joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400019c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
or al, 0x11
mov edx, 0xa
mov rcx, qword [r10 + 0x10]
lea r8, [0x140035a30]
call fcn.1400012b0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_winrt_l1_1_0.dll_RoInitialize]
mov ebp, eax
test eax, eax
js 0x140001a06
mov ecx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]

Function at 0x1400019f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [r14]
mov rax, qword [rcx + 0x10]
mov rcx, r14
call qword [0x140034e68]
call qword [sym.imp.api_ms_win_core_winrt_l1_1_0.dll_RoUninitialize]
mov rcx, qword [0x14003d048]
cmp rcx, r12
je 0x140001a51
test byte [rcx + 0x1c], 1
je 0x140001a51
mov eax, dword [rdi]
lea edx, [rax + rax*4]
cmp edx, 0x1e1
ja 0x140001a2c
mov eax, edx
sub rsi, rax
jmp 0x140001a2e
xor esi, esi
mov rcx, qword [rcx + 0x10]
lea r9, [0x140035650]
add r9, rsi
dec dword [rdi]
cmp ebx, 0xffffffff
je 0x140001a6f
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x140001a6f
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x58]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret

Function at 0x140001a3c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov dword [rsp + 0x20], ebp
mov edx, ntohl
lea r8, [0x140035a30]
call fcn.140001304

Function at 0x140007080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x1400070a1
mov eax, 0xff
call fcn.140002680
xor byte [rsi], al
jne 0x140007091
pop rsi
pop rbx
ret
Function at 0x14000b76c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x30
mov rbp, rcx
mov ecx, dword [0x14003d17c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
or ebx, 0xffffffff
mov rdi, rax
test rax, rax
jne 0x14000b7ad
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x78]
and dword [rsp + 0x78], eax
lea rdi, [rsp + 0x78]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
inc dword [rdi]
mov r10, qword [0x14003d048]
lea r13, [0x14003d048]
lea rdx, [0x140035650]
mov esi, 0x1df
cmp r10, r13
je 0x14000b80b
test byte [r10 + 0x1c], 1
je 0x14000b80b
mov eax, dword [rdi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x14000b7eb
mov eax, ecx
mov ecx, esi
sub rcx, rax
jmp 0x14000b7ed
xor ecx, ecx
lea r9, [rcx + rdx]
mov qword [rsp + 0x20], rbp
mov rcx, qword [r10 + 0x10]
lea r8, [0x140036090]
mov edx, 0xa
call fcn.140004a7c
and dword [rsp + 0x70], 0
lea r9, [rsp + 0x68]
and dword [rsp + 0x68], 0
lea rdx, [rsp + 0x70]
and qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.api_ms_win_appmodel_runtime_l1_1_0.dll_GetPackagesByPackageFamily]
cmp eax, 0x7a
sete bpl
mov r10, qword [0x14003d048]
cmp r10, r13
je 0x14000b888
test byte [r10 + 0x1c], 1
je 0x14000b888
mov eax, dword [rdi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x14000b85f
mov eax, ecx
sub rsi, rax
jmp 0x14000b861
xor esi, esi
mov rcx, qword [r10 + 0x10]
lea r9, [0x140035650]
movzx eax, bpl
lea r8, [0x140036090]
add r9, rsi
mov dword [rsp + 0x20], eax
mov edx, ntohl
call fcn.140001304
dec dword [rdi]
cmp ebx, 0xffffffff
je 0x14000b8a6
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x14000b8a6
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov al, bpl
add rsp, 0x30
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000d854
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
mov ecx, dword [0x14003d17c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
or ebx, 0xffffffff
mov rdi, rax
test rax, rax
jne 0x14000d8a2
