joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515260
Capabilities:
Get disk size

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x34]
test eax, eax
mov rsi, rcx
je 0x515280
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [rcx + 0x10]
xor r8d, r8d
mov edx, 0x5c
call fcn.00716bf0
mov rbx, qword [rsi + 0x18]
lea rdi, [rsp + 0x50]
mov rbp, qword [rsi + 0x10]
lea rdx, [rdi + 0x10]
add rax, 1
mov qword [rsp + 0x50], rdx
cmp rax, rbx
cmova rax, rbx
lea rbx, [rax + rax]
mov rax, rbp
add rax, rbx
je 0x5152d0
test rbp, rbp
jne 0x5152d0
lea rcx, [0x00816838]
call fcn.007cd620
nop
mov rcx, rbx
sar rcx, 1
cmp rcx, 7
mov rdx, rcx
mov qword [rsp + 0x48], rcx
ja 0x515380
cmp rdx, 1
je 0x515360
lea rax, [rdi + 0x10]
test rcx, rcx
lea r12, [rsp + 0x48]
jne 0x5153bf
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x44]
xor ecx, ecx
mov word [rax + rdx*2], cx
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x3c]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rcx, qword [rsp + 0x50]
add rdi, 0x10
mov ebx, eax
cmp rcx, rdi
je 0x51533f
call fcn.007da050
test ebx, ebx
je 0x515374
mov eax, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
imul edx, eax
mov dword [rsi + 0x38], edx
mov dword [rsi + 0x34], eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movzx eax, word [rbp]
lea r12, [rsp + 0x48]
mov word [rsp + 0x60], ax
lea rax, [rdi + 0x10]
jmp 0x515300
mov edx, 0x1000
mov eax, 0x200
jmp 0x51534e
lea r12, [rsp + 0x48]
mov rcx, rdi
xor r8d, r8d
mov rdx, r12
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov rdx, rbp
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
jmp 0x515300
mov rcx, rax
jmp 0x5153a5
Function at 0x515430
Capabilities:
Get file size

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
xor ebx, ebx
mov rsi, rcx
mov edi, edx
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x515460
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea rbp, [rsp + 0x70]
mov edx, 1
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsp + 0x88], rax
je 0x51554c
mov rax, qword [rsp + 0x50]
test dil, dil
mov edx, 0x940cf
mov rcx, rsi
mov qword [rsp + 0x60], 0
mov r9d, 0x10
mov dword [rsp + 0x48], 0
lea r8, [rsp + 0x60]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x68], rax
mov eax, 0
cmovne rax, rbp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
sete bl
and bl, dil
jne 0x515575
test eax, eax
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
je 0x515585
mov eax, dword [rsp + 0x48]
cmp eax, 0x10
je 0x515563
mov ebx, 1
mov rax, qword [rsp + 0x88]
cmp rax, 0xffffffffffffffff
je 0x515451
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [rsp + 0x98]
cmp qword [rsp + 0x68], rax
setne bl
jmp 0x51553a
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x3e5
je 0x515590
call rdi
jmp 0x515535
call fcn.004d6fb0
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x5155b3
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x5155e0
mov dword [rsp + 0x4c], 0xffffffff
xor r9d, r9d
mov rdx, rbp
mov rcx, rsi
lea r8, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x515600
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x48], eax
jmp 0x515530
call fcn.004d6fb0
call rdi
test eax, eax
mov dword [rsp + 0x48], 0xffffffff
jne 0x51553a
jmp 0x515535
call rdi
cmp eax, 0x26
mov esi, eax
je 0x5155d3
call fcn.004d6fb0
mov eax, esi
jmp 0x5155e7
Function at 0x516740
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov r8d, dword [rcx + 0x34]
test r8d, r8d
mov rbx, rcx
mov rsi, rdx
je 0x516823
movsxd rdi, dword [rcx + 0x38]
lea rbp, [rsp + 0x60]
lea r12, [rsp + 0x50]
lea r13, [rsp + 0x4c]
mov rax, rsi
mov rcx, qword [rbx + 8]
mov r9d, 8
mov r8, r12
cqo
mov qword [rsp + 0x30], r13
idiv rdi
mov dword [rsp + 0x28], 0x20
mov rsi, rax
mov edx, 0x90073
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x516804
cmp dword [rsp + 0x4c], 0x1f
jbe 0x516811
