joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001416e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x50], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx + 8]
movabs r8, 0x77684d53708e8e3d
movabs rax, 0x77684d53708e8e3e
xor r8, rax
movabs rax, 0xe21b6fa2983308ca
movabs rdx, 0x1de4905d67ccf735
xor rax, rdx
xor r8, rax
mov rax, rcx
and rax, r8
mov rdx, rcx
or rdx, r8
movabs r8, 0x145232250d3e9a5d
movabs r9, 0xebadcddaf2c165a2
xor r8, r9
xor rdx, r8
imul rdx, rax
movabs rax, 0x18ea50c271ef05bc
movabs r8, 0x18ea50c271ef05bf
xor rax, r8
mov r8, rcx
and r8, rax
mov rax, rcx
or rax, 3
imul rax, r8
add rax, rdx
mov qword [rsp + 0x60], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x1401975f8]
mulsd xmm0, xmm1
movsd qword [rsp + 0x68], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x70], xmm1
ucomisd xmm0, xmm1
jne 0x140014249
jp 0x140014249
jmp 0x140014298
movsd xmm1, qword [rsp + 0x68]
movsd xmm0, qword [rsp + 0x70]
subsd xmm0, xmm1
call fcn.140195ba0
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rsp + 0x48], xmm1
call fcn.140195ba0
movsd xmm1, qword [rsp + 0x48]
movsd xmm2, qword [0x140197600]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x140014298
call fcn.14000a590
jmp 0x14001439f
mov rax, qword [rsp + 0x60]
mov ecx, 2
cqo
idiv rcx
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax], rcx
mov rax, rcx
shl rax, 4
mov qword [rsp + 0x30], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x140197608]
mulsd xmm0, xmm1
movsd qword [rsp + 0x38], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x40], xmm1
ucomisd xmm0, xmm1
jne 0x1400142f5
jp 0x1400142f5
jmp 0x140014344
movsd xmm1, qword [rsp + 0x38]
movsd xmm0, qword [rsp + 0x40]
subsd xmm0, xmm1
call fcn.140195ba0
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x38]
movsd qword [rsp + 0x28], xmm1
call fcn.140195ba0
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x140197600]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x140014344
call fcn.14000a590
jmp 0x14001439f
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x140014363
mov rcx, r8
mov rdx, r8
call fcn.140010917
jmp 0x14001439f
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.1400104c6
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
add rsp, 0x78
ret
Function at 0x140019683
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
cmp rdx, 0
je 0x1400197c2
mov rax, qword [rsp + 0x50]
movabs rcx, 0xe0362914855327c4
movabs rdx, 0xe0362914855327c4
xor rcx, rdx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
movabs rax, 0x8fb9e754e41b7a1d
movabs rdx, 0x8fb9e754e41b7a1d
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x40], rax
mov rdx, qword [rax]
movabs rax, 0xb837d2a979c88d83
movabs rcx, 0xb837d2a979c88d93
xor rax, rcx
mov rcx, rdx
add rcx, rax
mov qword [rsp + 0x48], rcx
movabs rax, 0xcc6271907ade4263
movabs r8, 0x339d8e6f8521bd9c
xor rax, r8
xor rdx, rax
mov rax, rcx
and rax, rdx
movabs r8, 0x2307d6a89fce9144
movabs r9, 0xdcf8295760316ebb
xor r8, r9
xor rax, r8
movabs r8, 0xf5fd5b482518a99c
movabs r9, 0xa02a4b7dae75663
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
movabs rdx, 0x1b65760e2e84067d
movabs r8, 0xe49a89f1d17bf982
xor rdx, r8
xor rax, rdx
movabs rdx, 0x84baf7b0bffc90f3
movabs r8, 0x7b45084f40036f0c
xor rdx, r8
xor rcx, rdx
or rax, rcx
cmp rax, 0
jge 0x1400197b5
call fcn.14000a590
jmp 0x1400197c2
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x60]
cmp rax, 0
je 0x14001990a
mov rax, qword [rsp + 0x60]
movabs rcx, 0x41e5d0182620e42e
movabs rdx, 0x41e5d0182620e42e
xor rcx, rdx
movabs rdx, 0x611083d4d16fd008
movabs r8, 0x9eef7c2b2e902ff8
xor rdx, r8
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x1400198e4
mov rdx, qword [rsp + 0x38]
mov rax, rdx
and rax, 0xfffffffffffffff0
movabs r8, 0x34f46dc5df9a12ea
movabs rcx, 0xcb0b923a2065ed1a
xor r8, rcx
mov rcx, rdx
or rcx, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0xe07abba0b4c4fc93
movabs r8, 0x1f85445f4b3b036c
xor rdx, r8
cmp rax, rdx
setg al
xor al, 0xff
xor cl, 0xff
mov dl, 1
xor dl, 0
or al, cl
xor ecx, ecx
xor cl, 0
or cl, dl
xor al, 0xff
and al, cl
test al, 1
jne 0x1400198b9
jmp 0x1400198c3
call fcn.14000a590
jmp 0x14001990a
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140013f0f
jmp 0x14001990a
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.140013f0f
mov rcx, qword [rsp + 0x60]
call fcn.140014085
nop
add rsp, 0x68
ret
Function at 0x140019910
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov qword [rcx], rdx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x40]
cmp rax, 0
je 0x140019a4c
mov rax, qword [rsp + 0x40]
xor ecx, ecx
sub rcx, 0xfffffffffffffff0
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0x72a40e7346ca233d
movabs rdx, 0x72a40e7346ca232d
xor rcx, rdx
cmp rax, rcx
jb 0x140019a26
mov rdx, qword [rsp + 0x38]
movabs rcx, 0x1c9b98a2032aca0a
movabs rax, 0x15cdfa9a96f477d5
xor rcx, rax
mov rax, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x2b7adcea10e16636
movabs r8, 0x222cbed2853fdbe9
xor rcx, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x8e957f4195a18c90
movabs r8, 0x716a80be6a5e736f
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1400199f3
jmp 0x1400199fd
call fcn.14000a590
jmp 0x140019a4c
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 0
and cl, 1
call fcn.140013f0f
jmp 0x140019a4c
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.140013f0f
mov rcx, qword [rsp + 0x40]
call fcn.140014085
nop
add rsp, 0x48
ret
Function at 0x140019a52
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], rax
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x140019a98
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call rax
test al, 1
jne 0x140019a98
jmp 0x140019b12
mov rax, qword [0x1401ab088]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140019ac7
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call rax
test al, 1
jne 0x140019ac7
jmp 0x140019b12
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x30]
add rcx, 0x38
mov rdx, rax
add rdx, 0x10
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax + 0x10]
xor eax, eax
mov r8b, al
call fcn.140019683
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
call fcn.140019910
mov rax, qword [rsp + 0x38]
mov cl, 0x46
xor cl, 0x47
mov byte [rax + 0x60], cl
add rsp, 0x48
ret
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x18], rax
mov eax, 0x20
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov rax, rcx
add rax, 0x10
mov qword [rbp - 8], rax
cmp qword [rcx + 0x10], 0
jne 0x140019b6e
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x28]
mov qword [rax], rcx
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
cmp rax, 0
setne al
cmp rcx, 0
setne cl
xor al, 0xff
xor cl, 0xff
xor edx, edx
xor dl, 1
xor r8d, r8d
xor r8b, 1
xor dl, r8b
or al, cl
xor ecx, ecx
xor cl, 1
or cl, dl
xor al, 0xff
and al, cl
test al, 1
jne 0x140019bb2
jmp 0x140019be2
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x38]
mov r8, qword [rbp - 0x18]
mov r9, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
add rcx, 0x28
mov qword [rdx], r9
mov qword [rdx + 8], r8
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140019338
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rsp, rbp
pop rbp
jmp 0x140019a52
Function at 0x140019b17
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], rax
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x140019a98
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call rax
test al, 1
jne 0x140019a98
jmp 0x140019b12
mov rax, qword [0x1401ab088]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140019ac7
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call rax
test al, 1
jne 0x140019ac7
jmp 0x140019b12
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x30]
add rcx, 0x38
mov rdx, rax
add rdx, 0x10
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax + 0x10]
xor eax, eax
mov r8b, al
call fcn.140019683
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
call fcn.140019910
mov rax, qword [rsp + 0x38]
mov cl, 0x46
xor cl, 0x47
mov byte [rax + 0x60], cl
add rsp, 0x48
ret
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x18], rax
mov eax, 0x20
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov rax, rcx
add rax, 0x10
mov qword [rbp - 8], rax
cmp qword [rcx + 0x10], 0
jne 0x140019b6e
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x28]
mov qword [rax], rcx
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
cmp rax, 0
setne al
cmp rcx, 0
setne cl
xor al, 0xff
xor cl, 0xff
xor edx, edx
xor dl, 1
xor r8d, r8d
xor r8b, 1
xor dl, r8b
or al, cl
xor ecx, ecx
xor cl, 1
or cl, dl
xor al, 0xff
and al, cl
test al, 1
jne 0x140019bb2
jmp 0x140019be2
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x38]
mov r8, qword [rbp - 0x18]
mov r9, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
add rcx, 0x28
mov qword [rdx], r9
mov qword [rdx + 8], r8
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140019338
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rsp, rbp
pop rbp
jmp 0x140019a52

Function at 0x140019d55
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0xbf3cb2584a61431c
movabs rax, 0xbf3cb2584a61435c
xor rcx, rax
movabs rdx, 0x5cbb71963dd66d3a
movabs rax, 0x5cbb71963dd66d32
xor rdx, rax
call fcn.140019bef
mov rcx, rax
mov rax, qword [0x1401a1598]
mov qword [rcx], rax
lea rax, [0x140197d6e]
mov qword [rcx + 0x10], rax
movabs rax, 0x5204cb8ede432dde
movabs rdx, 0x5204cb8ede432dde
xor rax, rdx
mov qword [rcx + 0x18], rax
lea rax, [0x140197d30]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x6d1fac57
lea rdx, [0x140197d6e]
lea r8, [0x140197d4c]
lea r9, [0x140197d55]
call fcn.140019b17
nop
add rsp, 0x28
ret
Function at 0x14001a941
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14001aa43
mov rcx, qword [rsp + 0x40]
mov rax, rcx
and rax, 0xfffffffffffffff0
movabs rdx, 0xbc83dc5436bcc86d
movabs r8, 0x437c23abc943379d
xor rdx, r8
or rcx, rdx
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0x4a659a69750fda15
movabs rdx, 0x4a659a69750fda05
xor rcx, rdx
cmp rax, rcx
jb 0x14001aa22
mov rdx, qword [rsp + 0x38]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14001a9ef
jmp 0x14001a9f9
call fcn.14000a590
jmp 0x14001aa43
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 0
and cl, 1
call fcn.140013f0f
jmp 0x14001aa43
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.140013f0f
mov rcx, qword [rsp + 0x40]
call fcn.140014085
nop
add rsp, 0x48
ret

Function at 0x14001acb7
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov qword [rcx], rdx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x40]
cmp rax, 0
je 0x14001ae01
mov rax, qword [rsp + 0x40]
movabs rcx, 0x9962a06b8c74f72e
movabs rdx, 0x9962a06b8c74f72e
xor rcx, rdx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
movabs rax, 0xb4f2f5f02565668a
movabs rdx, 0xb4f2f5f02565668a
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0x1b03dcfb23bb54fc
movabs rdx, 0x1b03dcfb23bb54ec
xor rcx, rdx
cmp rax, rcx
jb 0x14001addb
mov rdx, qword [rsp + 0x38]
movabs rcx, 0xcda2d6915044b50b
movabs rax, 0x325d296eafbb4afb
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x9e4fc1de94725bf9
movabs r8, 0x61b03e216b8da406
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x14001adb0
jmp 0x14001adba
call fcn.14000a590
jmp 0x14001ae01
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140013f0f
jmp 0x14001ae01
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.140013f0f
mov rcx, qword [rsp + 0x40]
call fcn.140014085
nop
add rsp, 0x48
ret
Function at 0x14001b13e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14001b1be
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
movabs rcx, 0x22ac0ea80b45b26e
movabs rdx, 0x62ac0ea80b45b26e
xor rcx, rdx
and rax, rcx
movabs rcx, 0x19bf95d11dff0e96
movabs rdx, 0x19bf95d11dff0e96
xor rcx, rdx
cmp rax, rcx
jne 0x14001b1be
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rcx, qword [rcx + 8]
mov qword [rax + 8], rcx
add rsp, 0x38
ret
Function at 0x14001e1de
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14004d9e6
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x78
xor cl, 0x78
cmp al, cl
jne 0x14001e221
mov rcx, qword [rsp + 0x28]
call fcn.14004db62
nop
add rsp, 0x38
ret
Function at 0x14001eb15
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14001eb76
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x14001eb76
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], 0
mov qword [rax], 0
add rsp, 0x38
ret
Function at 0x140020156
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x30]
add rcx, 0x60
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x1400201bd
mov rax, qword [0x1401ab090]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x1400201bd
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
je 0x1400201ea
mov rax, qword [rsp + 0x38]
mov cl, 0x5b
xor cl, 0x5b
mov byte [rax], cl
call fcn.1400201fa
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x1400201f4
mov ecx, 1
call sub.msvcrt.dll_exit
nop
add rsp, 0x48
ret

Function at 0x1400201fa
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140019683
Function at 0x14002022a
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rax, qword [rsp + 0x68]
mov cl, byte [rax + 0x60]
mov dl, 0x1f
xor dl, 0x1f
xor eax, eax
cmp cl, dl
mov byte [rsp + 0x77], al
je 0x1400202a9
mov rax, qword [rsp + 0x60]
mov cl, 0xbf
xor cl, 0xbf
mov byte [rax], cl
call fcn.140020156
call fcn.1400201fa
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov dl, 0xc2
xor dl, 0xc2
mov byte [rax], dl
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
xor ecx, ecx
mov edx, ecx
sub rdx, rax
xor ecx, ecx
sub rcx, 0xffffffffffffffff
add rdx, rcx
movabs rcx, 0xd267be50287fd1cf
movabs r8, 0xd267be50287fd1cf
xor rcx, r8
sub rcx, rdx
mov qword [rsp + 0x30], rcx
movabs rcx, 0xeb31eb902193441d
movabs rdx, 0xeb31eb902193441d
xor rcx, rdx
cmp rax, rcx
jle 0x1400203a9
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x14002037f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x140020386
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov cl, byte [rcx]
mov dl, 0x15
xor dl, 0x15
cmp cl, dl
mov qword [rsp + 0x48], rax
je 0x1400202d3
jmp 0x1400203b4
mov rax, qword [rsp + 0x60]
mov cl, byte [rsp + 0x3f]
mov byte [rax], cl
add rsp, 0x78
ret
jmp 0x14002022a
Function at 0x1400203b9
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call rax
mov rax, qword [rsp + 0x68]
mov cl, byte [rax + 0x60]
mov dl, 0x1f
xor dl, 0x1f
xor eax, eax
cmp cl, dl
mov byte [rsp + 0x77], al
je 0x1400202a9
mov rax, qword [rsp + 0x60]
mov cl, 0xbf
xor cl, 0xbf
mov byte [rax], cl
call fcn.140020156
call fcn.1400201fa
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
mov byte [rsp + 0x77], al
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov dl, byte [rsp + 0x77]
mov byte [rsp + 0x3f], dl
mov dl, 0xc2
xor dl, 0xc2
mov byte [rax], dl
mov rax, qword [rcx]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
xor ecx, ecx
mov edx, ecx
sub rdx, rax
xor ecx, ecx
sub rcx, 0xffffffffffffffff
add rdx, rcx
movabs rcx, 0xd267be50287fd1cf
movabs r8, 0xd267be50287fd1cf
xor rcx, r8
sub rcx, rdx
mov qword [rsp + 0x30], rcx
movabs rcx, 0xeb31eb902193441d
movabs rdx, 0xeb31eb902193441d
xor rcx, rdx
cmp rax, rcx
jle 0x1400203a9
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, rax
add rcx, 8
mov r8, rdx
shl r8, 4
add rcx, r8
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, 0
je 0x14002037f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
jmp 0x140020386
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov cl, byte [rcx]
mov dl, 0x15
xor dl, 0x15
cmp cl, dl
mov qword [rsp + 0x48], rax
je 0x1400202d3
jmp 0x1400203b4
mov rax, qword [rsp + 0x60]
mov cl, byte [rsp + 0x3f]
mov byte [rax], cl
add rsp, 0x78
ret
jmp 0x14002022a

Function at 0x1400203c8
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14004eb1a
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x1f
xor cl, 0x1f
cmp al, cl
jne 0x14002040b
mov rcx, qword [rsp + 0x28]
call fcn.14004ebcb
nop
add rsp, 0x38
ret