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x58]
and dword [rsp + 0x58], eax
lea rdi, [rsp + 0x58]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
inc dword [rdi]
mov r10, qword [0x14003d048]
lea r13, [0x14003d048]
lea rdx, [0x140035650]
mov r14d, 0x1df
cmp r10, r13
je 0x14000d902
test byte [r10 + 0x1c], 1
je 0x14000d902
mov eax, dword [rdi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x14000d8e2
mov eax, ecx
mov ecx, r14d
sub rcx, rax
jmp 0x14000d8e4
xor ecx, ecx
lea r9, [rcx + rdx]
mov qword [rsp + 0x20], rsi
mov rcx, qword [r10 + 0x10]
lea r8, [0x140036280]
mov edx, ntohl
call fcn.140004a7c
and qword [rsp + 0x28], 0
lea r8, [0x14000d650]
and dword [rsp + 0x20], 0
mov r9, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14000d92d
xor esi, esi
jmp 0x14000d94f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
test esi, esi
js 0x14000d964
or edx, 0xffffffff
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [0x14003d048]
cmp rcx, r13
je 0x14000d9b0
test byte [rcx + 0x1c], 1
je 0x14000d9b0
mov eax, dword [rdi]
lea edx, [rax + rax*4]
cmp edx, 0x1e1
ja 0x14000d98a
mov eax, edx
sub r14, rax
jmp 0x14000d98d
xor r14d, r14d
mov rcx, qword [rcx + 0x10]
lea r9, [0x140035650]
add r9, r14
mov dword [rsp + 0x20], esi
mov edx, ntohl
lea r8, [0x140036280]
call fcn.140001304
dec dword [rdi]
cmp ebx, 0xffffffff
je 0x14000d9ce
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x14000d9ce
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r13
pop rdi
ret
Function at 0x14000f3ec
Capabilities:
Delete directory
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rcx
mov r12, r8
mov ecx, dword [0x14003d17c]
mov r13d, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
or ebx, 0xffffffff
mov rsi, rax
test rax, rax
jne 0x14000f43f
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x30]
and dword [rsp + 0x30], eax
lea rsi, [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
inc dword [rsi]
mov r10, qword [0x14003d048]
lea rax, [0x14003d048]
lea rdx, [0x140035650]
mov r14d, 0x1df
cmp r10, rax
je 0x14000f49f
test byte [r10 + 0x1c], 1
je 0x14000f49f
mov eax, dword [rsi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x14000f47f
mov eax, ecx
mov ecx, r14d
sub rcx, rax
jmp 0x14000f481
xor ecx, ecx
lea r9, [rcx + rdx]
mov qword [rsp + 0x20], r15
mov rcx, qword [r10 + 0x10]
lea r8, [0x140036280]
mov edx, 0x26
call fcn.140004a7c
and qword [rsp + 0x88], 0
lea rcx, [rsp + 0x88]
call fcn.1400117c4
mov ebp, eax
test eax, eax
js 0x14000f4ee
mov rcx, qword [rsp + 0x88]
mov r9, r12
mov r8d, r13d
mov rdx, r15
call fcn.14000f0c4
mov rcx, qword [rsp + 0x88]
mov ebp, eax
test eax, eax
jns 0x14000f4e7
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
jmp 0x14000f4ee
call fcn.140011f28
mov ebp, eax
mov rcx, qword [0x14003d048]
lea rax, [0x14003d048]
cmp rcx, rax
je 0x14000f541
test byte [rcx + 0x1c], 1
je 0x14000f541
mov eax, dword [rsi]
lea edx, [rax + rax*4]
cmp edx, 0x1e1
ja 0x14000f51b
mov eax, edx
sub r14, rax
jmp 0x14000f51e
xor r14d, r14d
mov rcx, qword [rcx + 0x10]
lea r9, [0x140035650]
add r9, r14
mov dword [rsp + 0x20], ebp
mov edx, 0x27
lea r8, [0x140036280]
call fcn.140001304
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
or eax, 0xffffffff
add dword [rsi], eax
cmp ebx, eax
je 0x14000f56f
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x14000f56f
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x70]
mov eax, ebp
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x140011388
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [0x14003d0d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r15, rcx
mov r12, r9
mov ecx, dword [0x14003d17c]
mov ebp, r8d
mov edi, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
or ebx, 0xffffffff
mov rsi, rax
test rax, rax
jne 0x1400113ea
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x30]
and dword [rsp + 0x30], eax
lea rsi, [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
inc dword [rsi]
mov r10, qword [0x14003d048]
lea rax, [0x14003d048]
lea rdx, [0x140035650]
mov r14d, 0x1df
cmp r10, rax
je 0x140011445
test byte [r10 + 0x1c], 1
je 0x140011445
mov eax, dword [rsi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x14001142a
mov eax, ecx
mov ecx, r14d
sub rcx, rax
jmp 0x14001142c
xor ecx, ecx
lea r9, [rcx + rdx]
mov edx, ntohl
mov rcx, qword [r10 + 0x10]
lea r8, [0x140036400]
call fcn.1400012b0
mov rcx, qword [0x14003d810]
lea r8, [rsp + 0x40]
mov r9d, 0x42
mov edx, edi
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140011485
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
test edi, edi
js 0x1400114ed
mov rcx, qword [0x14003d810]
lea r8, [rsp + 0xd0]
mov r9d, 0x100
mov edx, ebp
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1400114c8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
test edi, edi
js 0x1400114ed
mov eax, dword [rsp + 0x340]
lea r8, [rsp + 0xd0]
mov r9, r12
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140011580
mov edi, eax
mov r10, qword [0x14003d048]
lea rax, [0x14003d048]
cmp r10, rax
je 0x14001153e
test byte [r10 + 0x1c], 1
je 0x14001153e
mov ecx, dword [rsi]
lea eax, [rcx + rcx*4]
cmp eax, 0x1e1
ja 0x140011518
sub r14, rax
jmp 0x14001151b
xor r14d, r14d
mov rcx, qword [r10 + 0x10]
lea r9, [0x140035650]
add r9, r14
mov dword [rsp + 0x20], edi
mov edx, ntohl
lea r8, [0x140036400]
call fcn.140001304
dec dword [rsi]
cmp ebx, 0xffffffff
je 0x14001155c
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x14001155c
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov eax, edi
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400304d0
add rsp, 0x2e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140011b50
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov rsi, rcx
mov ecx, dword [0x14003d17c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
or ebx, 0xffffffff
mov rdi, rax
test rax, rax
jne 0x140011b99
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x60]
and dword [rsp + 0x60], eax
lea rdi, [rsp + 0x60]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
inc dword [rdi]
mov r10, qword [0x14003d048]
lea r12, [0x14003d048]
lea rdx, [0x140035650]
mov r14d, 0x1df
cmp r10, r12
je 0x140011bf9
test byte [r10 + 0x1c], 1
je 0x140011bf9
mov eax, dword [rdi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x140011bd9
mov eax, ecx
mov ecx, r14d
sub rcx, rax
jmp 0x140011bdb
xor ecx, ecx
lea r9, [rcx + rdx]
mov qword [rsp + 0x20], rsi
mov rcx, qword [r10 + 0x10]
lea r8, [0x140036400]
mov edx, Ordinal_20
call fcn.140004a7c
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x30]
and dword [rsp + 0x20], 0
lea r8, [0x140011cf0]
and dword [rsp + 0x38], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], rsi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x140011c4c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
jmp 0x140011c65
