joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r10, qword [rsp + 0x80]
mov r11, qword [rsp + 0x88]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rax, [rsp + 0x90]
cmp dword [0x005edc0c], 0
mov qword [rsp + 0x40], rax
je 0x481a60
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r10
call fcn.00480a10
mov rax, qword [rsp + 0x48]
xor rax, qword [rbx]
jne 0x481a70
add rsp, 0x50
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [0x005edc0c]
mov r12, rcx
mov r13d, edx
test eax, eax
jne 0x481ab0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.00487eb0
test eax, eax
jne 0x481b70
call fcn.004803b0
lea rbx, [0x005898e0]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
mov rcx, rdx
mov r14, rdx
call fcn.00488050
mov rdi, rax
call fcn.00487ff0
mov rcx, r14
call fcn.00488020
mov rsi, qword [0x005ab270]
mov r14, qword [0x005ab280]
mov rbp, rax
mov rcx, qword [rsi]
call fcn.004829b0
test eax, eax
je 0x481b30
mov rax, qword [rsi + 0x80]
test rax, rax
je 0x481b30
mov r9, rbp
mov r8, rdi
mov edx, r13d
mov rcx, r12
call rax
add rbx, 8
test r14, r14
je 0x481b55
mov rsi, r14
mov r14, qword [rbx + 8]
mov rcx, qword [rsi]
call fcn.004829b0
test eax, eax
jne 0x481b16
add rbx, 8
test r14, r14
jne 0x481b39
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.00487ee0
lea rax, str.thread_proc_on_main
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov qword [rsp + 0x28], rax
mov rcx, r12
mov qword [rsp + 0x20], 0
call fcn.00481a10
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x482060
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov rbx, rcx
mov rsi, rdx
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
call fcn.00414be0
mov r9, rsi
mov r8, rbx
mov edx, 0xa89
lea rcx, str.config.c
add rsp, 0x38
pop rbx
pop rsi
jmp 0x481270
mov eax, dword [0x005edc0c]
test eax, eax
jne 0x481280
ret
jmp 0x482060
push r13
push r12
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov eax, dword [0x005edc10]
mov qword [rsp + 0x20], rcx
mov r12, r8
mov dword [rsp + 0x28], edx
mov r13, r9
test eax, eax
je 0x4820c8
mov eax, dword [0x005edc14]
test eax, eax
jle 0x4820ad
lea r8, [rsp + 0x20]
mov rdx, r13
mov rcx, r12
call fcn.00481e10
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x4820cf
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
call fcn.00481e80
jmp 0x482099
call sub.libssp_0.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4820e0
Capabilities:
Set environment variable

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r13, rcx
lea rcx, str.GIT_TRACE2_PARENT_NAME
call fcn.004ae0e0
mov qword [0x00573158], 0
mov r12, rax
mov rax, qword [0x00573160]
cmp rax, qword [0x005ab200]
je 0x4821d8
mov byte [rax], 0
test r12, r12
je 0x482128
cmp byte [r12], 0
jne 0x482168
mov rcx, r13
call sub.msvcrt.dll_strlen
mov rdx, r13
lea rcx, [0x00573150]
mov r8, rax
call fcn.00472fb0
mov rdx, qword [0x00573160]
mov r8d, 1
lea rcx, str.GIT_TRACE2_PARENT_NAME
add rsp, 0x28
pop r12
pop r13
jmp fcn.004b7d70
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rdx, r12
lea rcx, [0x00573150]
mov r8, rax
call fcn.00472fb0
mov rdx, qword [0x00573150]
test rdx, rdx
jne 0x482200
mov edx, 1
lea rcx, [0x00573150]
call fcn.004727c0
mov rax, qword [0x00573158]
lea rdx, [rax + 1]
mov qword [0x00573158], rdx
mov rdx, qword [0x00573160]
mov byte [rdx + rax], 0x2f
mov rdx, qword [0x00573160]
mov rax, qword [0x00573158]
mov byte [rdx + rax], 0
jmp 0x482128
cmp byte [rax], 0
je 0x48211c
mov r8d, 0xa8
lea rdx, [0x00589967]
lea rcx, [0x00589972]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x48211c
mov rax, qword [0x00573158]
sub rdx, rax
cmp rdx, 1
jne 0x4821a6
jmp 0x48218e

Function at 0x482d90
Capabilities:
Set environment variable

Disassembly:
push r12
sub rsp, 0x20
lea rcx, str.GIT_TRACE2_PARENT_SID
call fcn.004ae0e0
mov r12, rax
test rax, rax
je 0x482e59
movzx eax, byte [rax]
test al, al
je 0x482e59
mov edx, dword [0x005edc30]
mov rcx, r12
xor r8d, r8d
nop dword [rax]
cmp al, 0x2f
jne 0x482dd5
add edx, 1
mov r8d, 1
movzx eax, byte [rcx + 1]
add rcx, 1
test al, al
jne 0x482dc8
test r8b, r8b
je 0x482dec
mov dword [0x005edc30], edx
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rdx, r12
lea rcx, [0x00573180]
mov r8, rax
call fcn.00472fb0
mov rdx, qword [0x00573180]
test rdx, rdx
jne 0x482e80
mov edx, 1
lea rcx, [0x00573180]
call fcn.004727c0
mov rax, qword [0x00573188]
lea rdx, [rax + 1]
add dword [0x005edc30], 1
mov qword [0x00573188], rdx
mov rdx, qword [0x00573190]
mov byte [rdx + rax], 0x2f
mov rdx, qword [0x00573190]
mov rax, qword [0x00573188]
mov byte [rdx + rax], 0
call fcn.00482b20
mov rdx, qword [0x00573190]
mov r8d, 1
lea rcx, str.GIT_TRACE2_PARENT_SID
add rsp, 0x20
pop r12
jmp fcn.004b7d70
mov rax, qword [0x00573188]
sub rdx, rax
cmp rdx, 1
jne 0x482e2a
jmp 0x482e12
Function at 0x487d10
Capabilities:
Set thread local storage value

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r13, rcx
mov edx, 0x30
mov ecx, 1
call fcn.004997f0
mov edx, 8
mov ecx, 0x64
mov dword [rax + 0x20], 0x64
mov r12, rax
call fcn.004997f0
movsxd rdx, dword [r12 + 0x24]
mov qword [r12 + 0x18], rax
lea ecx, [rdx + 1]
mov dword [r12 + 0x24], ecx
lea rcx, [0x005edca0]
mov qword [rax + rdx*8], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x005edc80]
lea rcx, [0x005edca0]
lea eax, [rbx + 1]
mov dword [0x005edc80], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [r12 + 0x28], ebx
xor edx, edx
mov rcx, r12
call fcn.00472870
mov r8d, dword [r12 + 0x28]
test r8d, r8d
jne 0x487de0
mov rcx, r13
call sub.msvcrt.dll_strlen
mov rdx, r13
mov rcx, r12
mov r8, rax
call fcn.00472fb0
cmp qword [r12 + 8], 0x18
ja 0x487df8
mov ecx, dword [0x005edc84]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
lea rdx, str.th_02d:
mov rcx, r12
call fcn.004737e0
jmp 0x487d9f
cmp qword [r12], 0x18
jbe 0x487e44
mov qword [r12 + 8], 0x18
mov rax, qword [r12 + 0x10]
cmp rax, qword [0x005ab200]
je 0x487e20
mov byte [rax + 0x18], 0
jmp 0x487dbd
cmp byte [rax], 0
je 0x487dbd
mov r8d, 0xa8
lea rdx, [0x0058a2fb]
lea rcx, [0x0058a306]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x487dbd
lea rcx, [0x0058a2d8]
call fcn.00494770
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x487e60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x005edc84]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x487e80
add rsp, 0x28
ret
call fcn.004803b0
lea rcx, [0x0058a319]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
add rsp, 0x28
jmp fcn.00487d10

Function at 0x487eb0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x005edc84]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp qword [0x005edcd0], rax
sete al
movzx eax, al
add rsp, 0x28
ret

Function at 0x487ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
call fcn.00487e60
xor edx, edx
mov ecx, dword [0x005edc84]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [r12 + 0x18]
call fcn.004c9260
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260

Function at 0x488070
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp qword [0x005edcc8], 0
jne 0x48809f
call fcn.004803b0
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
mov qword [0x005edcc8], rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea rcx, [0x005edca0]
mov dword [0x005edc84], eax
call fcn.0047f6c0
mov rdx, qword [0x005edcc8]
lea rcx, str.main
call fcn.00487d10
mov qword [0x005edcd0], rax
add rsp, 0x28
ret
Function at 0x488160
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov eax, dword [0x005edce0]
test eax, eax
je 0x4881a0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rbx]
jne 0x48828d
add rsp, 0x38
pop rbx
pop r12
ret
lea r12, [rsp + 0x20]
lea rcx, str.color.transport
mov dword [0x005edce0], 1
mov rdx, r12
call fcn.00413d80
mov edx, dword [0x00573738]
test eax, eax
je 0x488250
mov ecx, 2
call fcn.004d35c0
test eax, eax
je 0x488182
mov rdx, r12
lea rcx, str.color.transport.reset
call fcn.00413d80
test eax, eax
jne 0x488207
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x48826e
lea rdx, [0x005736a0]
call fcn.004d34f0
test eax, eax
js 0x48823c
mov rdx, r12
lea rcx, str.color.transport.rejected
call fcn.00413d80
test eax, eax
jne 0x488182
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x488284
lea rdx, [0x005736eb]
call fcn.004d34f0
test eax, eax
jns 0x488182
mov eax, 0xffffffff
jmp 0x488184
mov rdx, qword [rsp + 0x20]
lea rcx, str.color.transport
call fcn.004d3520
mov dword [0x00573738], eax
mov edx, eax
jmp 0x4881cc
lea rcx, str.color.transport.reset
call fcn.00414d80
mov eax, 0xffffffff
jmp 0x488184
lea rcx, str.color.transport.rejected
jmp 0x488275
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x4882a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, qword [rsp + 0xc0]
mov r15d, dword [rsp + 0xd0]
mov rbp, rdx
mov edx, dword [rsp + 0xc8]
mov rax, r8
mov rbx, r9
movsx edi, cl
lea r13, [r8 + 0x90]
test edx, edx
je 0x488364
mov rsi, qword [fcn.005707a0]
mov ecx, 1
test r9, r9
je 0x488460
call rsi
mov qword [rsp + 0x20], r13
lea r9, [rbx + 0x90]
mov r8d, edi
mov rcx, rax
lea rdx, str._c_t_s:_s_t
call sub.libintl_8.dll_libintl_fprintf
mov ecx, 1
test r12, r12
je 0x488485
call rsi
mov r9, r12
mov r8, rbp
lea rdx, str._s___s__n
mov rcx, rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.libintl_8.dll_libintl_fprintf
mov edx, dword [rax + 0x7c]
cmp edx, 1
jbe 0x488361
cmp edx, 9
jne 0x4884b0
mov rax, qword [rax]
test rax, rax
jne 0x488350
lea rdx, [0x0058a3bf]
mov r14, rdx
mov qword [rsp + 0x48], rdx
mov ecx, 2
mov rsi, qword [fcn.005707a0]
call rsi
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rbp
mov r9d, edi
mov dword [rsp + 0x20], r15d
mov rcx, rax
mov r8, r14
mov qword [rsp + 0x30], rdx
lea rdx, str.__s_c___s_s
call sub.libintl_8.dll_libintl_fprintf
test rbx, rbx
je 0x488500
mov rcx, r13
call fcn.00441fe0
lea rcx, [rbx + 0x90]
mov rdi, rax
call fcn.00441fe0
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rdi
mov r8, rbx
lea rdx, str._s_____s
mov rcx, rax
call sub.libintl_8.dll_libintl_fprintf
test r12, r12
je 0x48843a
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x0058a3f6]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rsi
mov rcx, r12
mov rdx, rax
call sub.msvcrt.dll_fputs
mov ecx, 2
call rsi
mov ecx, 0x29
mov rdx, rax
call sub.msvcrt.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msvcrt.dll_fputc
call rsi
mov r9, r13
mov r8d, edi
lea rdx, str._c_t:_s_t
mov rcx, rax
call sub.libintl_8.dll_libintl_fprintf
mov ecx, 1
test r12, r12
jne 0x488325
call rsi
mov r8, rbp
lea rdx, [0x0058a3db]
mov rcx, rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.libintl_8.dll_libintl_fprintf
mov edx, dword [0x00573738]
mov ecx, 2
lea rsi, [0x0058a3bf]
lea r14, [0x005736eb]
call fcn.004d35c0
mov edx, dword [0x00573738]
mov ecx, 2
test eax, eax
cmove r14, rsi
call fcn.004d35c0
lea rdx, [0x005736a0]
test eax, eax
cmove rdx, rsi
jmp 0x488373
mov ecx, 2
call rsi
mov rcx, r13
mov r14, rax
call fcn.00441fe0
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_fputs
jmp 0x4883ee
Function at 0x48a770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, qword [rsp + 0xa0]
mov r13, rcx
mov rcx, rdx
mov rbx, rdx
mov esi, r8d
mov r14d, r9d
call fcn.004892b0
mov ebp, eax
call fcn.00488160
test eax, eax
js 0x48a940
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [0x0058a9b1]
call fcn.00443890
mov r12, rax
test esi, esi
je 0x48a900
test rbx, rbx
je 0x48a909
mov r15, rbx
xor esi, esi
jmp 0x48a7e8
mov r15, qword [r15]
test r15, r15
je 0x48a810
cmp dword [r15 + 0x7c], 9
jne 0x48a7e0
mov dword [rsp + 0x20], ebp
mov r8d, esi
mov rcx, r15
mov r9d, r14d
mov rdx, r13
call fcn.0048a230
mov r15, qword [r15]
add esi, eax
test r15, r15
jne 0x48a7e8
nop
mov r15, rbx
jmp 0x48a820
mov r15, qword [r15]
test r15, r15
je 0x48a846
cmp dword [r15 + 0x7c], 1
jne 0x48a818
mov dword [rsp + 0x20], ebp
mov r8d, esi
mov rcx, r15
mov r9d, r14d
mov rdx, r13
call fcn.0048a230
mov r15, qword [r15]
add esi, eax
test r15, r15
jne 0x48a820
mov dword [rdi], 0
test rbx, rbx
jne 0x48a888
jmp 0x48a8de
cmp eax, 3
je 0x48a918
cmp eax, 5
je 0x48a930
cmp eax, 6
jne 0x48a880
or dword [rdi], 0x10
nop word [rax + rax]
mov rbx, qword [rbx]
test rbx, rbx
je 0x48a8de
mov eax, dword [rbx + 0x7c]
cmp eax, 9
je 0x48a8af
cmp eax, 1
jbe 0x48a8af
mov dword [rsp + 0x20], ebp
mov r8d, esi
mov r9d, r14d
mov rdx, r13
mov rcx, rbx
call fcn.0048a230
add esi, eax
mov eax, dword [rbx + 0x7c]
cmp eax, 2
jne 0x48a860
mov r15d, dword [rdi]
test r12, r12
je 0x48a920
lea rdx, [rbx + 0x90]
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x48a920
mov rbx, qword [rbx]
or r15d, 1
mov dword [rdi], r15d
test rbx, rbx
jne 0x48a888
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.004c9260
test rbx, rbx
jne 0x48a810
mov dword [rdi], 0
jmp 0x48a8de
or dword [rdi], 4
jmp 0x48a880
or r15d, 2
mov dword [rdi], r15d
jmp 0x48a880
or dword [rdi], 8
jmp 0x48a880
call fcn.00426640
lea rcx, [0x0058a3f9]
test eax, eax
je 0x48a95a
call fcn.00494a30
jmp 0x48a7ab
lea rcx, str.could_not_parse_transport.color._config
call fcn.0056e6a8
mov rcx, rax
jmp 0x48a950

Function at 0x48b6e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, qword [rcx + 0x18]
mov rdx, qword [r12 + 8]
call fcn.00489370
mov rcx, qword [r12 + 0x10]
call sub.msvcrt.dll_fclose
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260
Function at 0x494770
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x30
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x48], rdx
mov r12, rcx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
xor edx, edx
call qword [0x005737b0]
test eax, eax
je 0x4947e6
mov ecx, 2
call qword [fcn.005707a0]
mov r8d, 0x29
mov edx, 1
lea rcx, str.fatal:_recursion_detected_in_die_handler_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xa7
lea rcx, str.usage.c
call fcn.00480ea0
mov ecx, eax
call sub.msvcrt.dll_exit
lea rdx, [rsp + 0x48]
mov rcx, r12
mov qword [rsp + 0x20], rdx
call qword [0x005737c8]
nop
nop word [rax + rax]

Function at 0x494800
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x440
mov rax, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x468], rdx
mov r12, rcx
mov qword [rsp + 0x470], r8
mov qword [rsp + 0x478], r9
mov rbx, qword [rax]
mov qword [rsp + 0x438], rbx
xor ebx, ebx
call qword [0x005737b0]
test eax, eax
je 0x494888
mov ecx, 2
call qword [fcn.005707a0]
mov r8d, 0x2f
mov edx, 1
lea rcx, str.fatal:_recursion_detected_in_die_errno_handler_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xcf
lea rcx, str.usage.c
call fcn.00480ea0
mov ecx, eax
call sub.msvcrt.dll_exit
lea r13, [rsp + 0x468]
lea rcx, [rsp + 0x30]
mov rdx, r12
mov rbx, qword [0x005737c8]
mov qword [rsp + 0x28], r13
call fcn.004942c0
mov rdx, r13
mov rcx, rax
call rbx
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x495700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edi, dword [rsp + 0x88]
mov esi, dword [rsp + 0x80]
mov r13, rcx
mov rcx, rdx
movsxd rdx, r8d
mov ebx, r9d
call fcn.00499740
mov dword [rsp + 0x20], edi
mov rcx, r13
mov r9d, esi
mov r12, rax
mov r8d, ebx
mov rdx, rax
call fcn.00495250
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.004c9260
Function at 0x497250
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call qword [rcx + 0x20]
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260

Function at 0x497cf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, rcx
call fcn.00444a80
xor r8d, r8d
lea r9, [rbx + 0x20]
lea rdx, [0x0058d170]
mov rcx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call fcn.004431c0
test rax, rax
je 0x497d42
test byte [rsp + 0x34], 1
jne 0x497d58
mov dword [rbx + 0x40], 1
mov rax, qword [rsp + 0x38]
xor rax, qword [rsi]
jne 0x497d66
add rsp, 0x48
pop rbx
pop rsi
ret
mov rcx, rax
call fcn.004996c0
mov qword [rbx + 0x10], rax
jmp 0x497d42
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]

Function at 0x497d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
test rcx, rcx
je 0x497da4
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
call fcn.00473660
mov rax, qword [rsp + 0x28]
xor rax, qword [rbx]
jne 0x497db4
add rsp, 0x30
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]

Function at 0x497dc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov r12, rcx
test rax, rax
je 0x497e1c
mov rbx, rcx
nop dword [rax]
mov rcx, qword [rax]
add rbx, 8
call fcn.004c9260
mov rax, qword [rbx - 8]
mov rcx, qword [rax + 8]
call fcn.004c9260
mov rax, qword [rbx - 8]
mov rcx, qword [rax + 0x10]
call fcn.004c9260
mov rax, qword [rbx - 8]
mov rcx, qword [rax + 0x18]
call fcn.004c9260
mov rcx, qword [rbx - 8]
call fcn.004c9260
mov rax, qword [rbx]
test rax, rax
jne 0x497dd8
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp fcn.004c9260
Function at 0x499880
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x70], r8
mov esi, edx
mov r12, rcx
mov ebx, edx
mov qword [rsp + 0x78], r9
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
and esi, 0x100
je 0x4998c4
movzx esi, word [rsp + 0x70]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
mov r8d, esi
mov edx, ebx
mov rcx, r12
call fcn.004b0de0
test eax, eax
jns 0x499948
call rdi
cmp dword [rax], 4
je 0x4998cb
test bl, 2
jne 0x49995e
and ebx, 1
jne 0x499908
call fcn.00426640
lea rcx, [0x0058d471]
test eax, eax
je 0x499930
mov rdx, r12
call fcn.00494800
nop dword [rax]
call fcn.00426640
lea rcx, [0x0058d471]
test eax, eax
jne 0x4998fd
lea rcx, str.could_not_open__s_for_writing
call fcn.0056e6a8
mov rcx, rax
jmp 0x4998fd
lea rcx, [0x0058d560]
call fcn.0056e6a8
mov rcx, rax
jmp 0x4998fd
mov rdi, qword [rsp + 0x28]
xor rdi, qword [rbp]
jne 0x499975
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, str.could_not_open__s_for_reading_and_writing
call fcn.00499690
mov rdx, r12
mov rcx, rax
call fcn.00494800
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]

Function at 0x499980
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov ebx, 0x800000
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rax, qword [r13]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp r8, 0x800000
mov esi, ecx
mov rdi, rdx
cmovbe rbx, r8
lea r14, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
mov ecx, esi
call sub.msvcrt.dll__read
movsxd r12, eax
test r12, r12
jns 0x4999ed
call rbp
cmp dword [rax], 4
je 0x4999c1
call rbp
mov eax, dword [rax]
cmp eax, 0xb
je 0x499a10
cmp eax, 0x8c
je 0x499a10
mov rax, qword [rsp + 0x28]
xor rax, qword [r13]
jne 0x499a33
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 1
mov r8d, 0xffffffff
mov rcx, r14
mov dword [rsp + 0x20], esi
mov edx, 1
mov word [rsp + 0x24], ax
call fcn.004b74f0
jmp 0x4999c1
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]

Function at 0x499cb0
Capabilities:
Check os version
Query environment variable

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__dup
test eax, eax
js 0x499cc2
add rsp, 0x28
ret
lea rcx, str.dup_failed
call fcn.00494800
nop
nop
Function at 0x499cd0
Capabilities:
Check os version
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.msvcrt.dll__errno]
mov r12, rcx
mov rbx, rdx
mov rdx, rbx
mov rcx, r12
call fcn.004b1680
test rax, rax
jne 0x499d70
call rsi
cmp dword [rax], 4
je 0x499ce5
movzx eax, byte [rbx]
test al, al
je 0x499d30
cmp byte [rbx + 1], 0x2b
je 0x499d79
cmp al, 0x77
je 0x499d11
cmp al, 0x61
jne 0x499d30
call fcn.00426640
lea rcx, [0x0058d471]
test eax, eax
je 0x499d58
mov rdx, r12
call fcn.00494800
nop dword [rax]
call fcn.00426640
lea rcx, [0x0058d471]
test eax, eax
jne 0x499d21
lea rcx, [0x0058d560]
call fcn.0056e6a8
mov rcx, rax
jmp 0x499d21
lea rcx, str.could_not_open__s_for_writing
call fcn.0056e6a8
mov rcx, rax
jmp 0x499d21
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
lea rcx, str.could_not_open__s_for_reading_and_writing
call fcn.00499690
mov rdx, r12
mov rcx, rax
call fcn.00494800
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x499da0
Capabilities:
Check os version
Query environment variable

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__fdopen
test rax, rax
je 0x499db3
add rsp, 0x28
ret
lea rcx, str.Out_of_memory__fdopen_failed
call fcn.00494800
nop
push r13
push r12
push rbx
sub rsp, 0x20
lea rdx, [0x0058d5a8]
mov r13, rcx
call fcn.004b1680
mov r12, rax
test rax, rax
je 0x499df0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 1
jne 0x499de0
mov rcx, r13
call fcn.004af900
test eax, eax
jne 0x499e28
lea rdx, [0x0058d5a8]
mov rcx, r13
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.004b1680
call rbx
mov dword [rax], 1
jmp 0x499de0

Function at 0x499dc0
Capabilities:
Check os version
Query environment variable

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__fdopen
test rax, rax
je 0x499db3
add rsp, 0x28
ret
lea rcx, str.Out_of_memory__fdopen_failed
call fcn.00494800
nop
push r13
push r12
push rbx
sub rsp, 0x20
lea rdx, [0x0058d5a8]
mov r13, rcx
call fcn.004b1680
mov r12, rax
test rax, rax
je 0x499df0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 1
jne 0x499de0
mov rcx, r13
call fcn.004af900
test eax, eax
jne 0x499e28
lea rdx, [0x0058d5a8]
mov rcx, r13
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.004b1680
call rbx
mov dword [rax], 1
jmp 0x499de0