joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400c9ec0
lea rcx, [rcx + 0x48]
call fcn.1400da490
test eax, eax
je 0x1400c9eec
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x1400c9e88
mov r8d, 1
mov edx, 1
mov rcx, rbx
call fcn.1400c8130
mov rcx, qword [rbx + 0x30]
cmp qword [rbx + 0x20], rcx
je 0x1400c9e9b
call fcn.14034efb0
mov rcx, qword [rbx + 0x20]
call fcn.14034efb0
mov rcx, qword [rbx + 0x28]
call fcn.14034efb0
mov rdx, rbx
mov ecx, 0x60
add rsp, 0x30
pop rbx
jmp fcn.1400e6130
lea rax, [0x140390572]
lea r9, str.g_hash_table_unref
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x1403903e0]
lea rcx, [0x1403903fa]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400c9f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400c9f20
call fcn.1400c99b0
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400c9e50
lea rax, [0x140390572]
mov r9, qword [str.g_hash_table_destroy]
lea r8, [0x1403903e0]
mov edx, 8
mov qword [rsp + 0x20], rax
lea rcx, [0x1403903fa]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400c9f60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x1400c9fd0
test byte [rcx + 6], 1
je 0x1400c9fc0
lea rax, [0x1403907bc]
test rdx, rdx
je 0x1400c9f91
cmp qword [rdx + 8], 0
je 0x1400c9fe0
lea rax, str.G_HOOK_IS_UNLINKED__hook_
mov qword [rsp + 0x20], rax
lea r9, str.g_hook_free
lea r8, [0x1403903e0]
mov edx, 8
lea rcx, [0x1403903fa]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, str.hook_list__is_setup
jmp 0x1400c9f91
lea rax, [0x140390796]
jmp 0x1400c9f91
cmp qword [rdx + 0x10], 0
jne 0x1400c9f8a
cmp qword [rdx + 0x18], 0
jne 0x1400c9f8a
test byte [rdx + 0x20], 2
je 0x1400ca000
lea rax, str._G_HOOK_IN_CALL__hook_
jmp 0x1400c9f91
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400ca00b
call rax
movzx ecx, word [rbx + 4]
mov rdx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400e6130
Function at 0x1400ca020
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400ca0c0
test rdx, rdx
je 0x1400ca0f8
mov eax, dword [rdx + 0x18]
test eax, eax
je 0x1400ca108
sub eax, 1
mov dword [rdx + 0x18], eax
jne 0x1400ca0b6
mov eax, dword [rdx + 0x1c]
test eax, eax
jne 0x1400ca118
test byte [rdx + 0x20], 2
jne 0x1400ca128
mov rax, qword [rdx + 0x10]
mov rcx, qword [rdx + 8]
test rax, rax
je 0x1400ca148
mov qword [rax + 8], rcx
mov rax, qword [rdx + 8]
test rax, rax
je 0x1400ca090
mov rcx, qword [rdx + 0x10]
mov qword [rax + 0x10], rcx
mov qword [rdx + 8], 0
mov qword [rdx + 0x10], 0
movzx eax, byte [rbx + 6]
test al, 1
jne 0x1400ca138
or eax, 1
mov rcx, rbx
mov byte [rbx + 6], al
call fcn.1400c9f60
and byte [rbx + 6], 0xfe
add rsp, 0x30
pop rbx
ret
lea rax, [0x140390796]
mov qword [rsp + 0x20], rax
lea r9, str.g_hook_unref
lea r8, [0x1403903e0]
mov edx, 8
lea rcx, [0x1403903fa]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret
lea rax, [0x1403907bc]
jmp 0x1400ca0c7
lea rax, [0x1403907fa]
jmp 0x1400ca0c7
lea rax, str.hook__hook_id__0
jmp 0x1400ca0c7
lea rax, str._G_HOOK_IN_CALL__hook_
jmp 0x1400ca0c7
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400c9f60
mov qword [rbx + 8], rcx
jmp 0x1400ca077

Function at 0x1400ca160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x1400ca180
test rdx, rdx
je 0x1400ca1b8
mov eax, dword [rdx + 0x1c]
and dword [rdx + 0x20], 0xfffffffe
test eax, eax
jne 0x1400ca1c8
add rsp, 0x38
ret
lea rax, [0x140390796]
mov qword [rsp + 0x20], rax
lea r9, str.g_hook_destroy_link
lea r8, [0x1403903e0]
mov edx, 8
lea rcx, [0x1403903fa]
call fcn.1400d2190
nop
add rsp, 0x38
ret
lea rax, [0x1403907bc]
jmp 0x1400ca187
mov dword [rdx + 0x1c], 0
add rsp, 0x38
jmp fcn.1400ca020

Function at 0x1400ca640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400ca660
lock sub dword [rcx + 0x40], 1
je 0x1400ca698
add rsp, 0x30
pop rbx
ret
lea rax, [0x1403908ac]
lea r9, str.g_key_file_unref
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x1403903e0]
lea rcx, [0x1403903fa]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret
call fcn.1400ca540
mov rdx, rbx
mov ecx, 0x48
add rsp, 0x30
pop rbx
jmp fcn.1400e6130

Function at 0x1400cacb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, edx
mov edx, r8d
test rbx, rbx
je 0x1400cacf3
cmp qword [rbx], 0
je 0x1400cace8
lea r8, [0x1403906d0]
mov edx, 0x10
lea rcx, [0x1403903fa]
add rsp, 0x20
pop rbx
jmp fcn.1400d2190
mov r8, r9
call fcn.1400cac00
mov qword [rbx], rax
add rsp, 0x20
pop rbx
ret
Function at 0x1400cdd90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x1400cde30
call fcn.1400ca540
lock sub dword [rbx + 0x40], 1
je 0x1400cde18
mov ecx, 0x20
call fcn.1400e69e0
pxor xmm0, xmm0
mov ecx, 0x18
mov qword [rbx + 0x18], rax
mov rsi, rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
call fcn.1400e69e0
mov qword [rbx + 8], 0
mov qword [rax], rsi
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rbx], rax
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x20], 0
mov byte [rbx + 0x28], 0x3b
mov dword [rbx + 0x2c], 0
add rsp, 0x38
pop rbx
pop rsi
ret
mov rdx, rbx
mov ecx, 0x48
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400e6130
lea rax, [0x1403908ac]
lea r9, str.g_key_file_free
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x1403903e0]
lea rcx, [0x1403903fa]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x1400cde70
Capabilities:
Set environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
test rcx, rcx
je 0x1400cdff0
mov edx, 0x3d
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400cded8
lea rax, str.strchr__variable_____NULL
mov qword [rsp + 0x20], rax
lea r9, str.g_setenv
xor ebx, ebx
lea r8, [0x1403903e0]
mov edx, 8
lea rcx, [0x1403903fa]
call fcn.1400d2190
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x140391277]
test rsi, rsi
je 0x1400cdea0
mov rcx, rbx
call fcn.1400ed3e0
cmp byte [rax], 0
je 0x1400cdf00
lea rax, str.g_utf8_validate__variable___1__NULL_
jmp 0x1400cdea0
mov rcx, rsi
call fcn.1400ed3e0
cmp byte [rax], 0
je 0x1400cdf20
lea rax, str.g_utf8_validate__value___1__NULL_
jmp 0x1400cdea0
test edi, edi
jne 0x1400cdf48
mov rcx, rbx
call fcn.1400c71c0
test rax, rax
je 0x1400cdf48
mov ebx, 1
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov edx, 0xffffffff
call fcn.1402b3210
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov edx, 0xffffffff
mov rbp, rax
call fcn.1402b3210
xor r9d, r9d
mov r8, rsi
mov rcx, rbx
lea rdx, [0x140391285]
mov rdi, rax
call fcn.1400e4ea0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rax
mov rsi, rax
call fcn.1402b3210
mov rcx, rsi
mov rbx, rax
call fcn.14034efb0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wputenv]
mov rcx, rbx
xor ebx, ebx
call fcn.14034efb0
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbp
test eax, eax
setne bl
call fcn.14034efb0
mov rcx, rdi
call fcn.14034efb0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, str.variable___NULL
jmp 0x1400cdea0
Function at 0x1400d10d0
Capabilities:
Query environment variable

Disassembly:
push rbx
add rsp, 0xffffffffffffff80
lea rax, [0x14039c32c]
lea rcx, str.G_MESSAGES_PREFIXED
mov ebx, dword [0x14035ca04]
mov qword [rsp + 0x20], rax
lea rax, [0x14039c332]
mov qword [rsp + 0x30], rax
lea rax, str.warning
mov qword [rsp + 0x40], rax
lea rax, str.message
mov qword [rsp + 0x50], rax
lea rax, [0x14039c34b]
mov qword [rsp + 0x60], rax
lea rax, str.debug
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x48], 0x10
mov dword [rsp + 0x58], 0x20
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], pe_nt_image_headers64
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400d1179
lea rdx, [rsp + 0x20]
mov r8d, 6
call fcn.1400d0ee0
mov ebx, eax
mov dword [0x14035ca04], ebx
sub rsp, 0xffffffffffffff80
pop rbx
ret

Function at 0x1400d1190
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x58
lea rax, str.gc_friendly
lea rcx, str.G_DEBUG
mov qword [rsp + 0x20], rax
lea rax, str.fatal_warnings
mov qword [rsp + 0x30], rax
lea rax, str.fatal_criticals
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x38], 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 8
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400d1210
lea rdx, [rsp + 0x20]
mov r8d, 3
call fcn.1400d0ee0
mov edx, eax
and eax, 1
and edx, 0xfffffffc
or dword [0x14035ca00], edx
mov rdx, qword [0x14048d6e0]
mov dword [rdx], eax
add rsp, 0x58
ret
xor eax, eax
xor edx, edx
jmp 0x1400d11fc
Function at 0x1400d40c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14035c9e0]
mov ecx, eax
test eax, eax
jne 0x1400d40df
lea rcx, [0x14035c9e0]
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400d40f5
mov rax, qword [rax]
test rax, rax
je 0x1400d40f5
mov rax, qword [rax]
add rsp, 0x28
ret

Function at 0x1400d41e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rdx + 0x50]
mov r8d, dword [rcx + 0x28]
mov rsi, rdx
test rax, rax
jne 0x1400d420b
jmp 0x1400d4250
jl 0x1400d4250
mov rax, qword [rax + 8]
test rax, rax
je 0x1400d4250
mov rbx, qword [rax]
cmp r8d, dword [rbx + 0x10]
jne 0x1400d4200
mov rax, qword [rcx + 0x40]
mov rdx, qword [rcx + 0x48]
test rax, rax
je 0x1400d42c0
mov qword [rax + 0x48], rdx
mov rax, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x40]
test rax, rax
je 0x1400d4288
pxor xmm0, xmm0
mov qword [rax + 0x40], rdx
movups xmmword [rcx + 0x40], xmm0
cmp qword [rbx], 0
je 0x1400d429a
add rsp, 0x38
pop rbx
pop rsi
ret
lea rax, str.source_list___NULL
lea r9, str.source_remove_from_context
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14039c3e8]
lea rcx, [0x14039c3b0]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
pxor xmm0, xmm0
mov qword [rbx + 8], rdx
movups xmmword [rcx + 0x40], xmm0
cmp qword [rbx], 0
jne 0x1400d4248
mov rcx, qword [rsi + 0x50]
mov rdx, rbx
call fcn.1400d3ec0
mov rdx, rbx
mov ecx, 0x18
mov qword [rsi + 0x50], rax
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400e6130
mov qword [rbx], rdx
jmp 0x1400d4229
Function at 0x1400d4760
Capabilities:
Hash data using djb2

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x64]
mov rbx, rcx
mov rsi, rdx
test eax, eax
je 0x1400d47e8
movsxd r8, dword [0x14035c9a0]
cmp r8d, 0xffffffff
je 0x1400d4808
movabs rax, 0x431bde82d7b634db
mov ecx, dword [rbx + 0x60]
imul rcx, rcx, 0xf4240
add rcx, rsi
sub rcx, r8
imul rcx
mov rax, rcx
sar rax, 0x3f
sar rdx, 0x12
sub rdx, rax
imul rax, rdx, 0xf4240
mov rdx, rcx
sub rdx, rax
lea rax, [rcx + 0xf4240]
cmp rdx, 0x3d08f
cmovg rcx, rax
sub rcx, rdx
lea rdx, [rcx + r8]
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400d4680
mov edx, dword [rcx + 0x60]
mov rcx, rbx
imul rdx, rdx, 0x3e8
add rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400d4680
lea rcx, [0x14039cc5c]
call fcn.1400c71c0
mov r10, rax
test rax, rax
je 0x1400d48f8
movsx eax, byte [r10]
test al, al
je 0x1400d4928