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov esi, dword [rsp + 0x38]
mov rcx, qword [0x14003d048]
cmp rcx, r12
je 0x140011cb1
test byte [rcx + 0x1c], 1
je 0x140011cb1
mov eax, dword [rdi]
lea edx, [rax + rax*4]
cmp edx, 0x1e1
ja 0x140011c8b
mov eax, edx
sub r14, rax
jmp 0x140011c8e
xor r14d, r14d
mov rcx, qword [rcx + 0x10]
lea r9, [0x140035650]
add r9, r14
mov dword [rsp + 0x20], esi
mov edx, Ordinal_20
lea r8, [0x140036400]
call fcn.140001304
dec dword [rdi]
cmp ebx, 0xffffffff
je 0x140011ccf
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x140011ccf
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x140012370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x14003d9c0], 0
jne 0x14001247f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
sub rax, qword [0x14003d9b8]
mov esi, 0x2ee
cmp rax, rsi
jae 0x140012460
mov ecx, dword [0x14003d17c]
sub rsi, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
or ebx, 0xffffffff
mov rdi, rax
test rax, rax
jne 0x1400123dd
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x40]
and dword [rsp + 0x40], eax
lea rdi, [rsp + 0x40]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
inc dword [rdi]
mov r10, qword [0x14003d048]
lea rax, [0x14003d048]
cmp r10, rax
je 0x14001243a
test byte [r10 + 0x1c], 4
je 0x14001243a
mov eax, dword [rdi]
inc eax
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x140012414
mov eax, ecx
mov ecx, 0x1df
sub rcx, rax
jmp 0x140012416
xor ecx, ecx
lea r9, [0x140035650]
mov qword [rsp + 0x20], rsi
add r9, rcx
lea r8, [0x140036400]
mov rcx, qword [r10 + 0x10]
mov edx, 0x1b
call fcn.140001370
mov ecx, esi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
dec dword [rdi]
cmp ebx, 0xffffffff
je 0x140012460
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x140012460
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
and qword [0x14003d9b8], 0
xor edx, edx
xor ecx, ecx
mov byte [0x14003d9c0], 1
mov r8d, 0x280003
call qword [sym.imp.api_ms_win_mm_playsound_l1_1_0.dll_PlaySoundW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140012780
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov r12d, r9d
mov ecx, dword [0x14003d17c]
mov r15, rdx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
xor r8d, r8d
or ebx, 0xffffffff
mov rdi, rax
test rax, rax
jne 0x1400127ea
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x80]
mov ecx, ebx
mov dword [rsp + 0x80], r8d
lea rdi, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
xor r8d, r8d
inc dword [rdi]
mov rdx, qword [0x14003d048]
lea rax, [0x14003d048]
mov r13d, dword [rsp + 0xa8]
mov r14d, 0x1df
mov rbp, qword [rsp + 0xa0]
lea r9, [0x140035650]
cmp rdx, rax
je 0x140012862
test byte [rdx + 0x1c], 1
je 0x140012862
mov eax, dword [rdi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x140012839
mov eax, ecx
mov ecx, r14d
sub rcx, rax
jmp 0x14001283c
mov rcx, r8
mov eax, dword [rsp + 0x90]
add r9, rcx
mov rcx, qword [rdx + 0x10]
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call fcn.140010ca4
mov r12, qword [rsp + 0xb0]
lea rax, [rsi + 0x18]
xor ecx, ecx
or r9, 0xffffffffffffffff
mov byte [r12], cl
inc r9
cmp word [rbp + r9*2], cx
jne 0x140012878
mov r8, rbp
mov qword [rsp + 0x28], rax
call fcn.140013498
xor ebp, ebp
test eax, eax
js 0x1400128ee
mov eax, dword [rsp + 0x90]
mov dword [rsi + 0x10], eax
mov eax, dword [rsp + 0x98]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x30], r13d
cmp qword [rsi + 0x38], r15
je 0x1400128e3
test r15, r15
je 0x1400128c9
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 8]
call qword [0x140034e68]
mov rcx, qword [rsi + 0x38]
mov qword [rsi + 0x38], r15
test rcx, rcx
je 0x1400128e3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140034e68]
mov rdx, r12
mov rcx, rsi
call fcn.140012ba0
mov rcx, qword [0x14003d048]
lea rax, [0x14003d048]
cmp rcx, rax
je 0x14001293d
test byte [rcx + 0x1c], 1
je 0x14001293d
mov eax, dword [rdi]
lea edx, [rax + rax*4]
cmp edx, 0x1e1
ja 0x14001291b
mov eax, edx
sub r14, rax
jmp 0x14001291e
mov r14, rbp
mov rcx, qword [rcx + 0x10]
lea r9, [0x140035650]
add r9, r14
lea r8, [0x140036400]
mov edx, 0x29
call fcn.1400012b0
or eax, 0xffffffff
add dword [rdi], eax
cmp ebx, eax
je 0x14001295d
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x14001295d
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012978
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov rbp, r9
mov ecx, dword [0x14003d17c]
mov r13, r8
mov r15, rdx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
xor r8d, r8d
or ebx, 0xffffffff
mov rsi, rax
test rax, rax
jne 0x1400129e0
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x80]
mov ecx, ebx
mov dword [rsp + 0x80], r8d
lea rsi, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
xor r8d, r8d
inc dword [rsi]
mov rdx, qword [0x14003d048]
lea rax, [0x14003d048]
mov r12, qword [rsp + 0xa0]
mov r14d, 0x1df
lea r9, [0x140035650]
cmp rdx, rax
je 0x140012a45
test byte [rdx + 0x1c], 1
je 0x140012a45
mov eax, dword [rsi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x140012a27
mov eax, ecx
mov ecx, r14d
sub rcx, rax
jmp 0x140012a2a
mov rcx, r8
add r9, rcx
mov qword [rsp + 0x30], r12
mov rcx, qword [rdx + 0x10]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r13
call fcn.140010ef0
mov rax, qword [rsp + 0xb0]
xor ecx, ecx
or rbp, 0xffffffffffffffff
mov r9, rbp
mov byte [rax], cl
lea rax, [rdi + 0x18]
inc r9
cmp word [r12 + r9*2], cx
jne 0x140012a5c
mov r8, r12
mov qword [rsp + 0x28], rax
call fcn.140013498
xor r12d, r12d
test eax, eax
js 0x140012b18
lea rax, [rdi + 0x20]
mov r9, rbp
inc r9
cmp word [r13 + r9*2], r12w
jne 0x140012a85
mov r8, r13
mov qword [rsp + 0x28], rax
call fcn.140013498
test eax, eax
js 0x140012b18
mov r8, qword [rsp + 0x98]
lea rax, [rdi + 0x28]
inc rbp
cmp word [r8 + rbp*2], r12w
jne 0x140012aad
mov r9, rbp
mov qword [rsp + 0x28], rax
call fcn.140013498
test eax, eax
js 0x140012b18
mov qword [rdi + 0x10], r12
mov dword [rdi + 0x30], 3
cmp qword [rdi + 0x38], r15
je 0x140012b08
test r15, r15
je 0x140012aee
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 8]
call qword [0x140034e68]
mov rcx, qword [rdi + 0x38]
mov qword [rdi + 0x38], r15
test rcx, rcx
je 0x140012b08
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140034e68]
mov rdx, qword [rsp + 0xb0]
mov rcx, rdi
call fcn.140012ba0
mov rcx, qword [0x14003d048]
lea rax, [0x14003d048]
cmp rcx, rax
je 0x140012b67
test byte [rcx + 0x1c], 1
je 0x140012b67
mov eax, dword [rsi]
lea edx, [rax + rax*4]
cmp edx, 0x1e1
ja 0x140012b45
mov eax, edx
sub r14, rax
jmp 0x140012b48
mov r14, r12
mov rcx, qword [rcx + 0x10]
lea r9, [0x140035650]
add r9, r14
lea r8, [0x140036400]
mov edx, 0x2b
call fcn.1400012b0
or eax, 0xffffffff
add dword [rsi], eax
cmp ebx, eax
je 0x140012b87
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x140012b87
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret