function at 0x14000d7f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x14000d820
mov rax, qword [rax + 8]
test rax, rax
je 0x14000d818
mov rax, qword [rax]
mov rcx, rax
call qword [rax + 8]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14000d872
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000d862
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000d862
mov ecx, 4
mov eax, ecx
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x14000d87d
inc ecx
inc rax
cmp rax, 6
jl 0x14000d850
mov rcx, rbx
call case.0x1400459db.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x18]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14000d9a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14000d9c7
add rcx, 8
call fcn.14000bfb0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14000da13
mov ecx, dword [0x1400b5ba0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000da03
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000da03
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14000da1e
inc ecx
inc rax
cmp rax, 6
jl 0x14000d9f1
mov rcx, rbx
call case.0x1400459db.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x30]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14000e4a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x14000e538
test r8, r8
jle 0x14000e530
nop word [rax + rax]
mov rcx, rdi
call fcn.1400082e0
test rax, rax
jle 0x14000e50e
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.14004e9c0
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14000e528
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000e530
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14000e4d0
sub r14, rbx
mov rax, r14
jmp 0x14000e5b6
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x14000e551
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000e553
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14000e5ab
test ecx, ecx
jle 0x14000e58c
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.14004e9c0
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14000e5ab
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000e5ab
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1400576c0
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000e5d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000e5f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000e66c
mov rdi, r14
mov rcx, rbx
call fcn.140008300
test rax, rax
jle 0x14000e644
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14004e9c0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000e65c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000e664
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000e606
sub r14, rdi
jmp 0x14000e74f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000e683
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000e685
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000e6b7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14004e9c0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000e74c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000e6f2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000e72d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140057d68
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000e74c
cmp rbp, rax
ja 0x14000e700
test rbp, rbp
je 0x14000e74c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140057d68
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret