joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400daf50
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
lea rax, [rsp + 0x50]
mov rbx, rdx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], esi
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400db078
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x1400db078
mov eax, dword [rbx + 8]
cmp r8d, eax
jle 0x1400dafbc
mov dword [rbx + 8], r8d
cmp r8d, dword [rbx + 0xc]
jle 0x1400dafd7
mov edx, eax
mov rcx, rbx
call fcn.140040820
jmp 0x1400dafd2
jge 0x1400dafd7
mov ecx, eax
sub ecx, r8d
je 0x1400dafd7
sub eax, ecx
mov rcx, rbx
mov dword [rbx + 8], eax
call fcn.14008e070
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rbx]
lea r9, [rsp + 0x58]
mov rcx, rdi
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400db066
mov eax, dword [rsp + 0x58]
cmp eax, dword [rsp + 0x50]
jae 0x1400db054
movsxd rdi, dword [rbx + 8]
cmp eax, edi
jle 0x1400db03f
mov esi, eax
mov dword [rbx + 8], eax
sub esi, edi
cmp eax, dword [rbx + 0xc]
jle 0x1400db01d
mov edx, edi
mov rcx, rbx
call fcn.140040820
mov rcx, rdi
movsxd r8, esi
add rcx, qword [rbx]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
jge 0x1400db054
mov ecx, edi
sub ecx, eax
je 0x1400db054
sub edi, ecx
mov rcx, rbx
mov dword [rbx + 8], edi
call fcn.14008e070
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx + 8], esi
cmp dword [rbx + 0xc], esi
je 0x1400db078
xor edx, edx
mov rcx, rbx
call fcn.1400a51a0
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400db0a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
lea rcx, str.Win_RequestExit
call fcn.1400a4c20
lea rcx, [0x140351110]
call fcn.140013790
test bl, bl
je 0x1400db110
call fcn.1400b1640
test rax, rax
je 0x1400db0eb
call fcn.1400b1640
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x68]
call fcn.1400b1640
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
movzx eax, byte [0x1403b7362]
neg al
sbb ebx, ebx
and ebx, 3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostQuitMessage]

Function at 0x1400db540
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call fcn.140029190
call fcn.1400d2410
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
Function at 0x1400dbcf0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x60]
movaps xmm6, xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mulss xmm6, dword [0x140274780]
cvttss2si rax, xmm6
test eax, eax
jne 0x1400dbd22
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x1400dbd2a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x50]
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x28], rax
lea rdx, [0x14034e1c0]
lea rax, [0x1400292a0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.14004e100
lea rcx, [rsp + 0x58]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [rsp + 0x58]
sub ecx, dword [rsp + 0x60]
add dword [rbx + 0x10], ecx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
Function at 0x1400dc0e0
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov ecx, dword [0x140442618]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140419a00], eax
jg 0x1400dc2cb
mov ecx, dword [0x1404199f8]
test ecx, ecx
je 0x1400dc125
lea eax, [rcx - 1]
test eax, eax
jne 0x1400dc2b4
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1402ff110]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400dc2ae
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov edx, r14d
mov dword [rbp - 0x28], edx
mov ecx, r14d
mov dword [rbp - 0x24], ecx
test rdi, rdi
je 0x1400dc1c9
cmp word [rdi], cx
je 0x1400dc1c9
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], cx
jne 0x1400dc184
inc ebx
test ebx, ebx
jle 0x1400dc1a4
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.14001ca50
mov ecx, dword [rbp - 0x24]
mov edx, dword [rbp - 0x28]
lea eax, [rbx + rdx]
mov dword [rbp - 0x28], eax
cmp eax, ecx
jle 0x1400dc1b7
lea rcx, [rbp - 0x30]
call fcn.14001c660
mov rcx, qword [rbp - 0x30]
mov rdx, rdi
movsxd r8, ebx
add r8, r8
call fcn.140034be0
lea r9, [0x140270c00]
mov dword [rsp + 0x20], 1
lea r8, [0x1402667e0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.1400218d0
mov rcx, qword [rax]
mov r9d, dword [rax + 8]
mov qword [rax], r14
mov qword [rbp - 0x40], rcx
mov ecx, dword [rax + 0xc]
mov qword [rax + 8], r14
mov eax, r9d
neg eax
mov dword [rbp - 0x38], r9d
mov dword [rbp - 0x34], ecx
sbb edx, edx
add edx, 2
add edx, r9d
cmp edx, ecx
jle 0x1400dc222
lea rcx, [rbp - 0x40]
call fcn.14001ca50
mov r8d, 1
lea rdx, [0x140270c00]
lea rcx, [rbp - 0x40]
call fcn.14001ee30
mov rcx, qword [0x1404199f0]
mov rsi, qword [rbp - 0x40]
mov ebx, dword [rbp - 0x38]
mov edi, dword [rbp - 0x34]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1400dc260
call fcn.14004dcf0
mov rcx, qword [rbp - 0x20]
mov qword [0x1404199f0], rsi
mov rsi, qword [rsp + 0x90]
mov dword [0x1404199f8], ebx
mov rbx, qword [rsp + 0x88]
mov dword [0x1404199fc], edi
mov rdi, qword [rsp + 0x68]
test rcx, rcx
je 0x1400dc296
call fcn.14004dcf0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400dc2a4
call fcn.14004dcf0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [0x1404199f8]
test ecx, ecx
lea rax, [0x1402655d8]
cmovne rax, qword [0x1404199f0]
add rsp, 0x70
pop rbp
ret
lea rcx, [0x140419a00]
call fcn.14024fed0
cmp dword [0x140419a00], 0xffffffff
jne 0x1400dc110
lea rcx, [0x140260cd0]
call fcn.14024fd30
lea rcx, [0x140419a00]
call fcn.14024fe70
jmp 0x1400dc110
Function at 0x1400dc310
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x1400dc3a3
cmp word [0x140419c50], 0
jne 0x1400dc397
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
lea rcx, [0x140419c50]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movzx eax, word [0x140419c50]
lea rbx, [0x140419c50]
lea rdi, [0x140419c50]
test ax, ax
je 0x1400dc388
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalnum]
test eax, eax
je 0x1400dc37b
movzx eax, word [rbx]
mov word [rdi], ax
add rdi, 2
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1400dc364
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov word [rdi], cx
mov rdi, qword [rsp + 0x20]
lea rax, [0x140419c50]
add rsp, 0x28
ret
cmp word [0x140419a50], 0
jne 0x1400dc3c7
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x100
lea rcx, [0x140419a50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [0x140419a50]
add rsp, 0x28
ret
Function at 0x1400dc3e0
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov ecx, dword [0x140442618]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140419a30], eax
jg 0x1400dc5cb
mov ecx, dword [0x140419a28]
test ecx, ecx
je 0x1400dc425
lea eax, [rcx - 1]
test eax, eax
jne 0x1400dc5b4
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1402ff130]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400dc5ae
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov edx, r14d
mov dword [rbp - 0x28], edx
mov ecx, r14d
mov dword [rbp - 0x24], ecx
test rdi, rdi
je 0x1400dc4c9
cmp word [rdi], cx
je 0x1400dc4c9
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], cx
jne 0x1400dc484
inc ebx
test ebx, ebx
jle 0x1400dc4a4
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.14001ca50
mov ecx, dword [rbp - 0x24]
mov edx, dword [rbp - 0x28]
lea eax, [rbx + rdx]
mov dword [rbp - 0x28], eax
cmp eax, ecx
jle 0x1400dc4b7
lea rcx, [rbp - 0x30]
call fcn.14001c660
mov rcx, qword [rbp - 0x30]
mov rdx, rdi
movsxd r8, ebx
add r8, r8
call fcn.140034be0
lea r9, [0x140270c00]
mov dword [rsp + 0x20], 1
lea r8, [0x1402667e0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.1400218d0
mov rcx, qword [rax]
mov r9d, dword [rax + 8]
mov qword [rax], r14
mov qword [rbp - 0x40], rcx
mov ecx, dword [rax + 0xc]
mov qword [rax + 8], r14
mov eax, r9d
neg eax
mov dword [rbp - 0x38], r9d
mov dword [rbp - 0x34], ecx
sbb edx, edx
add edx, 2
add edx, r9d
cmp edx, ecx
jle 0x1400dc522
lea rcx, [rbp - 0x40]
call fcn.14001ca50
mov r8d, 1
lea rdx, [0x140270c00]
lea rcx, [rbp - 0x40]
call fcn.14001ee30
mov rcx, qword [0x140419a20]
mov rsi, qword [rbp - 0x40]
mov ebx, dword [rbp - 0x38]
mov edi, dword [rbp - 0x34]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1400dc560
call fcn.14004dcf0
mov rcx, qword [rbp - 0x20]
mov qword [0x140419a20], rsi
mov rsi, qword [rsp + 0x90]
mov dword [0x140419a28], ebx
mov rbx, qword [rsp + 0x88]
mov dword [0x140419a2c], edi
mov rdi, qword [rsp + 0x68]
test rcx, rcx
je 0x1400dc596
call fcn.14004dcf0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400dc5a4
call fcn.14004dcf0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [0x140419a28]
test ecx, ecx
lea rax, [0x1402655d8]
cmovne rax, qword [0x140419a20]
add rsp, 0x70
pop rbp
ret
lea rcx, [0x140419a30]
call fcn.14024fed0
cmp dword [0x140419a30], 0xffffffff
jne 0x1400dc410
lea rcx, [0x140260cf0]
call fcn.14024fd30
lea rcx, [0x140419a30]
call fcn.14024fe70
jmp 0x1400dc410
Function at 0x1400dc610
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x488
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140442618]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140419a18], eax
jg 0x1400dc802
mov ecx, dword [0x140419a10]
test ecx, ecx
je 0x1400dc665
lea eax, [rcx - 1]
test eax, eax
jne 0x1400dc7d9
mov qword [rsp + 0x490], rbx
lea rcx, [rsp + 0x260]
xor edx, edx
mov qword [rsp + 0x480], rdi
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor edi, edi
mov edx, edi
mov ecx, edi
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], ecx
mov qword [rsp + 0x30], rdi
cmp word [rsp + 0x50], di
je 0x1400dc73d
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], cx
jne 0x1400dc6f0
inc ebx
test ebx, ebx
jle 0x1400dc713
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14001ca50
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x38]
lea eax, [rdx + rbx]
mov dword [rsp + 0x38], eax
cmp eax, ecx
jle 0x1400dc728
lea rcx, [rsp + 0x30]
call fcn.14001c660
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
movsxd r8, ebx
add r8, r8
call fcn.140034be0
lea r9, [0x140270c00]
mov dword [rsp + 0x20], 1
lea r8, [0x1402667e0]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400218d0
mov rbx, rax
lea rax, [0x140419a08]
cmp rax, rbx
je 0x1400dc7a5
mov rcx, qword [0x140419a08]
test rcx, rcx
je 0x1400dc782
call fcn.14004dcf0
mov rcx, qword [rbx]
mov qword [0x140419a08], rcx
mov qword [rbx], rdi
mov eax, dword [rbx + 8]
mov dword [0x140419a10], eax
mov eax, dword [rbx + 0xc]
mov dword [0x140419a14], eax
mov qword [rbx + 8], rdi
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x490]
test rcx, rcx
je 0x1400dc7c4
call fcn.14004dcf0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400dc7d3
call fcn.14004dcf0
mov ecx, dword [0x140419a10]
test ecx, ecx
lea rax, [0x1402655d8]
cmovne rax, qword [0x140419a08]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140250070
add rsp, 0x488
ret
lea rcx, [0x140419a18]
call fcn.14024fed0
cmp dword [0x140419a18], 0xffffffff
jne 0x1400dc650
lea rcx, [0x140260d10]
call fcn.14024fd30
lea rcx, [0x140419a18]
call fcn.14024fe70
jmp 0x1400dc650

Function at 0x1400dcf50
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
test r8d, r8d
je 0x1400dcf8f
test rcx, rcx
je 0x1400dcf8f
xor eax, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test rbx, rbx
je 0x1400dcf91
mov ecx, dword [rsp + 0x50]
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x14010faa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rcx
and rbx, 0xffffffffffffc000
cmp qword [rbx + 0x60], 0
je 0x14010fc10
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [rbx + 0x68]
jne 0x14010fc10
mov rax, qword [rbx + 0x60]
mov byte [rax + 0x344], 0
mov eax, 0xffff
add word [rbx + 0x74], ax
jne 0x14010fbad
movzx ecx, word [rbx + 0x76]
mov r9, qword [rbx + 0x60]
call fcn.140110320
mov r8d, eax
inc r8
lea rax, [r8 + r8*2]
cmp rbx, qword [r9 + rax*8]
je 0x14010fb81
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14010fb19
mov rax, qword [rbx + 0x40]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14010fb2a
mov rax, qword [rbx + 0x48]
mov qword [rcx + 0x48], rax
mov rcx, qword [rbx + 0x20]
lea rax, [rbx + 0x4000]
xor r8d, r8d
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x40], r8
mov qword [rbx + 0x48], r8
mov qword [rbx + 0x58], r8
mov dword [rbx + 0x74], r8d
mov byte [rbx + 0x78], r8b
mov qword [rbx + 0x60], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
mov ecx, dword [rcx + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rbx
lea rcx, [rax + 0x300]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140110cf0
movzx eax, word [rbx + 0x76]
mov rcx, rbx
sub rcx, rax
mov edx, 0x4000
add rcx, rdx
xor r8d, r8d
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], r8
mov byte [rbx + 0x78], r8b
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbx + 0x76]
mov eax, 0x400
cmp cx, ax
jbe 0x14010fbf1
test dil, 0x7f
jne 0x14010fbf1
movzx eax, bx
movzx r8d, cx
sub ax, di
mov edx, 0x4000
add ax, dx
xor edx, edx
movzx eax, ax
div r8d
test dx, dx
je 0x14010fbe8
movzx eax, dx
sub r8d, eax
jmp 0x14010fbeb
xor r8d, r8d
movsxd rax, r8d
sub rdi, rax
mov rax, qword [rbx + 0x58]
xor edx, edx
mov qword [rdi], rax
mov rcx, rbx
mov qword [rbx + 0x58], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14010ef70
movzx ecx, word [rbx + 0x76]
mov eax, 0x400
cmp cx, ax
jbe 0x14010fc54
test dil, 0x7f
jne 0x14010fc54
movzx eax, bx
movzx r8d, cx
sub ax, di
mov edx, 0x4000
add ax, dx
xor edx, edx
movzx eax, ax
div r8d
test dx, dx
je 0x14010fc4b
movzx eax, dx
sub r8d, eax
jmp 0x14010fc4e
xor r8d, r8d
movsxd rax, r8d
sub rdi, rax
mov rax, qword [rbx + 0x10]
nop dword [rax + rax]
mov qword [rdi], rax
mov rcx, rax
lock cmpxchg qword [rbx + 0x10], rdi
cmp rax, rcx
jne 0x14010fc60
test rcx, rcx
jne 0x14010fca3
mov qword [rsp + 0x30], rsi
mov rsi, qword [rbx + 0x18]
cmp rsi, 1
je 0x14010fc9e
lea rcx, [rsi + 0x10]
call fcn.14010ef00
mov rax, qword [rsi + 8]
mov qword [rbx + 0x18], rax
mov qword [rsi + 8], rbx
mov byte [rsi + 0x10], 0
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401103a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
movzx ebx, dl
mov ecx, dword [rcx + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test bl, bl
je 0x1401104fa
test rax, rax
jne 0x1401104fa
mov qword [rsp + 0x30], rdi
lea rdi, [rsi + 0x1f2c0]
mov rcx, rdi
call fcn.14010ef00
mov rbx, qword [rdi + 0x18]
test rbx, rbx
je 0x1401103f3
mov rax, qword [rbx]
mov qword [rdi + 0x18], rax
jmp 0x14011046e
mov rdx, qword [rdi + 8]
test rdx, rdx
jne 0x140110427
mov edx, 0x348
mov rcx, rsi
call fcn.14010fe10
mov qword [rdi + 8], rax
mov rdx, rax
test rax, rax
jne 0x140110427
mov byte [rdi], al
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, word [rdx + 0x76]
mov rbx, qword [rdx + 0x50]
mov rcx, rbx
sub rcx, rax
mov qword [rdx + 0x50], rcx
mov rcx, qword [rdi + 8]
lea rax, [rcx + 0x80]
cmp qword [rcx + 0x50], rax
jae 0x14011046e
mov qword [rcx + 0x50], 0
mov rax, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov qword [rcx + 0x40], rax
mov rax, qword [rdi + 8]
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], 0
xor edx, edx
mov byte [rdi], 0
mov r8d, 0x348
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
test rbx, rbx
jne 0x140110498
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov qword [rbx + 0x10], rsi
lea rax, [rsi + 0x10]
mov qword [rbx + 0x310], rax
mov rdx, rbx
mov ecx, dword [rsi + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [rsi + 0x1f090]
mov qword [rbx + 8], 0
call fcn.14010ef00
mov rcx, qword [rsi + 0x1f088]
mov qword [rbx], rcx
mov rax, qword [rsi + 0x1f088]
test rax, rax
je 0x1401104e4
mov qword [rax + 8], rbx
mov qword [rsi + 0x1f088], rbx
mov rdi, qword [rsp + 0x30]
mov rax, rbx
mov byte [rsi + 0x1f090], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x140110510
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [0x14035a390]
mov rbx, rcx
test rdi, rdi
je 0x140110563
test rcx, rcx
je 0x140110563
call fcn.14010eea0
test al, al
je 0x14011055b
mov ecx, dword [rdi + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, rbx
mov rcx, rdi