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x516811
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x516811
movsxd rax, dword [rbx + 0x38]
add rcx, qword [rsp + 0x50]
sub rcx, qword [rsp + 0x68]
imul rcx, rax
mov rax, rsi
cqo
idiv rdi
lea rax, [rcx + rdx]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x5167bc
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [rcx + 0x10]
xor r8d, r8d
mov edx, 0x5c
call fcn.00716bf0
mov rdi, qword [rbx + 0x18]
lea rbp, [rsp + 0x60]
mov r13, qword [rbx + 0x10]
lea rdx, [rbp + 0x10]
add rax, 1
mov qword [rsp + 0x60], rdx
cmp rax, rdi
cmova rax, rdi
lea rdi, [rax + rax]
mov rax, r13
add rax, rdi
je 0x516872
test r13, r13
jne 0x516872
lea rcx, [0x00816838]
call fcn.007cd620
mov rcx, rdi
sar rcx, 1
cmp rcx, 7
mov rdx, rcx
mov qword [rsp + 0x50], rcx
ja 0x516931
cmp rdx, 1
je 0x516901
lea rax, [rbp + 0x10]
test rcx, rcx
lea r12, [rsp + 0x50]
jne 0x516970
lea r13, [rsp + 0x4c]
xor ecx, ecx
mov qword [rsp + 0x68], rdx
lea r8, [rsp + 0x48]
mov word [rax + rdx*2], cx
mov r9, r13
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rcx, qword [rsp + 0x60]
mov edi, eax
lea rax, [rbp + 0x10]
cmp rcx, rax
je 0x5168e4
call fcn.007da050
test edi, edi
je 0x516920
mov eax, dword [rsp + 0x48]
mov edx, dword [rsp + 0x44]
imul edx, eax
movsxd rdi, edx
mov dword [rbx + 0x38], edx
mov dword [rbx + 0x34], eax
jmp 0x516775
movzx eax, word [r13]
lea r12, [rsp + 0x50]
mov word [rsp + 0x70], ax
lea rax, [rbp + 0x10]
jmp 0x5168a2
mov edi, 0x1000
mov edx, 0x1000
mov eax, 0x200
jmp 0x5168f6
lea r12, [rsp + 0x50]
mov rcx, rbp
xor r8d, r8d
mov rdx, r12
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rdx, r13
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
jmp 0x5168a2
mov rcx, rax
jmp 0x516956
Function at 0x5171e0
Capabilities:
Get file size

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rcx, qword [rcx + 8]
mov rbx, rdx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x517210
mov rax, qword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rsi
ret
call fcn.004d6fb0
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
mov rax, 0xffffffffffffffff
jmp 0x517201

Function at 0x517230
Capabilities:
Get file size

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov rbp, rdx
mov dword [rsp + 0x4c], 0
call fcn.004d6fb0
lea rdi, [rsp + 0x60]
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x517340
mov rsi, qword [rsp + 0x60]
test byte [rbx + 0x30], 4
jne 0x5172e3
mov rax, rsi
mov qword [rsp + 0x60], rbp
sub rax, rbp
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x4c]
mov rcx, qword [rbx + 8]
mov r8, rdi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov r9d, 0x10
mov edx, 0x940cf
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x517320
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x5172d7
cmp qword [rsp + 0x50], rbp
mov rsi, rbp
cmovge rsi, qword [rsp + 0x50]
mov rax, rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [0x008de1c0]
test eax, eax
je 0x517330
sub eax, 1
mov rdx, rbp
cdqe
mov rcx, rax
add rax, rsi
not rcx
and rdx, rcx
and rax, rcx
sub rax, rdx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
jmp 0x517280
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x5172c1
mov rsi, rbp
jmp 0x5172d7
call fcn.005f3c10
mov dword [0x008de1c0], eax
jmp 0x5172ed
call fcn.004d6fb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x51732b
or rsi, 0xffffffffffffffff
jmp 0x51726a
Function at 0x5200c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [rcx]
mov rcx, qword [0x00826f80]
mov rbx, qword [rax + 0x428]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x520109
jmp 0x520142
mov rax, qword [rax + 0x10]
test rax, rax
je 0x520142
cmp rbx, qword [rax]
jne 0x520100
cmp qword [rax + 8], 0
je 0x520142
lfence
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x48]
mov edx, dword [rsp + 0x58]
test al, 1
je 0x520137
mov r8, qword [rcx]
mov rax, qword [r8 + rax - 1]
call rax
sfence
add rsp, 0x70
pop rbx
ret
lea rdx, [rsp + 0x40]
mov ecx, 0x58
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x5201d5
lea rdx, [0x006cde90]
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov qword [rax + 0x28], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rax + 0x20], 0
mov dword [rax + 0x30], 0
mov qword [rax + 0x38], rdx
mov rdx, qword [rsp + 0x48]
mov qword [rax + 0x40], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x48], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rax + 0x50], rdx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x70
pop rbx
ret
Function at 0x541680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x30]
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], 0
lea rcx, [rbp + 4]
mov ebx, r8d
mov r12, r9
call fcn.00602a00
mov rax, qword [rsi + 0x158]
lea rdx, [rsi + 0x150]
test rax, rax
je 0x541783
mov rcx, rdx
jmp 0x5416dc
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
je 0x5416ea
cmp dword [rax + 0x20], ebx
jge 0x5416d0
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x5416dc
cmp rdx, rcx
je 0x541783
cmp dword [rcx + 0x20], ebx
jg 0x541783
mov rax, qword [rcx + 0x24]
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x2c]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x34]
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 0x3c]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x44]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x4c]
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 0x54]
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x5c]
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0x64]
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x6c]
mov qword [rsp + 0x78], rax
mov rax, qword [rcx + 0x74]
mov qword [rsp + 0x80], rax
mov rax, qword [rcx + 0x7c]
mov qword [rsp + 0x88], rax
call fcn.007d0a30
mov rcx, rax
call fcn.007da050
sub qword [rsi + 0x170], 1
cmp dword [rsi + 0x20], 2
mov r13d, ebx
je 0x541810
test r13d, r13d
js 0x5417d6
mov rcx, qword [rsi + 0x10]
mov edx, ebx
call fcn.0050d110
mov r8, rbp
mov edx, r13d
mov rcx, rsi
mov r9d, eax
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call fcn.00540690
test r12, r12
je 0x5417cb
mov dword [r12], eax
mov rax, qword [rsi + 0x18]
mov eax, dword [rax + 8]
test eax, eax
je 0x541800
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rdi + 0x10], 0
mov rax, rdi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [rbp + 4]
mov rcx, rdi
call fcn.00602a60
jmp 0x5417ec
mov rax, qword [rsi + 0x58]
cmp qword [rsi + 0x60], rax
je 0x541826
movsxd rdx, ebx
mov r13d, dword [rax + rdx*4]
jmp 0x541790
mov r13d, ebx
jmp 0x541790
Function at 0x579260
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [rdx + 0x10]
mov r9, qword [rdx]
mov r10, qword [rdx + 8]
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x18]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rbx, qword [rcx]
mov qword [rsp + 0x40], r9
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x58], rax
mov eax, dword [rdx + 0x20]
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x60], eax
movzx eax, byte [rdx + 0x24]
mov byte [rsp + 0x64], al
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x5792cd
cmp rbx, qword [rax]
je 0x5793a1
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x5792c0
lea rdx, [rsp + 0x40]
mov ecx, 0x60
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x57938a
lea rdx, [0x006d0d80]
mov qword [rax], 0
mov qword [rax + 8], 0
mov r9, qword [rsp + 0x40]
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov r10, qword [rsp + 0x48]
mov qword [rax + 0x28], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov dword [rax + 0x30], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov qword [rsp + 0x58], 0
mov qword [rax + 0x50], rdx
mov edx, dword [rsp + 0x60]
mov qword [rsp + 0x50], 0
mov dword [rax + 0x58], edx
movzx edx, byte [rsp + 0x64]
mov byte [rax + 0x5c], dl
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
jmp 0x5793d9
cmp qword [rax + 8], 0
je 0x5792d2
lfence
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x48]
movzx r8d, byte [rsp + 0x64]
test al, 1
mov edx, dword [rsp + 0x60]
je 0x5793d4
mov r9, qword [rcx]
mov rax, qword [r9 + rax - 1]
call rax
sfence
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x5793f2
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
je 0x579400
add rsp, 0x70
pop rbx
ret
call fcn.00576830
nop
add rsp, 0x70
pop rbx
ret
Function at 0x57c020
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [rdx + 0x10]
mov r9, qword [rdx]
mov r10, qword [rdx + 8]
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x18]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rbx, qword [rcx]
mov qword [rsp + 0x40], r9
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x58], rax
movzx eax, byte [rdx + 0x20]
mov qword [rsp + 0x48], r10
mov byte [rsp + 0x60], al
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x57c07e
cmp rbx, qword [rax]
je 0x57c150
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x57c071
lea rdx, [rsp + 0x40]
mov ecx, 0x60
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x57c130
lea rdx, [0x006cf1c0]
mov qword [rax], 0
mov qword [rax + 8], 0
mov r9, qword [rsp + 0x40]
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov r10, qword [rsp + 0x48]
mov qword [rax + 0x28], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov dword [rax + 0x30], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov qword [rsp + 0x58], 0
mov qword [rax + 0x50], rdx
movzx edx, byte [rsp + 0x60]
mov qword [rsp + 0x50], 0
mov byte [rax + 0x58], dl
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
jmp 0x57c183
cmp qword [rax + 8], 0
je 0x57c083
lfence
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x48]
movzx edx, byte [rsp + 0x60]
test al, 1
je 0x57c17e
mov r8, qword [rcx]
mov rax, qword [r8 + rax - 1]
call rax
sfence
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x57c19c
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
je 0x57c1a2
add rsp, 0x70
pop rbx
ret
call fcn.00576830
nop
add rsp, 0x70
pop rbx
ret
Function at 0x57cec0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [rdx + 0x10]
mov r9, qword [rdx]
mov r10, qword [rdx + 8]
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x18]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rbx, qword [rcx]
mov qword [rsp + 0x40], r9
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x57cf1d
cmp rbx, qword [rax]
je 0x57cfe0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x57cf10
lea rdx, [rsp + 0x40]
mov ecx, 0x58
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x57cfc7
lea rdx, [0x006cc100]
mov qword [rax], 0
mov qword [rax + 8], 0
mov r9, qword [rsp + 0x40]
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov r10, qword [rsp + 0x48]
mov qword [rax + 0x28], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov dword [rax + 0x30], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov qword [rsp + 0x58], 0
mov qword [rax + 0x50], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
jmp 0x57d00e
cmp qword [rax + 8], 0
je 0x57cf22
lfence
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x48]
test al, 1
je 0x57d009
mov rdx, qword [rcx]
mov rax, qword [rdx + rax - 1]
call rax
sfence
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x57d027
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
je 0x57d030
add rsp, 0x70
pop rbx
ret
call fcn.00576830
nop
add rsp, 0x70
pop rbx
ret
Function at 0x57dd70
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [rdx + 0x10]
mov r9, qword [rdx]
mov r10, qword [rdx + 8]
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x18]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rbx, qword [rcx]
mov qword [rsp + 0x40], r9
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x58], rax
mov eax, dword [rdx + 0x20]
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x57ddcd
cmp rbx, qword [rax]
je 0x57de95
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x57ddc0
lea rdx, [rsp + 0x40]
mov ecx, 0x60
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x57de7e
lea rdx, [0x006cf360]
mov qword [rax], 0
mov qword [rax + 8], 0
mov r9, qword [rsp + 0x40]
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov r10, qword [rsp + 0x48]
mov qword [rax + 0x28], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov dword [rax + 0x30], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov qword [rsp + 0x58], 0
mov qword [rax + 0x50], rdx
mov edx, dword [rsp + 0x60]
mov qword [rsp + 0x50], 0
mov dword [rax + 0x58], edx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
jmp 0x57dec7
cmp qword [rax + 8], 0
je 0x57ddd2
lfence
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x48]
mov edx, dword [rsp + 0x60]
test al, 1
je 0x57dec2
mov r8, qword [rcx]
mov rax, qword [r8 + rax - 1]
call rax
sfence
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x57dee0
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
je 0x57def0
add rsp, 0x70
pop rbx
ret
call fcn.00576830
nop
add rsp, 0x70
pop rbx
ret
Function at 0x584b00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x98
mov rax, qword [rdx + 0x10]
mov r8, qword [rdx + 0x20]
mov r9, qword [rdx]
mov r10, qword [rdx + 8]
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x18]
lea rsi, [rsp + 0x40]
mov qword [rdx + 0x18], 0
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x58], rax
lea rax, [rsi + 0x30]
mov qword [rsp + 0x60], rax
lea rax, [rdx + 0x30]
cmp r8, rax
mov qword [rdx + 0x10], 0
je 0x584d41
mov qword [rsp + 0x60], r8
mov r8, qword [rdx + 0x30]
mov qword [rsp + 0x70], r8
mov r8, qword [rdx + 0x28]
mov qword [rdx + 0x20], rax
mov eax, dword [rdx + 0x40]
mov qword [rdx + 0x28], 0
mov byte [rdx + 0x30], 0
mov rbx, qword [rcx]
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x68], r8
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x584bad
cmp rbx, qword [rax]
je 0x584cc1
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x584ba0
mov rdx, rsi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x584caa
lea rdx, [0x006d0540]
mov qword [rax], 0
mov qword [rax + 8], 0
mov r9, qword [rsp + 0x40]
lea rcx, [rsi + 0x30]
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov r10, qword [rsp + 0x48]
mov qword [rax + 0x28], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov dword [rax + 0x30], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov qword [rsp + 0x58], 0
mov qword [rax + 0x50], rdx
lea rdx, [rax + 0x68]
mov qword [rax + 0x58], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], 0
cmp rdx, rcx
je 0x584d58
mov qword [rax + 0x58], rdx
mov rdx, qword [rsp + 0x70]
mov qword [rax + 0x68], rdx
mov rdx, qword [rsp + 0x68]
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rax + 0x60], rdx
lea rdx, [rsi + 0x30]
mov qword [rsp + 0x60], rdx
mov edx, dword [rsp + 0x80]
mov dword [rax + 0x78], edx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
jmp 0x584cfb
cmp qword [rax + 8], 0
je 0x584bb2
lfence
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x80]
test al, 1
je 0x584cf2
mov rdx, qword [rcx]
mov rax, qword [rdx + rax - 1]
lea rdx, [rsi + 0x20]
call rax
sfence
mov rcx, qword [rsp + 0x60]
add rsi, 0x30
cmp rcx, rsi
je 0x584d0e
call fcn.007da050
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x584d27
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
je 0x584d31
add rsp, 0x98
pop rbx
pop rsi
ret
call fcn.00576830
nop
add rsp, 0x98
pop rbx
pop rsi
ret
mov r9, qword [rdx + 0x30]
mov r10, qword [rdx + 0x38]
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x78], r10
jmp 0x584b69
mov r9, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov qword [rax + 0x68], r9
mov qword [rax + 0x70], r10
jmp 0x584c80