joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180135bb0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 0x4c]
mov rbx, rdx
mov rbp, rcx
test eax, eax
je 0x180135d5e
cmp qword [rdx + 0xd8], 0
je 0x180135d5e
cmp qword [rdx + 0xf8], 0
jne 0x180135d5e
xor edi, edi
mov dword [rdx + 0xf0], edi
mov edx, edi
test eax, eax
je 0x180135c2e
mov r8d, dword [rbx + 0x48]
mov rax, qword [rbp + 0x30]
mov ecx, r8d
mov rcx, qword [rax + rcx*8]
mov eax, dword [rcx + 0x134]
inc eax
cmp dword [rbx + 0xf0], eax
jae 0x180135c24
mov dword [rbx + 0xf0], eax
inc edx
inc r8d
cmp edx, dword [rbx + 0x4c]
jb 0x180135c03
mov esi, dword [rbx + 0xf0]
mov ecx, dword [0x18025e63c]
shl esi, 3
test ecx, ecx
js 0x180135c5f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180135c5f
mov rcx, qword [rax + 0x40]
mov r8d, 0x10
mov edx, esi
call fcn.180243b70
jmp 0x180135c62
mov rax, rdi
mov qword [rbx + 0xf8], rax
test rax, rax
jne 0x180135c78
mov eax, 0x8007000e
jmp 0x180135d60
mov ecx, dword [0x18025e63c]
mov esi, dword [rbx + 0x4c]
test ecx, ecx
js 0x180135ca8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180135ca8
mov rcx, qword [rax + 0x40]
lea edx, [rsi*8]
mov r8d, 0x10
call fcn.180243b70
jmp 0x180135cab
mov rax, rdi
mov qword [rbx + 0x100], rax
test rax, rax
je 0x180135c6e
mov r8d, dword [rbx + 0xf0]
mov rcx, qword [rbx + 0xf8]
xor edx, edx
shl r8, 3
call fcn.18024adb8
mov r8d, dword [rbx + 0x4c]
mov rcx, qword [rbx + 0x100]
shl r8, 3
xor edx, edx
call fcn.18024adb8
mov r11, qword [rbx + 0xd8]
mov r8, qword [r11 + 0x40]
cmp dword [rbx + 0x4c], edi
jbe 0x180135d5e
movabs r10, 0x200002800080
test r8, r8
je 0x180135d5e
mov ecx, dword [rbx + 0x48]
mov rax, qword [rbp + 0x30]
add ecx, edi
mov r9, qword [rax + rcx*8]
mov rax, qword [r9 + 0xa8]
test qword [rax + 0x10], r10
jne 0x180135d53
mov rdx, qword [r8 + 0x10]
mov ecx, dword [r9 + 0x134]
mov rax, qword [rbx + 0xf8]
add rdx, 0x28
mov qword [rax + rcx*8], rdx
mov rdx, qword [r8 + 0x10]
mov ecx, dword [r9 + 0x110]
mov rax, qword [rbx + 0x100]
add rdx, 0x28
mov qword [rax + rcx*8], rdx
mov r8, qword [r8 + 0x18]
inc edi
cmp edi, dword [rbx + 0x4c]
jb 0x180135d00
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180146c00
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x19], 0
mov rdi, rcx
jne 0x180146c1a
mov eax, 0x8000ffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
test rdx, rdx
je 0x180146d46
mov rbx, qword [rcx + 8]
movabs rax, 0x7fffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x180146d3f
cmp rbx, 0x10
jae 0x180146c59
mov ebx, 0x20
jmp 0x180146c67
cmp rbx, rax
ja 0x180146c63
add rbx, rbx
jmp 0x180146c67
or rbx, 0xffffffffffffffff
cmp rbx, rdx
jb 0x180146c42
movabs rax, 0x3ffffffffffffff
cmp rbx, rax
ja 0x180146d3f
test rbx, rbx
je 0x180146d49
mov ecx, dword [0x18025e63c]
mov rsi, rbx
shl rsi, 6
test ecx, ecx
jns 0x180146c9e
mov rax, rbp
jmp 0x180146ca4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x180146cc4
mov eax, 0x8007000e
jmp 0x180146d9d
mov rax, qword [rdi + 0x10]
mov r8, rbx
cmp rbx, rax
cmova r8, rax
test r8, r8
je 0x180146d4c
mov rdx, rbp
nop word [rax + rax]
mov rcx, qword [rdi]
add rdx, 0x40
sub r8, 1
mov rax, qword [rdx + rcx - 0x40]
mov qword [rdx + rsi - 0x40], rax
mov rax, qword [rdx + rcx - 0x38]
mov qword [rdx + rsi - 0x38], rax
mov rax, qword [rdx + rcx - 0x30]