mov rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140110930
mov rcx, rbx
call fcn.14010faa0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140110a50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
test dl, 0x3f
jne 0x140110b09
mov rcx, qword [rdx - 8]
lea r14, [rdx - 0x10]
mov rax, rcx
shr rax, 0x20
test al, 1
je 0x140110b09
mov rax, qword [r14]
test rax, rax
je 0x140110b09
cmp rax, r14
jae 0x140110b09
call fcn.1401133b0
cmp rax, r14
jne 0x140110b09
mov r15, qword [r14]
mov r14, qword [r15 + 0x48]
sub r14, rbx
add r14, r15
cmp rdi, r14
ja 0x140110af0
test rsi, rsi
je 0x140110ac7
lea rax, [rsi - 1]
test rbx, rax
jne 0x140110af0
lea rcx, [rbp + 0x10]
call fcn.140115180
xor ecx, ecx
mov rdx, r14
shr rdx, 1
cmp r14, rax
cmova rcx, rdx
cmp rdi, rcx
jbe 0x140110af0
mov qword [r15 + 0x40], rdi
mov rax, rbx
jmp 0x140110b95
mov r14, qword [r15 + 0x40]
mov rdx, rdi
mov rcx, rbp
test rsi, rsi
je 0x140110b36
mov r8, rsi
call fcn.14010f0a0
jmp 0x140110b3b
mov rcx, rbx
mov rdx, rbx
and rcx, 0xffffffffffffc000
call fcn.14010fa20
mov r14, rax
cmp rdi, rax
ja 0x140110af4
test rsi, rsi
je 0x140110b31
lea rcx, [rsi - 1]
test rbx, rcx
jne 0x140110af4
mov rax, rbx
jmp 0x140110b95
call fcn.1401105e0
mov rsi, rax
test rax, rax
je 0x140110b92
cmp r14, rdi
mov rdx, rbx
mov rcx, rax
cmovb rdi, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
test rbp, rbp
je 0x140110b92
test rbx, rbx
je 0x140110b92
mov rcx, rbx
call fcn.14010eea0
test al, al
je 0x140110b8a
mov ecx, dword [rbp + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, rbx
mov rcx, rbp
mov rdx, rax
call fcn.140110930
jmp 0x140110b92
mov rcx, rbx
call fcn.14010faa0
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140110bb0
Capabilities:
Get thread local storage value

Disassembly:
push r15
sub rsp, 0x40
mov qword [rsp + 0x50], rbx
xor r15b, r15b
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov r13, rcx
add rcx, 0x1f080
call fcn.14010ef00
mov rbx, qword [r13 + 0x1f078]
test rbx, rbx
je 0x140110c9e
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], r14
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
xor edx, edx
xchg qword [rbx + 0x320], rdx
add rcx, 0x10
test rdx, rdx
je 0x140110c20
call fcn.140112240
mov r14b, 1
jmp 0x140110c23
xor r14b, r14b
xor edi, edi
xor bpl, bpl
xchg qword [rbx + 0x300], rdi
test rdi, rdi
je 0x140110c78
mov bpl, 1
nop word [rax + rax]
mov rcx, qword [rbx + 0x310]
mov rsi, qword [rdi + 0x40]
mov rax, qword [rcx]
cmp qword [rax + 0x1f290], 0
jne 0x140110c68
mov rcx, qword [rdi + 0x6c]
call fcn.140113740
mov rcx, qword [rbx + 0x310]
mov rdx, rdi
call fcn.140115380
mov rdi, rsi
test rsi, rsi
jne 0x140110c40
mov rbx, qword [rbx]
or bpl, r14b
or r15b, bpl
test rbx, rbx
jne 0x140110c00
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov byte [r13 + 0x1f080], 0
mov ecx, dword [r13 + 0x1f2ac]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
test rax, rax
je 0x140110cd9
mov rcx, rax
call fcn.14010f600
or al, r15b
add rsp, 0x40
pop r15
ret
movzx eax, r15b
add rsp, 0x40
pop r15
ret

Function at 0x140110e30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test r8, r8
je 0x140110eef
lea rax, [r8 - 1]
test r8, rax
jne 0x140110eef
test rcx, rcx
jne 0x140110e62
mov rcx, qword [0x14035a390]
call fcn.14010f0a0
jmp 0x140110ed2
test rdx, rdx
jne 0x140110ebd
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x14035a390]
test rdi, rdi
je 0x140110eb0
call fcn.14010eea0
test al, al
je 0x140110ea8
mov ecx, dword [rdi + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, rbx
mov rcx, rdi
mov rdx, rax
call fcn.140110930
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.14010faa0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x14035a390]
mov r9, r8
mov r8, rdx
mov rdx, rbx
call fcn.140110a50
mov rbx, rax
test rax, rax
jne 0x140110ee6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xc
mov rax, rbx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
xor eax, eax
add rsp, 0x20
pop rbx
ret