mov r8, r10
movsx ecx, al
mov edx, 0x1505
nop word [rax + rax]
mov r9d, edx
add r8, 1
shl r9d, 5
add edx, r9d
add edx, ecx
movsx ecx, byte [r8]
test cl, cl
jne 0x1400d4840
mov ecx, 0x1505
test edx, edx
js 0x1400d48b0
nop dword [rax]
mov edx, ecx
add r10, 1
shl edx, 5
add ecx, edx
add ecx, eax
movsx eax, byte [r10]
test al, al
jne 0x1400d4868
movsxd rax, ecx
mov edx, ecx
imul rax, rax, 0x431bde83
sar edx, 0x1f
sar rax, 0x32
sub eax, edx
imul edx, eax, 0xf4240
mov eax, ecx
sub eax, edx
movsxd r8, eax
mov dword [0x14035c9a0], eax
jmp 0x1400d4784
mov edx, 0x1505
nop dword [rax]
mov ecx, edx
add r10, 1
shl ecx, 5
add edx, ecx
add edx, eax
movsx eax, byte [r10]
test al, al
jne 0x1400d48b8
neg edx
movsxd rax, edx
mov ecx, edx
imul rax, rax, 0x431bde83
sar ecx, 0x1f
sar rax, 0x32
sub eax, ecx
imul ecx, eax, 0xf4240
mov eax, edx
sub eax, ecx
movsxd r8, eax
jmp 0x1400d489f
lea rcx, str.HOSTNAME
call fcn.1400c71c0
mov r10, rax
test rax, rax
jne 0x1400d4820
mov dword [0x14035c9a0], 0
xor r8d, r8d
jmp 0x1400d4784
mov r8d, 0x1505
mov eax, 0x1505
jmp 0x1400d489f

Function at 0x1400d5200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400d5220
lock sub dword [rcx + 0x18], 1
je 0x1400d5258
add rsp, 0x30
pop rbx
ret
lea rax, str.file___NULL
lea r9, str.g_mapped_file_unref
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14039c3e8]
lea rcx, [0x14039c3b0]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret
cmp qword [rcx + 8], 0
jne 0x1400d5278
mov rdx, rbx
mov ecx, 0x28
add rsp, 0x30
pop rbx
jmp fcn.1400e6130
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d525f
Function at 0x1400d5f30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.1400d5e70
test eax, eax
jne 0x1400d5f80
lea rax, str.acquired_context
lea r9, str.g_main_context_push_thread_default
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14039c3e8]
lea rcx, [0x14039c3b0]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call fcn.1400d5df0
test rbx, rbx
je 0x1400d5fa0
cmp rax, rbx
je 0x1400d5fa0
mov rcx, rbx
call fcn.1400d4050
jmp 0x1400d5fa2
xor ebx, ebx
mov rax, qword [0x14035c9e0]
lea rdi, [0x14035c9e0]
mov ecx, eax
test eax, eax
je 0x1400d5fe0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x1400d5ff8
mov rdx, rbx
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1400dbd10
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x1400d5fc4
mov ecx, 0x18
call fcn.1400e69e0
pxor xmm0, xmm0
mov qword [rax + 0x10], 0
mov rsi, rax
movups xmmword [rax], xmm0
mov rax, qword [0x14035c9e0]
mov ecx, eax
test eax, eax
jne 0x1400d602b
mov rcx, rdi
call fcn.1401001a0
mov ecx, eax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1400d5fc4

Function at 0x1400d6490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400d6510
mov rcx, qword [rcx + 0x18]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x1400d6500
test rdx, rdx
je 0x1400d6548
mov qword [rdx + 8], rax
mov qword [rbx + 0x18], 0
test rax, rax
je 0x1400d64d8
mov rdx, qword [rbx + 0x10]
mov qword [rax + 0x10], rdx
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400d64ee
call fcn.1400d18e0
mov rdx, rbx
mov ecx, 0x28
add rsp, 0x30
pop rbx
jmp fcn.1400e6130
test rdx, rdx
jne 0x1400d64b7
test rax, rax
jne 0x1400d64c8
jmp 0x1400d64e0
lea rax, str.root___NULL
lea r9, str.g_node_destroy
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14039c3e8]
lea rcx, [0x14039c3b0]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret
mov qword [rcx + 0x20], rax
jmp 0x1400d64bb
Function at 0x1400d6ed0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rcx
mov ebp, edx