mov qword [rdx + rsi - 0x30], rax
mov rax, qword [rdx + rcx - 0x28]
mov qword [rdx + rsi - 0x28], rax
mov rax, qword [rdx + rcx - 0x20]
mov qword [rdx + rsi - 0x20], rax
mov rax, qword [rdx + rcx - 0x18]
mov qword [rdx + rsi - 0x18], rax
mov rax, qword [rdx + rcx - 0x10]
mov qword [rdx + rsi - 0x10], rax
mov rax, qword [rdx + rcx - 8]
mov qword [rdx + rsi - 8], rax
jne 0x180146ce0
jmp 0x180146d4c
mov eax, 0x80070216
jmp 0x180146d9d
mov rbx, rbp
mov rsi, rbp
cmp byte [rdi + 0x18], 0
je 0x180146d86
mov qword [rsp + 0x48], r12
mov r12, qword [rdi]
test r12, r12
je 0x180146d81
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x180146d72
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov rcx, qword [rbp]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
cmp qword [rdi + 0x10], rbx
jbe 0x180146d97
mov qword [rdi + 0x10], rbx
mov byte [rdi + 0x18], 1
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18017f500
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
mov ecx, 0x98
mov rbp, r9
mov r13, r8
mov r14, rdx
mov r12d, 1
call fcn.180071960
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x18017f6ed
mov dword [rax + 8], 5
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r12d
mov qword [rdi + 0x28], rbx
mov dword [rdi + 0x30], ebx
mov dword [rdi + 0x34], ebx
mov dword [rdi + 0x38], 0x21
mov qword [rdi + 0x40], r13
mov qword [rdi + 0x48], rbx
mov byte [rdi + 0x50], r12b
mov qword [rdi + 0x58], rbx
mov dword [rdi + 0x60], ebx
lea rax, [0x180041948]
lea rdx, [rsp + 0x20]
mov qword [rdi], rax
mov rax, qword [r14]
mov rcx, rbp
mov qword [rdi + 0x68], rax
mov rax, qword [r14 + 8]
mov qword [rdi + 0x70], rax
mov rax, qword [r14 + 0x10]
mov qword [rdi + 0x78], rax
mov rax, qword [r14 + 0x18]
mov qword [rdi + 0x80], rax
mov rax, qword [r14 + 0x20]
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x88], rax
mov rax, qword [rbp]
call qword [rax + 0x58]
test byte [rax + 3], 2
je 0x18017f6b3
mov rax, qword [rbp]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [rax + 0x58]
test byte [rax + 3], r12b
je 0x18017f6b3
mov qword [rsi + 0x70], rbp
mov qword [rsi + 0x78], rbx
mov dword [rsi + 0x80], 4
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18017f610
mov rax, rbx
jmp 0x18017f616
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x40
lea r8d, [rdx - 0x30]
call fcn.180243b70
mov r11, rax
test rax, rax
je 0x18017f6a1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], 0xffffffff
mov dword [r11 + 8], 7
mov dword [r11 + 0x3c], 0x10
mov qword [r11 + 0x30], rbx
lea rax, [0x180043470]
mov qword [r11], rax
mov dword [r11 + 0x38], ebx
cmp dword [rbp + 8], 0xa
jne 0x18017f67b
mov rax, qword [rsi + 0x70]
cmp qword [rbp + 0x38], rax
jne 0x18017f67b
mov qword [r11 + 0x30], rbp
jmp 0x18017f6a4
mov rax, qword [rsi + 0x70]
mov qword [r11 + 0x30], rax
cmp rbp, qword [rsi + 0x70]
je 0x18017f6a4
lea r9, [0x180042f10]
mov r8d, 0xc01
mov rdx, r14
mov rcx, rsi
call fcn.18010c480
mov r11, rbp
mov qword [rdi + 0x28], r11
test r11, r11
jne 0x18017f6d3
mov r12d, 0x8007000e
add dword [rdi + 0x20], 0xffffffff
jne 0x18017f6c6
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rax, qword [rsp + 0x70]
mov qword [rax], rbx
mov eax, r12d
jmp 0x18017f6fa
mov rcx, qword [rsp + 0x70]
mov qword [rsi + 0x70], rbx
mov qword [rsi + 0x78], rbx
