joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060fc0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x1400b1433], 1
jne 0x140060fdd
cmp byte [0x1400b1432], 0
jne 0x140060ffc
jmp 0x14006102b
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400b1433], 1
test rax, rax
setne byte [0x1400b1432]
je 0x14006102b
mov rdi, qword [dbg.__acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_step_stage2_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.140056950
mov ecx, 2
call rdi
mov rcx, rax
call sym.fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
mov r8, qword [0x1400b9008]
mov rcx, rsi
mov dl, 1
add rsp, 0x28
pop rdi
pop rsi
jmp r8

Function at 0x140061050
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
cmp byte [0x1400b1433], 1
jne 0x140061071
cmp byte [0x1400b1432], 0
jne 0x140061090
jmp 0x1400610c2
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400b1433], 1
test rax, rax
setne byte [0x1400b1432]
je 0x1400610c2
mov rbx, qword [dbg.__acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.140056950
mov ecx, 2
call rbx
mov rcx, rax
call sym.fflush
mov rax, qword [rdi]
mov rax, qword [rax + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [0x1400b9008]
xor ecx, ecx
cmp qword [rsi + 8], 0
mov eax, 0xffffe66b
cmovne eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400610f0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x1400b1433], 1
jne 0x14006110d
cmp byte [0x1400b1432], 0
jne 0x14006112c
jmp 0x14006115b
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400b1433], 1
test rax, rax
setne byte [0x1400b1432]
je 0x14006115b
mov rdi, qword [dbg.__acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_resume_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.140056950
mov ecx, 2
call rdi
mov rcx, rax
call sym.fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x50]
mov rcx, rsi
call qword [0x1400b9008]
mov eax, 0xffffe674
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140061180
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [0x1400b1433], 1
jne 0x1400611ab
cmp byte [0x1400b1432], 0
jne 0x1400611ca
jmp 0x140061202
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400b1433], 1
test rax, rax
setne byte [0x1400b1432]
je 0x140061202
mov r15, qword [dbg.__acrt_iob_func]
mov ecx, 2
call r15
mov dword [rsp + 0x20], edi
lea rdx, str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
mov rcx, rax
mov r8, r14
mov r9, rbx
call fcn.140056950
mov ecx, 2
call r15
mov rcx, rax
call sym.fflush
mov rax, qword [r14]
mov rax, qword [rax + 0x60]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [0x1400b9008]
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140061240
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
cmp byte [0x1400b1433], 1
jne 0x140061260
cmp byte [0x1400b1432], 0
jne 0x14006127f
jmp 0x1400612b1
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400b1433], 1
test rax, rax
setne byte [0x1400b1432]
je 0x1400612b1
mov rbx, qword [dbg.__acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_is_fpreg_cursor_p__regNum_d__n
mov rcx, rax
mov r8, rdi
mov r9d, esi
call fcn.140056950
mov ecx, 2
call rbx
mov rcx, rax
call sym.fflush
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
mov rcx, rdi
mov edx, esi
call qword [0x1400b9008]
movzx eax, al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400612d0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
cmp byte [0x1400b1433], 1
jne 0x1400612f0
cmp byte [0x1400b1432], 0
jne 0x14006130f
jmp 0x140061341
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400b1433], 1
test rax, rax
setne byte [0x1400b1432]
je 0x140061341
mov rbx, qword [dbg.__acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_regname_cursor_p__regNum_d__n
mov rcx, rax
mov r8, rdi
mov r9d, esi
call fcn.140056950
mov ecx, 2
call rbx
mov rcx, rax
call sym.fflush
mov rax, qword [rdi]
mov rax, qword [rax + 0x70]
mov r8, qword [0x1400b9008]
mov rcx, rdi
mov edx, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp r8

Function at 0x140061360
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x1400b1433], 1
jne 0x14006137d
cmp byte [0x1400b1432], 0
jne 0x14006139c
jmp 0x1400613cb
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400b1433], 1
test rax, rax
setne byte [0x1400b1432]
je 0x1400613cb
mov rdi, qword [dbg.__acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_is_signal_frame_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.140056950
mov ecx, 2
call rdi
mov rcx, rax
call sym.fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x58]
mov rcx, rsi
call qword [0x1400b9008]
movzx eax, al
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400613f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x1400b1431], 1
jne 0x14006140c
cmp byte [0x1400b1430], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_UNWINDING
call sym.getenv
test rax, rax
setne al
setne byte [0x1400b1430]
mov byte [0x1400b1431], 1
add rsp, 0x28
ret

Function at 0x140061440
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x1400b1435], 1
jne 0x14006145c
cmp byte [0x1400b1434], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_DWARF
call sym.getenv
test rax, rax
setne al
setne byte [0x1400b1434]
mov byte [0x1400b1435], 1
add rsp, 0x28
ret
Function at 0x1400618f0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call sym..weak._Znwy.default.__clang_call_terminate
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [method.std::__1.__libcpp_beginthreadex_thunk_abi:v170003__void_]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140061948
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140089760
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
add rsp, 0x58
ret
Function at 0x14003b60c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140048cc8], rbx
je 0x14003b673
cmp rax, rbx
jne 0x14003b666
mov ebx, 1
mov esi, ebx
jmp 0x14003b678
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b64b
mov ebx, 1
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b690
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14003b6fc
mov eax, dword [0x140048cd0]
test eax, eax
jne 0x14003b6f1
mov dword [0x140048cd0], ebx
lea r15, [0x14003e288]
lea rdi, [0x14003e270]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b6e3
test eax, eax
jne 0x14003b6e7
cmp qword [rdi], r14
je 0x14003b6d8
mov rax, qword [rdi]
mov rcx, qword [0x14003e230]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b6ba
test eax, eax
je 0x14003b6f7
mov eax, 0xff
jmp 0x14003b852
mov dword [0x140048284], ebx
mov edi, 0x1f
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b723
lea rdx, [0x14003e268]
lea rcx, [0x14003e238]
call sub.msvcrt.dll__initterm
mov dword [0x140048cd0], 2
test esi, esi
jne 0x14003b731
mov rax, r14
xchg qword [0x140048cc8], rax
cmp qword [0x140048ce8], r14
je 0x14003b764
lea rcx, [0x140048ce8]
call fcn.14003bbf0
test eax, eax
je 0x14003b764
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140048ce8]
mov r9, qword [0x14003e230]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b77d
mov eax, 0xff
jmp 0x14003b852
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14003b803
test ax, ax
je 0x14003b798
test edx, edx
jne 0x14003b803
sub ax, bx
cmp ax, di
ja 0x14003b7ae
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14003b798
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fc0
mov dword [0x140048280], eax
cmp dword [0x1400482a0], r14d
jne 0x14003b7ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140048284], r14d
jne 0x14003b801
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140048280]
jmp 0x14003b852
cmp ax, 0x22
jne 0x14003b817
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b786
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14017b000
add rsp, 0x28
jmp 0x14003b60c
Function at 0x14000911d
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400505f0
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140050660
add rsp, 0x10
push qword [rsp + 0x28]
push 0
pop rcx
pop rdx
call sub.SHELL32.DLL_SHCreateDirectory
mov qword [rsp + 0x30], rax
push qword [rsp + 0x30]
xor r15, r15
cmp r15, qword [rsp]
jne 0x14000918a
movabs rdx, 0x1400cd442
lea rcx, [rsp + 0x40]
sub rsp, 0x28
call fcn.1400501d0
add rsp, 0x28
jmp 0x1400091de
mov r15, 0x50
cmp r15, qword [rsp]
jne 0x1400091b5
movabs rdx, 0x1400cd442
lea rcx, [rsp + 0x40]
sub rsp, 0x28
call fcn.1400501d0
add rsp, 0x28
jmp 0x1400091de
mov r15, 0xb7
cmp r15, qword [rsp]
jne 0x1400091de
movabs rdx, 0x1400cd442
lea rcx, [rsp + 0x40]
sub rsp, 0x28
call fcn.1400501d0
add rsp, 0x28
pop rax
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400502c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400503f0
add rsp, 0x28
pop rax
push rax
call fcn.140050460
pop rdx
add rax, rdx
jmp 0x140009218
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140050700
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140050700
add rsp, 0x28
pop rax
add rsp, 0x40
pop r15
ret
Function at 0x140024f60
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140024f68
sub rsp, 0x28
call fcn.1400505f0
lea rax, [rsp + 0x28]
mov rax, rax
push rax
pop rcx
call sub.KERNEL32.dll_GetSystemInfo
lea rbp, [rsp + 0x28]
movsxd rax, dword [rbp + 0x20]
jmp 0x140024f9f
add rsp, 0x60
pop rbp
ret

Function at 0x140028bec
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140a72564]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140029530
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400295f6
lea rcx, [0x140a77430]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140a75888]
jmp 0x1400295ba
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400295b7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140a75888]
mov rdx, rsi
call fcn.1400500cc
jmp 0x1400295ba
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140029587
mov rdx, qword [0x140a72308]
lea rcx, [0x140a75888]
mov rdi, rdx
inc rdx
mov qword [0x140a72308], rdx
lea edx, [rbx + 0x20]
call fcn.140050114
lea rcx, [0x140a77430]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x1400297a0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140029817
movsxd rdx, ecx
lea rcx, [0x1400296fc]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [0x140a75898]
test rbx, rbx
je 0x14002988a
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14002980d
cmp byte [rbx + 0x20], 0
je 0x14002980d
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x1400297d3
jmp 0x14002988a
mov rbx, qword [0x140a75898]
test rbx, rbx
je 0x14002988a
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140029882
cmp byte [rbx + 0x21], 0
je 0x140029846
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140029872
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.DLL_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140a75898]
call fcn.1400500cc
mov rbx, rdi
test rdi, rdi
jne 0x140029823
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140029958
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140a774a0]
call fcn.14004f3f4
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x140029a55
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x1400299af
add rax, 2
cmp word [rax], 0x20
je 0x1400299a5
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x1400299ed
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x140029a2d
cmp cx, r9w
je 0x1400299df
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x1400299cd
cmp word [rax], bp
je 0x140029a2d
mov rcx, rax
add rax, 2
jmp 0x140029a35
test dx, dx
je 0x140029a32
mov rbx, rax
cmp dx, 0x20
je 0x1400299df
add rax, 2
cmp word [rax], r9w
jne 0x140029a23
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x140029a2d
cmp cx, r9w
je 0x140029a23
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140029a11
movzx edx, word [rax]
test dx, dx
jne 0x1400299f5
jmp 0x1400299df
mov rcx, rax
jmp 0x140029a35
mov r8d, ebp
cmp dword [r14], esi
jne 0x140029a3f
test rdi, rdi
jne 0x140029a5f
test r8d, r8d
je 0x140029a46
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x14002999f
test rdi, rdi
jne 0x140029a74
movsxd rax, esi
jmp 0x140029a76
test rbx, rbx
je 0x140029a74
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x140029a76
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140029b20
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x140a774a0]
xor ebp, ebp
mov esi, edx
mov dword [rax + 8], ebp
call fcn.14004f3f4
test ebx, ebx
js 0x140029b4f
mov dword [rax], ebx
lea rcx, [rsp + 0x30]
call fcn.140029958
mov edi, dword [rsp + 0x30]
mov edx, esi
mov ecx, edi
mov rbx, rax
call fcn.140050730
mov ecx, ebp
jmp 0x140029b8b
test edi, edi
je 0x140029b90
movzx edx, word [rbx]
cmp dx, 0x22
jne 0x140029b7e
inc ecx
jmp 0x140029b85
mov word [rax], dx
add rax, 2
add rbx, 2
dec edi
cmp word [rbx], bp
jne 0x140029b6d
mov word [rax], bp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.140050870
Function at 0x14002a630
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140a758c8], 0
jne 0x14002a655
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140a758c8], 1
mov dword [0x140a758cc], eax
mov rcx, qword [0x140a754a0]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140a758cc]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x14002a810
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140a758c8], 0
mov ebx, ecx
jne 0x14002a834
call fcn.14002a630
mov ecx, dword [0x140a758cc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14002a85c
call fcn.14002a630
mov ecx, dword [0x140a758cc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x14002a870
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x14002a8b0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002a810
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140a758c8], 0
jne 0x14002a655
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140a758c8], 1
mov dword [0x140a758cc], eax
mov rcx, qword [0x140a754a0]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140a758cc]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x14002a810
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140a758c8], 0
mov ebx, ecx
jne 0x14002a834
call fcn.14002a630
mov ecx, dword [0x140a758cc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14002a85c
call fcn.14002a630
mov ecx, dword [0x140a758cc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x14002a870
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x14002a8b0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002a910
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140a758c8], 0
mov rbx, rcx
jne 0x14002a927
call fcn.14002a630
mov ecx, dword [0x140a758cc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
test rax, rax
jne 0x14002a94f
call fcn.14002a630
mov ecx, dword [0x140a758cc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
movsxd r8, dword [r9]
movsxd rdx, dword [r9 + 4]
mov eax, 0x10
mov r10d, dword [r9 + r8*4 + 0x4c]
mov r11d, dword [r9 + r8*4 + 8]
ror r10d, 0xd
add r10d, dword [r9 + rdx*4 + 0x4c]
ror r11d, 5
add r11d, dword [r9 + rdx*4 + 8]
mov dword [r9 + r8*4 + 8], r10d
mov dword [r9 + r8*4 + 0x4c], r11d
dec r8d
mov ecx, r11d
cmovs r8d, eax
dec edx
cmovs edx, eax
mov dword [r9], r8d
mov dword [r9 + 4], edx
inc rbx
je 0x14002a9c8
mov edx, r10d
mov r8, rbx
mov eax, ebx
shr r8, 0x20
imul rax, rdx
shr rax, 0x20
imul rcx, r8
imul rdx, r8
shr rcx, 0x20
add rax, rcx
add rax, rdx
add rsp, 0x20
pop rbx
ret
mov eax, r10d
shl rax, 0x20
and rax, rcx
add rsp, 0x20
pop rbx
ret