joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046c24
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebp, ecx
xor r14d, r14d
xor ecx, ecx
mov ebx, r14d
mov esi, r14d
call qword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x140046c83
lea ecx, [r14 + 0xd]
call qword [sym.imp.USER32.DLL_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x140046c7b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test rax, rax
je 0x140046c7b
mov rcx, rax
call sub.msvcrt.dll_wcslen
mov rsi, rax
call qword [sym.imp.USER32.DLL_CloseClipboard]
jmp 0x140046c88
mov rdi, qword [rsp + 0x48]
mov edx, ebp
mov ecx, esi
call fcn.140050b60
test rbx, rbx
je 0x140046cb5
lea ecx, [rsi + 1]
mov rdx, rbx
movsxd r8, ecx
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x140046cb9
mov word [rax], r14w
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140046ccc
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x140046cee
call qword [sym.imp.USER32.DLL_EmptyClipboard]
mov ebx, eax
call qword [sym.imp.USER32.DLL_CloseClipboard]
movsxd rax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400471e4
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1403da2a0], eax
add rsp, 0x28
ret

Function at 0x140047248
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x1400472bd
call qword [rcx + 0xb0]
mov edx, dword [rbx + 0xf4]
mov dword [rbx + 0x108], edx
mov edx, dword [rbx + 0xf8]
mov rdi, rax
mov dword [rbx + 0x10c], edx
test rax, rax
jne 0x1400472bd
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140047295
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x1403d5880]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1403da2a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1403da2b0], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400472cc
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x30
mov r15d, ecx
mov ecx, dword [0x1403da2a0]
mov edi, r9d
mov esi, r8d
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [rsp + 0x60]
mov rbx, rax
cmp edx, dword [rax + 0x120]
je 0x14004731b
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + pe_nt_image_headers64]
mov r8d, dword [rbx + 0x104]
mov edx, dword [rbx + 0x100]
mov r9d, esi
mov rcx, rbx
add r8d, r14d
add edx, r15d
mov dword [rsp + 0x60], edi
mov rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
jmp rax
Function at 0x140047390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1403da2a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400473f1
mov rcx, rax
call qword [rax + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x1400473c9
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x1403d5880]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1403da2a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1403da2b0], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1400478c0
Capabilities:
Get file size
Read file on windows

Disassembly:
xor r8d, r8d
jmp 0x1400478c8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, rdx
xor ebx, ebx
mov r14, rcx
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14004798b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [0x1403d5880]
xor edx, edx
mov r8d, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140047982
lea r9, [rsp + 0x78]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140047970
cmp dword [rsp + 0x78], edi
jne 0x140047970
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call fcn.140047518
mov rbx, rax
mov rcx, qword [0x1403d5880]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1400478c8
Capabilities:
Get file size
Read file on windows

Disassembly:
xor r8d, r8d
jmp 0x1400478c8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, rdx
xor ebx, ebx
mov r14, rcx
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14004798b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [0x1403d5880]
xor edx, edx
mov r8d, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140047982
lea r9, [rsp + 0x78]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140047970
cmp dword [rsp + 0x78], edi
jne 0x140047970
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call fcn.140047518
mov rbx, rax
mov rcx, qword [0x1403d5880]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14004e7e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.140050b60
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14010f3a8
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x14004e810
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140050ca0

Function at 0x14004f7b4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1403d95d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14004f835
mov r8, qword [0x1403d95c8]
mov rcx, qword [0x1403d5880]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1403d95d0]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1403d95c0]
jmp 0x14004f821
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14004f81e
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14004f80c
lea rcx, [0x14004f718]
mov rdx, rdi
call fcn.14010fbd8
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14004f84c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x14004f876
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x1403d95c8]
test rcx, rcx
jne 0x14004f8b9
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x1403d5880]
movsxd r8, ebx
mov edx, 8
mov dword [0x1403d95d0], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1403d95d0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1403d95c8]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x1403d95c8], rcx
mov ecx, dword [0x1403d95d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x1403d95c8]
mov rcx, qword [0x1403d5880]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1403d95d0]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x14004f90d
test rbp, rbp
je 0x14004f934
lea rcx, [0x1403d95c0]
mov edx, 0x28
call fcn.1400504e0
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x14004f934
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140050590
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1403da510], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1403c1da0], eax
call fcn.140051050
add rsp, 0x28
ret
Function at 0x1400506f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140050740
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x1400507a6
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x1403da510]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x1400507d1
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1403da510]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.140050fd0
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140050890
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x1400508c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x140050950
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140050980
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140050a20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1403c1da0], 0xffffffff
jne 0x140050a4f
call fcn.140050590
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1400509d0]
call fcn.14010fbd8
jmp 0x140050a80
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140050a80
call fcn.140051050
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x1400509d0]
call fcn.14010fbd8
add rsp, 0x28
ret

Function at 0x140050b30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
add rsp, 0x38
ret

Function at 0x140050b60
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x140050b90
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x140050c02
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1403da510]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x140050c60
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x140050c60
cmp dword [rsp + 0x20], 0x100000
jge 0x140050c23
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1403da510]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140050ca0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret
Function at 0x140050ce0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x140050f30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x140050f8b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x140050f8b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x140050f8d
xor eax, eax
add rsp, 0x38
ret

Function at 0x140050fa0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x140051050
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x1403da510]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x1403da510]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x1403c1da0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140073550
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r8, rcx
test rcx, rcx
je 0x14007361b
mov rdx, qword [rcx]
xor r9d, r9d
mov qword [rsp], rdi
mov eax, r9d
mov r10d, r9d
lea rdi, [0x14012e700]
mov byte [rdx + 0x16], al
mov rdx, qword [rcx]
mov byte [rdx + 0x17], al
mov rdx, qword [rcx]
mov byte [rdx + 0x18], al
mov rdx, qword [rcx]
mov byte [rdx + 0x19], al
movsxd r11, dword [rcx + 8]
test r11, r11
jle 0x1400735c5
mov qword [rsp + 0x10], rbx
mov rbx, qword [rcx]
nop dword [rax]
movzx edx, byte [rbx + r10]
mov ecx, eax
inc r10
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r10, r11
jl 0x1400735a0
mov rbx, qword [rsp + 0x10]
movsxd r10, dword [r8 + 0x18]
test r10, r10
jle 0x1400735f2
mov r11, qword [r8 + 0x10]
movzx edx, byte [r11 + r9]
mov ecx, eax
inc r9
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r9, r10
jl 0x1400735d2
mov rcx, qword [r8]
mov rdi, qword [rsp]
mov edx, eax
mov byte [rcx + 0x16], al
mov rcx, qword [r8]
shr edx, 8
mov byte [rcx + 0x17], dl
mov rcx, qword [r8]
mov edx, eax
shr edx, 0x10
shr eax, 0x18
mov byte [rcx + 0x18], dl
mov rcx, qword [r8]
mov byte [rcx + 0x19], al
add rsp, 8
ret
Function at 0x140079dd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11d, dword [rcx + 0x18]
mov rax, rcx
test r11d, r11d
je 0x140079e66
mov r9d, dword [rax + 0x20]
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
cmp r9d, r11d
jae 0x140079e5d
mov r10d, dword [rax + 0x1c]
mov qword [rsp + 0x10], rbx
mov ebx, dword [rcx + rdx*4]
mov qword [rsp], rdi
lea rdi, [0x1403d0850]
nop word [rax + rax]
mov ecx, 0x18
mov rdx, rbx
sub ecx, r9d
add r9d, 8
shr rdx, cl
mov ecx, r10d
shr rcx, 8
movzx r8d, dl
xor r8, rcx
movzx ecx, r10b
mov r10d, dword [rdi + r8*4]
shl ecx, 8
mov dword [rax + 0x20], r9d
xor r10d, ecx
mov dword [rax + 0x1c], r10d
cmp r9d, r11d
jb 0x140079e10
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
movzx eax, r10w
add rsp, 8
ret
movzx eax, word [rax + 0x1c]
add rsp, 8
ret
movzx eax, word [rcx + 0x1c]
add rsp, 8
ret
Function at 0x14007ad60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x14]
mov rbx, rcx
test edi, edi
je 0x14007ad9e
mov rcx, qword [rcx]
xor eax, eax
cmp dword [rbx + 0x10], eax
lea rdx, [rcx + rdi*4]
setne al
sub eax, edi
add eax, dword [rbx + 0xc]
shl eax, 2
mov r8d, eax
call qword [sym.imp.msvcrt.dll_memmove]
sub dword [rbx + 0xc], edi
mov dword [rbx + 0x14], 0
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0xc]
mov edx, dword [rbx + 0x10]
sub eax, ecx
shl eax, 2
sub eax, edx
mov qword [rsp + 0x30], rax
jne 0x14007adc2
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rbx]
lea r9, [rcx*4]
lea rcx, [r9 + rdx]
add rcx, r10
test edx, edx
je 0x14007ae00
mov edx, dword [r9 + r10]
mov r8d, edx
mov eax, edx
shl edx, 8
shr r8d, 8
shl eax, 8
xor r8d, eax
and r8d, 0xff00ff
xor r8d, edx
rol r8d, 0x10
mov dword [r9 + r10], r8d
mov r8, qword [rbx + 0x30]
lea rdx, [rsp + 0x30]
call qword [rbx + 0x28]
test eax, eax
je 0x14007adb5
mov r8d, dword [rbx + 0xc]
mov eax, dword [rbx + 0x10]
mov rdx, qword [rsp + 0x30]
lea eax, [rax + r8*4]
lea rcx, [rdx + 3]
add rcx, rax
shr rcx, 2
cmp r8d, ecx
jae 0x14007ae75
sub ecx, r8d
lea r9, [r8*4]
mov r10d, ecx
nop
mov r8, qword [rbx]
lea r9, [r9 + 4]
mov ecx, dword [r8 + r9 - 4]
mov edx, ecx
mov eax, ecx
shl ecx, 8
shr edx, 8
shl eax, 8
xor edx, eax
and edx, 0xff00ff
xor edx, ecx
rol edx, 0x10
mov dword [r8 + r9 - 4], edx
dec r10
jne 0x14007ae40
mov rdx, qword [rsp + 0x30]
mov eax, dword [rbx + 0xc]
lea ecx, [rdx + rax*4]
add ecx, dword [rbx + 0x10]
mov eax, ecx
shr eax, 2
and ecx, 3
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], ecx
mov rbx, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14007df70
Capabilities:
Encode data using xor

Disassembly:
xor al, al
test edx, edx
je 0x14007df97
lea r9, [0x14012fdc0]
nop dword [rax]
movzx r8d, byte [rcx]
movzx eax, al
lea rcx, [rcx + 1]
xor r8, rax
movzx eax, byte [r8 + r9]
dec edx
jne 0x14007df80
ret