mov rcx, qword [rsp + 0x90]
mov rbx, r8
mov rdi, r9
test byte [r8 + 0xc], 1
jne 0x1400d6efe
mov rax, qword [r8]
cmp byte [rax], 0
jne 0x1400d6f10
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, r8
call fcn.1400c84f0
mov r13, rax
test rax, rax
je 0x1400d7050
mov ecx, 0x18
call fcn.1400e69e0
pxor xmm0, xmm0
mov edx, 0x40
mov qword [rax], 0
mov rsi, rax
mov rcx, rax
movups xmmword [rax + 8], xmm0
call fcn.1400e93d0
mov rax, qword [rsi]
mov byte [rax], 0
movsx r8d, byte [rbx + 8]
test r8b, r8b
jne 0x1400d7020
mov r8, r13
lea rdx, str._____s
mov rcx, rsi
call fcn.1400e9c90
mov r8, qword [rbx + 0x28]
test r8, r8
je 0x1400d6fa2
mov rax, qword [r12 + 0x30]
test rax, rax
je 0x1400d6f93
mov rcx, r8
mov rdx, qword [r12 + 0x40]
call rax
mov r8, rax
lea rdx, [0x14039d2b6]
mov rcx, rsi
call fcn.1400e9c90
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x1400d7040
mov rax, qword [r12 + 0x30]
lea r13, [0x14039c240]
test rax, rax
je 0x1400d6fcd
mov rcx, rbx
mov rdx, qword [r12 + 0x40]
call rax
mov rbx, rax
mov rcx, qword [rsi]
call fcn.1400d6560
mov qword [rsp + 0x28], rbx
lea r9d, [rbp + 4]
lea rdx, str._s_s__s_n
mov qword [rsp + 0x20], r13
mov r8, qword [rsi]
sub r9d, eax
mov rcx, rdi
call fcn.1400e9c90
mov rcx, qword [rsi]
call fcn.14034efb0
mov rdx, rsi
mov ecx, 0x18
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400e6130
mov r9, r13
lea rdx, str.____c_____s
mov rcx, rsi
call fcn.1400e9c90
jmp 0x1400d6f73
lea r13, [0x14039c240]
mov rbx, r13
jmp 0x1400d6fcd
mov r13, qword [rbx]
jmp 0x1400d6f24
Function at 0x1400d8cc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.1400d5df0
cmp rbx, rax
mov eax, 0
cmove rbx, rax
mov rax, qword [0x14035c9e0]
mov ecx, eax
test eax, eax
jne 0x1400d8cf4
lea rcx, [0x14035c9e0]
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
lea rax, str.stack___NULL
test rcx, rcx
je 0x1400d8d1d
mov rax, qword [rcx]
test rax, rax
je 0x1400d8d70
cmp rbx, qword [rax]
je 0x1400d8d50
lea rax, str.g_queue_peek_head__stack___context
mov qword [rsp + 0x20], rax
lea r9, str.g_main_context_pop_thread_default
lea r8, [0x14039c3e8]
mov edx, 8
lea rcx, [0x14039c3b0]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret
call fcn.1400df330
mov rcx, rbx
call fcn.1400d6040
test rbx, rbx
je 0x1400d8d42
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400d8970
test rbx, rbx
jne 0x1400d8d16
call fcn.1400df330
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp fcn.1400d6040
Function at 0x1400d92b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov r11, rcx
test rcx, rcx
je 0x1400d9454
mov eax, dword [rcx + 0x9c0]
cmp eax, 0x26f
ja 0x1400d9312
mov ecx, dword [rcx + rax*4]
lea edx, [rax + 1]
mov dword [r11 + 0x9c0], edx
mov edx, ecx
movaps xmm6, xmmword [rsp + 0x30]
shr edx, 0xb
xor edx, ecx
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x40
pop rbx
ret
mov r8d, dword [rcx]
lea r10, [rcx + 0x38c]
mov rax, rcx
lea r9, [0x1403a1a18]
nop word cs:[rax + rax]
mov ecx, r8d
mov r8d, dword [rax + 4]
add rax, 4
and ecx, 0x80000000
mov edx, r8d
and edx, 0x7fffffff
or edx, ecx
mov ecx, edx
and edx, 1
shr ecx, 1
xor ecx, dword [rax + 0x630]
xor ecx, dword [r9 + rdx*4]
mov dword [rax - 4], ecx
cmp rax, r10
jne 0x1400d9330
movdqa xmm5, xmmword [0x1403a1b70]
movdqa xmm4, xmmword [0x1403a1b80]
lea rbx, [r11 + 0x9bc]
movdqa xmm3, xmmword [0x1403a1b90]
nop dword [rax]
movdqu xmm0, xmmword [rax + 4]
movdqu xmm1, xmmword [rax]
add rax, 0x10
pand xmm1, xmm4
pand xmm0, xmm5
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm0, 1
pand xmm1, xmm3
pshufd xmm2, xmm1, 0x55
movd ecx, xmm1
movd edx, xmm2
movdqa xmm2, xmm1
punpckhdq xmm2, xmm1
pshufd xmm1, xmm1, 0xff
mov edx, dword [r9 + rdx*4]
movd r8d, xmm1
movd r10d, xmm2
mov r8d, dword [r9 + r8*4]
movd xmm2, dword [r9 + r10*4]
movd xmm6, edx
movd xmm1, r8d
punpckldq xmm2, xmm1
movd xmm1, dword [r9 + rcx*4]
punpckldq xmm1, xmm6
movdqu xmm6, xmmword [rax - 0x39c]
punpcklqdq xmm1, xmm2
pxor xmm0, xmm6
pxor xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, rbx
jne 0x1400d9388
mov ecx, dword [r11]
mov eax, dword [r11 + 0x9bc]
mov edx, ecx
and eax, 0x80000000
and edx, 0x7fffffff
or eax, edx
mov edx, eax
and eax, 1
shr edx, 1
xor edx, dword [r11 + 0x630]
xor edx, dword [r9 + rax*4]
mov dword [r11 + 0x9bc], edx
mov edx, 1
jmp 0x1400d92d9
lea rax, str.rand___NULL
lea r9, str.g_rand_int
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14039e140]
lea rcx, [0x14039e15a]
call fcn.1400d2190
nop
movaps xmm6, xmmword [rsp + 0x30]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x1400d9670
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x68]
mov rbx, rcx
cmp rax, qword [rcx + 0x70]
jb 0x1400d9708
mov ecx, dword [rcx + 0x60]
test ecx, ecx
js 0x1400d96f7
mov rsi, qword [rbx + 0x78]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
jmp 0x1400d96aa
call rdi
cmp dword [rax], 4
jne 0x1400d96e8
mov ecx, dword [rbx + 0x60]
mov r8d, 0xfa0
mov rdx, rsi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
je 0x1400d96a0
test eax, eax
jle 0x1400d96f0
cdqe
movq xmm0, rsi
add rax, rsi
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rbx + 0x68], xmm0
movzx eax, byte [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call rdi
cmp dword [rax], 0xb
je 0x1400d96a7
nop
mov dword [rbx + 0x60], 0xffffffff
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
movzx eax, byte [rax]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400da400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x1400da440
mov eax, 1
lock xadd dword [rcx], eax
test eax, eax
jle 0x1400da478
cmp eax, 0x7fffffff
jne 0x1400da46c
lea r8, str.Reference_count_has_reached_saturation
mov edx, 8
lea rcx, [0x14039e15a]
add rsp, 0x38
jmp fcn.1400d2190
lea rax, str.arc___NULL
mov qword [rsp + 0x20], rax
lea r9, str.g_atomic_ref_count_inc
lea r8, [0x14039e140]
mov edx, 8
lea rcx, [0x14039e15a]
call fcn.1400d2190
nop
add rsp, 0x38
ret
lea rax, str.old_value___0
jmp 0x1400da447

Function at 0x1400da740
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x68]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp rax, qword [rcx + 0x70]
jae 0x1400da790
lea rdx, [rax + 1]
mov qword [rcx + 0x68], rdx
movzx eax, byte [rax]
cmp al, 0xa
je 0x1400da807
test al, al
je 0x1400da837
add dword [rdi], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, dword [rcx + 0x60]
test ecx, ecx
js 0x1400da837
mov rsi, qword [rbx + 0x78]
mov r12, qword [sym.imp.msvcrt.dll__errno]
jmp 0x1400da7bb
call r12
cmp dword [rax], 4
jne 0x1400da828
mov ecx, dword [rbx + 0x60]
mov r8d, 0xfa0
mov rdx, rsi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
je 0x1400da7b0
test eax, eax
jle 0x1400da830
cdqe
mov edx, 1
movq xmm1, rsi
movq xmm2, rax
movq xmm0, rdx
punpcklqdq xmm1, xmm1
punpcklqdq xmm0, xmm2
paddq xmm0, xmm1
movups xmmword [rbx + 0x68], xmm0
movzx eax, byte [rsi]
test al, al
je 0x1400da840
cmp al, 0xa
jne 0x1400da778
mov dword [rdi], 0
mov eax, 0xa
add dword [rbp], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 0xb
je 0x1400da7b8
mov dword [rbx + 0x60], 0xffffffff
xor eax, eax
jmp 0x1400da77b
mov rcx, rbx
call fcn.1400da6a0
mov rax, qword [rbx + 0x68]
mov qword [rbx + 0x70], rax
jmp 0x1400da830