mov dword [rsi + 0x80], ebx
mov eax, ebx
mov qword [rcx], rdi
jmp 0x18017f6fa
mov rcx, qword [rsp + 0x70]
mov eax, 0x8007000e
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x180185f40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbp, r9
mov rsi, r8
mov rdi, rcx
jne 0x180185f71
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
xor r12d, r12d
test ecx, ecx
jns 0x180185f8d
mov rax, r12
jmp 0x180185f93
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0xb0
mov r8d, 0x10
call fcn.180243b70
mov rbx, rax
test rax, rax
je 0x1801860cc
mov qword [rbx + 0x60], r12
mov qword [rbx + 0x68], r12
mov qword [rbx + 0x70], r12
mov qword [rbx + 0x78], r12
mov qword [rbx + 0x80], r12
mov qword [rbx + 0x90], r12
lea rax, [0x180034acf]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x28], 0xffffffff
mov dword [rbx + 0x2c], 0xffffffff
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x34], 0xffffffff
mov dword [rbx + 0x38], 0xffffffff
mov dword [rbx + 0x3c], r12d
mov qword [rbx + 0x40], r12
and byte [rbx + 0x98], 0xe0
lea rax, [0x1800417d0]
mov qword [rbx], rax
mov dword [rbx + 0x48], 0xffffffff
mov dword [rbx + 0x50], 0xffffffff
mov dword [rbx + 0x54], 0xffffffff
mov dword [rbx + 0x58], 0xffffffff
mov dword [rbx + 0x5c], 0xffffffff
mov dword [rbx + 0x4c], r12d
mov dword [rbx + 8], 7
mov qword [rbx + 0xa0], r12
mov qword [rbx + 0xa8], r12
test rsi, rsi
jne 0x180186068
mov rsi, qword [rdi + 0x3b8]
mov rax, qword [rdi + 0x98]
mov rdx, qword [rdi + 8]
mov r9b, 1
mov r8, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.18010e580
test eax, eax
js 0x1801860cc
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0xa0], rbp
mov qword [rbx + 0xa8], rax
mov rax, qword [rdi + 8]
mov qword [rbx + 0x80], r12
mov qword [rbx + 0x68], rax
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x1801860c2
mov qword [rcx + 0x80], rbx
mov qword [rax + 0x78], rbx
jmp 0x1801860d6
mov qword [rax + 0x70], rbx
mov qword [rax + 0x78], rbx
jmp 0x1801860d6
mov byte [rdi + 0x468], 1
mov rbx, r12
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180186100
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbp, r9
mov esi, r8d
mov r12, rdx
mov rdi, rcx
jne 0x18018612f
xor eax, eax
jmp 0x180186233
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x40], rbx
test ecx, ecx
jns 0x180186142
xor eax, eax
jmp 0x180186148
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0xb0
mov r8d, 0x10
call fcn.180243b70
mov rbx, rax
test rax, rax
je 0x180186222
mov rcx, rax
call fcn.18010ea80
lea rcx, [0x180041758]
mov dword [rbx + 8], esi
sub esi, 8
mov qword [rbx], rcx
mov qword [rbx + 0xa8], 0
je 0x1801861b8
sub esi, 1
je 0x1801861ab
cmp esi, 1
je 0x18018619e
xor eax, eax
jmp 0x18018622e
inc dword [rdi + 0x47c]
mov eax, 8
jmp 0x1801861c3
inc dword [rdi + 0x478]
mov eax, 7
jmp 0x1801861c3
inc dword [rdi + 0x474]
mov eax, 6
mov dword [rbx + 0xa0], eax
test rbp, rbp
jne 0x1801861d5
mov rbp, qword [rdi + 0x3b8]
mov rax, qword [rdi + 0x98]
mov rdx, qword [rdi + 8]
mov r9b, 1
mov r8, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.18010e580
test eax, eax
js 0x18018621e
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0xa8], rax
cmp rbp, qword [rdi + 0x3b8]
je 0x180186249
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call fcn.180113ee0
test eax, eax
jns 0x180186285
test eax, eax
je 0x18018622b
mov byte [rdi + 0x468], 1
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov rax, qword [rdi + 8]
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x68], rax
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x18018627d
mov qword [rcx + 0x80], rbx
mov qword [rax + 0x78], rbx
mov qword [rdi + 8], rbx
mov byte [rdi + 0x46d], 1
jmp 0x18018622b
mov qword [rax + 0x70], rbx
mov qword [rax + 0x78], rbx
mov qword [rdi + 8], rbx
mov byte [rdi + 0x46d], 1
jmp 0x18018622b
Function at 0x1801862a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rsi, r9
mov r12, r8
mov rbp, rdx
mov rbx, rcx
jne 0x1801862cf
xor eax, eax
jmp 0x18018638b
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x40], rdi
test ecx, ecx
jns 0x1801862e2
xor eax, eax
jmp 0x1801862e8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0xb0
mov r8d, 0x10
call fcn.180243b70
mov rdi, rax
test rax, rax
je 0x18018637a
mov rcx, rax
call fcn.18010ea80
mov dword [rdi + 8], 0xb
mov qword [rdi + 0xa8], 0
lea rcx, [0x180041758]
mov r9b, 1
mov r8, r12
mov qword [rdi], rcx
mov rax, qword [rbx + 0x98]
mov rdx, qword [rbx + 8]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18010e580
test eax, eax
js 0x180186376
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
mov qword [rdi + 0xa8], rsi
call fcn.180113ee0
test eax, eax
js 0x180186376
inc dword [rbx + 0x480]
mov qword [rbx + 8], rdi
mov byte [rbx + 0x46d], 1
jmp 0x180186383
test eax, eax
je 0x180186383
mov byte [rbx + 0x468], 1
xor edi, edi
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x18018e320
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0xd220]
lea rax, [0x180047c40]
mov qword [rsp + 0x38], r12
xor r12d, r12d
mov rdi, rcx
mov qword [rcx], rax
test rbx, rbx
je 0x18018e373
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18018e35f
mov rax, r12
jmp 0x18018e365
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0xd238]
test rcx, rcx
je 0x18018e389
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rdi + 0xd240]
mov qword [rdi + 0xd238], r12
test rcx, rcx
je 0x18018e3a6
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
test byte [rdi + 0xcefa], 1
mov qword [rdi + 0xd240], r12
jne 0x18018e3d9
mov rbx, qword [rdi + 0xd230]
test rbx, rbx
je 0x18018e3d2
mov rcx, rbx
call fcn.1800f76e0
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rdi + 0xd230], r12
lea rbx, [rdi + 0xd510]
mov esi, 2
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
sub rbx, 0x20
mov qword [rbx + 0x10], r12
cmp byte [rbx + 0x18], r12b
je 0x18018e42d
mov rbp, qword [rbx]
test rbp, rbp
je 0x18018e429
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18018e415
mov rax, r12
jmp 0x18018e41b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [rbx + 0x18], r12b
sub esi, 1
mov qword [rbx], r12
mov qword [rbx + 8], r12
jns 0x18018e3f0
lea rcx, [rdi + 0xd490]
call fcn.1800c6110
lea rcx, [rdi + 0xd470]
call fcn.1800c6110
lea rcx, [rdi + 0xd450]
call fcn.1800c6110
lea rcx, [rdi + 0xd430]
call fcn.1800c6110
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
lea rbx, [rdi + 0xd430]
mov esi, 0x13
nop
sub rbx, 0x18
mov rcx, rbx
call fcn.180193ad0
sub esi, 1
jns 0x18018e480
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.18019dff0
Function at 0x180190410
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
mov rdi, rbx
test rdx, rdx
je 0x180190489
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
mov r12d, ecx
cmp r12, 0xffffffffffffffff
ja 0x1801904da
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x180190465
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1801904da
mov r8, r12
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rsi, qword [rbp + 0xd220]
test rsi, rsi
je 0x1801904b6
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x1801904a8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0xd220], rdi
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov eax, 0x8007000e
jmp 0x1801904bf
Function at 0x180193ad0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
mov rbx, rcx
test rdi, rdi
je 0x180193b20
nop word [rax + rax]
mov rax, qword [rdi]
mov qword [rbx], rax
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x180193b04
xor eax, eax
jmp 0x180193b0a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbx]
test rdi, rdi
jne 0x180193af0
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x180193b4b
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x180193b37
xor eax, eax
jmp 0x180193b3d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180193b70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
mov rsi, r8
mov r12, rdx
mov word [rdx], di
mov ebx, ecx
mov qword [r8], rdi
cmp ecx, 0xffff
jbe 0x180193ba7
mov eax, 0x80070216
jmp 0x180193c33
test ecx, ecx
je 0x180193c31
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x180193bbe
mov rax, rdi
jmp 0x180193bc4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp ebx, dword [rax + 0x250]
ja 0x180193c06
mov qword [rsp + 0x30], rbp
lea ebp, [rbx - 1]
shl rbp, 5
add rbp, qword [rax + 0x248]
cmp qword [rbp + 8], rdi
jne 0x180193bf1
mov rcx, rbp
call fcn.180109b60
test eax, eax
jne 0x180193bfc
mov rdi, qword [rbp + 8]
mov rax, qword [rdi]
mov qword [rbp + 8], rax
mov rbp, qword [rsp + 0x30]
mov qword [rsi], rdi
jmp 0x180193c1f
mov rcx, qword [rax + 0x28]
lea edx, [rbx*8]
mov r8d, 0x10
call fcn.180243b70
mov qword [rsi], rax
cmp qword [rsi], 0
jne 0x180193c2c
mov eax, 0x8007000e
jmp 0x180193c33
mov word [r12], bx
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x180193c50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp word [rcx], 0
mov rdi, rdx
mov rbx, rcx
je 0x180193cbb
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x30], rsi
xor esi, esi
test ecx, ecx
jns 0x180193c7c
mov rax, rsi
jmp 0x180193c82
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, word [rbx]
cmp ecx, dword [rax + 0x250]
ja 0x180193cb0
mov r8, qword [rdi]
dec ecx
movsxd rdx, ecx
shl rdx, 5
add rdx, qword [rax + 0x248]
test r8, r8
je 0x180193cb0
mov rax, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r8
mov word [rbx], si
mov qword [rdi], rsi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180197940
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x18025e63c]
xor ebx, ebx
test ecx, ecx
jns 0x180197957
mov rcx, rbx
jmp 0x180197960
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
cmp qword [rcx + 0x30], rbx
je 0x180197998
mov rdx, qword [rcx + 0x30]
test rdx, rdx
je 0x18019798f
mov rax, qword [rdx]
mov qword [rcx + 0x30], rax
test rax, rax
jne 0x18019797f
mov qword [rcx + 0x38], rbx
movabs rax, 0xfefefefefefefefe
mov rbx, rdx
mov qword [rdx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x28]
mov edx, 0x80
lea r8d, [rdx - 0x70]
add rsp, 0x20
pop rbx
jmp fcn.180243b70

Function at 0x1801979c0
Capabilities:
Get thread local storage value

Disassembly:
test rcx, rcx
je 0x180197a2f
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x180197a2a
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x180197a25
mov edx, 0xfe
mov rcx, rbx
lea r8d, [rdx - 0x7e]
call fcn.18024adb8
mov qword [rbx], 0
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x180197a1d
mov qword [rax], rbx
mov qword [rdi + 0x38], rbx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
repz ret

Function at 0x18019dd80
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x18025e63c]
xor ebx, ebx
test ecx, ecx
jns 0x18019dd97
mov rcx, rbx
jmp 0x18019dda0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
cmp qword [rcx + 0x18], rbx
je 0x18019ddd8
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x18019ddcf
mov rax, qword [rdx]
mov qword [rcx + 0x18], rax
test rax, rax
jne 0x18019ddbf
mov qword [rcx + 0x20], rbx
movabs rax, 0xfefefefefefefefe
mov rbx, rdx
mov qword [rdx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x10]
mov edx, 0x188
mov r8d, 0x10
add rsp, 0x20
pop rbx
jmp fcn.180243b70

Function at 0x18019de00
Capabilities:
Get thread local storage value

Disassembly:
test rcx, rcx
je 0x18019de70
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x30], rdi
test ecx, ecx
jns 0x18019de20
xor edi, edi
jmp 0x18019de29
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 0xfe
mov r8d, 0x188
mov rcx, rbx
call fcn.18024adb8
mov qword [rbx], 0
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x18019de5e
mov qword [rax], rbx
mov qword [rdi + 0x20], rbx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
repz ret
Function at 0x18019e250
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x50]
xor ebx, ebx
mov rsi, rcx
test rdi, rdi
je 0x18019e298
mov rcx, rdi
call fcn.18011dbe0
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18019e284
mov rax, rbx
jmp 0x18019e28a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x18019e2ab
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18019ea00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 8]
mov edi, dword [rcx + 0xce40]
mov r12, rdx
mov rbx, rcx
cmp eax, edi
jne 0x18019eadb
test edi, edi
je 0x18019ea39
add edi, edi
jmp 0x18019ea3e
mov edi, 0x10
cmp edi, eax
jb 0x18019ea4a
mov esi, edi
sub esi, eax
xor eax, eax
jmp 0x18019ea52
or esi, 0xffffffff
mov eax, 0x80070216
test eax, eax
js 0x18019eaf5
mov ecx, edi
call fcn.180109c60
mov rbp, rax
test rax, rax
jne 0x18019ea73
mov eax, 0x8007000e
jmp 0x18019eaf5
mov r8d, dword [rbx + 8]
mov rdx, qword [rbx + 0xce48]
mov rcx, rax
shl r8, 3
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx + 8]
mov r8d, esi
lea rcx, [rbp + rax*8]
shl r8, 3
xor edx, edx
call fcn.18024adb8
mov rsi, qword [rbx + 0xce48]
test rsi, rsi
je 0x18019eace
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18019eaba
xor eax, eax
jmp 0x18019eac0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx + 0xce48], rbp
mov dword [rbx + 0xce40], edi
mov edx, dword [rbx + 8]
mov rcx, qword [rbx + 0xce48]
mov qword [rcx + rdx*8], r12
mov ecx, dword [rbx + 8]
mov dword [r12], ecx
inc dword [rbx + 8]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret