joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002d30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002d52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002d61
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002d84
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002d86
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002dc2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002e5e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002dfd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002e3e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002e5e
cmp rbx, rax
ja 0x140002e10
test rbx, rbx
je 0x140002e5e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
inc eax
add ebx, esi
inc eax
add eax, esi
dec ebx
add ebp, ecx
call rsp
add dword [rbx - 0x31fe3201], esi
inc ebx
add ecx, esi
inc ecx
add esi, esi
inc ecx
add esp, esi
inc ecx
add esp, esi
inc eax
add ebp, esi
invalid
Function at 0x1400032c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400032ed
xor eax, eax
jmp 0x140003459
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003327
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003327
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003459
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000344c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000336a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003395
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003451
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003404
sub eax, 1
je 0x140003404
cmp eax, 2
jne 0x14000344c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003451
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003432
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000344c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003451
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004830
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003800
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400038d3
cmp byte [rcx + 0x71], 0
je 0x1400038d3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400038cf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003894
sub eax, 1
je 0x140003898
cmp eax, 2
jne 0x1400038cf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004830
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400038c6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400038cf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000387c
xor al, al
jmp 0x14000387c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004830
add rsp, 0x60
pop rbx
ret

Function at 0x140005370
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400053ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400053ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400053ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400053ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400053ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400053bc
xor al, al
add rsp, 0x28
ret
Function at 0x140001290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
lea r8d, [rbp + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14000133a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000133a
mov rcx, rax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov eax, 2
shr ebx, 1
lea ecx, [rbx + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140001758
add rbx, rbx
mov rdx, rsi
mov r8, rbx
mov rcx, rax
mov rdi, rax
call fcn.140002690
mov rsi, qword [rsp + 0x30]
mov rax, rdi
mov word [rbx + rdi], bp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400062fc
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
movabs rax, 0xcb61c354836ecd83
movabs rcx, 0xcb61c354836ecd83
xor rax, rcx
cmp rdx, rax
mov qword [rsp + 0x50], rdx
jge 0x1400063f2
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
xor eax, eax
sub rax, rdx
mov qword [rsp + 0x28], rax
mov edx, 1
call fcn.140022539
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov r8b, 0x51
xor r8b, 0x7c
mov byte [rcx + rdx + 8], r8b
mov rcx, qword [rax]
mov rdx, 0xffffffffffffffff
xor rdx, 1
xor eax, eax
sub rax, 1
sub rdx, rax
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x38], rax
xor rcx, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0x7031b1b40226ca0c
movabs rdx, 0x7031b1b40226ca0c
xor rcx, rdx
cmp rax, rcx
jge 0x1400063ce
call fcn.14000a590
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x1400063f2
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov qword [r8], rdx
mov rcx, qword [rcx]
mov byte [rcx + rdx + 8], 0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
add rsp, 0x58
jmp fcn.14000595c
Function at 0x14000a590
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140019bef
mov rcx, rax
mov rax, qword [0x1401a15f0]
mov qword [rcx], rax
lea rax, [0x140197d5f]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140197d30]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x6d1fac57
lea rdx, [0x140197d5f]
lea r8, [0x140197d4c]
lea r9, [0x140197d55]
call fcn.140019b17
nop
add rsp, 0x28
ret
Function at 0x14000c3e7
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov rax, qword [rdx + 8]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov r10d, r9d
mov r11d, 0x1bd50be
xor r11d, 0x1bc50be
movabs r8, 0x53bd34e433812c9f
movabs rcx, 0x53bd34e433812c9f
xor r8, rcx
movabs rcx, 0x27b159e0dca64dbb
movabs rsi, 0x27b159e0dca64db3
xor rcx, rsi
cmp r10d, 0x100
cmovb rcx, r8
mov edi, 0x1677acd0
xor edi, 0x1777acd0
mov r8d, 0x18
mov esi, 0x10
cmp r10d, edi
cmovb r8, rsi
cmp r10d, r11d
cmovb r8, rcx
mov ecx, r8d
shr r10d, cl
mov ecx, r10d
mov ecx, ecx
mov r10d, ecx
lea rcx, [0x140197c20]
movsx r10, byte [rcx + r10]
movabs rcx, 0x7dd58f2835268048
movabs r11, 0x7dd58f2835268048
xor rcx, r11
sub rcx, r8
movabs r8, 0xf57a7b2996cc0145
movabs r11, 0xf57a7b2996cc0145
xor r8, r11
sub r8, r10
add rcx, r8
movabs r8, 0xd1de9d3f024a720e
movabs r10, 0xd1de9d3f024a720e
xor r8, r10
sub r8, rcx
mov r10, r8
and r10, 0xfffffffffffffffb
movabs rcx, 0xf55de0110c6d9dd3
movabs r11, 0xf55de0110c6d9dd1
xor rcx, r11
imul r10, rcx
mov rcx, r8
xor rcx, 0xfffffffffffffffb
add rcx, r10
sar r9, cl
mov qword [rsp + 0x48], r9
mov rcx, r9
xor r9d, r9d
sub r9, 0xffffffffffffffe0
sub rcx, r9
add r8, 0xfffffffffffffffa
mov qword [rsp + 0x50], r8
mov qword [rdx + 0x20], 0
add rax, 0x868
shl r8, 8
add rax, r8
shl rcx, 3
add rax, rcx
mov qword [rsp + 0x58], rax
mov rcx, qword [rax]
mov qword [rdx + 0x18], rcx
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
cmp rax, 0
je 0x14000c585
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x38]
mov qword [rdx], r9
mov edx, dword [rax + rcx*4 + 0x804]
movabs r9, 0x156963fb59d6dd9e
movabs rcx, 0xea969c04a6292261
xor r9, rcx
mov rcx, r8
xor rcx, r9
xor r8, 0xffffffffffffffff
and rcx, r8
movabs r8, 0x525e6531ab0385bf
movabs r9, 0x525e6531ab0385a0
xor r8, r9
movabs r9, 0x4516e8fbd10a9deb
movabs r10, 0x4516e8fbd10a9df4
xor r9, r10
or r8, r9
xor r8, 0xffffffffffffffff
or rcx, r8
movabs r8, 0xa19a1481e5f69359
movabs r9, 0x5e65eb7e1a096ca6
xor r8, r9
xor rcx, r8
mov r8d, 1
shl r8, cl
mov rcx, qword [rsp + 0x50]
or edx, r8d
mov dword [rax + rcx*4 + 0x804], edx
mov edx, dword [rax + 0x800]
mov dword [rsp + 0x2c], edx
movabs rdx, 0xd8920858faf602e9
movabs r8, 0x276df7a70509fd16
xor rdx, r8
xor rcx, rdx
movabs r8, 0xabea709d88ab926b
movabs rdx, 0xabea709d88ab9274
xor r8, rdx
movabs rdx, 0x6147bc79c33d95f1
movabs r9, 0x9eb843863cc26a0e
xor rdx, r9
xor r8, rdx
mov rdx, 0xffffffffffffffff
movabs r9, 0xc5c765d4bf04c43f
xor rdx, r9
or rcx, r8
movabs r8, 0xc5c765d4bf04c43f
or rdx, r8
xor rcx, 0xffffffffffffffff
and rcx, rdx
movabs rdx, 0xf038ac20994ea6e
movabs r8, 0xf038ac20994ea6f
xor rdx, r8
shl rdx, cl
mov ecx, dword [rsp + 0x2c]
or ecx, edx
mov dword [rax + 0x800], ecx
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x14000dc72
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.14000d5e6

Function at 0x14000dc9f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.14000d5e6
Function at 0x14000ea54
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movabs rcx, 0xa79102748fde1fa
movabs rax, 0xa79102748fde1ba
xor rcx, rax
movabs rdx, 0x611436bbd6ebbe02
movabs rax, 0x611436bbd6ebbe0a
xor rdx, rax
call fcn.140019bef
mov rcx, rax
mov rax, qword [0x1401a1588]
mov qword [rcx], rax
lea rax, [0x140197d40]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140197d30]
mov qword [rcx + 0x20], rax
movabs rdx, 0xe661cd410531c55d
movabs rax, 0xe661cd41682e690a
xor rdx, rax
mov rax, rsp
mov qword [rax + 0x20], rdx
lea rdx, [0x140197d40]
lea r8, [0x140197d4c]
lea r9, [0x140197d55]
call fcn.140019b17
nop
add rsp, 0x28
ret
Function at 0x14001063b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
add rsp, 0x38
jmp fcn.1400104c6

Function at 0x140010672
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
add rsp, 0x38
jmp fcn.1400104c6
Function at 0x1400106a9
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x60], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x68], rax
mov rcx, qword [rcx + 8]
movabs r8, 0x4dd7fb82cf49ab58
movabs rax, 0x4dd7fb82cf49ab5b
xor r8, rax
movabs rax, 0x84ce18f4da90dda8
movabs rdx, 0x7b31e70b256f2257
xor rax, rdx
xor r8, rax
mov rax, rcx
and rax, r8
mov rdx, rcx
or rdx, r8
xor rdx, 0xffffffffffffffff
imul rdx, rax
movabs rax, 0x2257cbe08e220e5f
movabs r8, 0x2257cbe08e220e5c
xor rax, r8
mov r8, rcx
and r8, rax
movabs r9, 0x968428cb6cbb2df1
movabs rax, 0x968428cb6cbb2df2
xor r9, rax
mov rax, rcx
or rax, r9
imul rax, r8
add rax, rdx
mov qword [rsp + 0x70], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x140197500]
mulsd xmm0, xmm1
movsd qword [rsp + 0x78], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x80], xmm1
ucomisd xmm0, xmm1
jne 0x14001078a
jp 0x14001078a
jmp 0x1400107dc
movsd xmm1, qword [rsp + 0x78]
movsd xmm0, qword [rsp + 0x80]
subsd xmm0, xmm1
call fcn.140195ba0
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x78]
movsd qword [rsp + 0x58], xmm1
call fcn.140195ba0
movsd xmm1, qword [rsp + 0x58]
movsd xmm2, qword [0x140197508]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x1400107dc
call fcn.14000a590
jmp 0x14001090f
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
movabs r8, 0xb53c281e7286cf73
movabs rdx, 0xb53c281e7286cf71
xor r8, rdx
cqo
idiv r8
mov qword [rsp + 0x38], rax
mov qword [rcx], rax
movabs rcx, 0xfac7b97bbe63d562
movabs rdx, 0xfac7b97bbe63d566
xor rcx, rdx
shl rax, cl
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x140197510]
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x140010865
jp 0x140010865
jmp 0x1400108b4
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
subsd xmm0, xmm1
call fcn.140195ba0
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x30], xmm1
call fcn.140195ba0
movsd xmm1, qword [rsp + 0x30]
movsd xmm2, qword [0x140197508]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x1400108b4
call fcn.14000a590
jmp 0x14001090f
mov rax, qword [rsp + 0x40]
cmp rax, 0
jge 0x1400108d3
mov rcx, r8
mov rdx, r8
call fcn.140010917
jmp 0x14001090f
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x68
call fcn.1400104c6
mov rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
add rsp, 0x88
ret

Function at 0x140010917
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x40
mov edx, 8
call fcn.140019bef
mov rcx, rax
mov rax, qword [0x1401a1588]
mov qword [rcx], rax
lea rax, [0x140197d40]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0
lea rax, [0x140197d30]
mov qword [rcx + 0x20], rax
mov rax, rsp
mov qword [rax + 0x20], 0x6d1fac57
lea rdx, [0x140197d40]
lea r8, [0x140197d4c]
lea r9, [0x140197d55]
call fcn.140019b17
nop
add rsp, 0x28
ret
Function at 0x1400121d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.14000ffaa

Function at 0x1400121fd
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
cmp rdx, 0x11
mov qword [rsp + 0x30], rcx
jl 0x140012285
mov rax, qword [rsp + 0x28]
movabs rdx, 0x7ce3f3378afd08f8
mov rcx, rax
add rcx, rdx
movabs rdx, 0x94a4053fdf5ba6b9
movabs r8, 0x6b5bfac020a45947
xor rdx, r8
add rcx, rdx
movabs rdx, 0x7ce3f3378afd08f8
sub rcx, rdx
movzx ecx, word [rcx]
mov edx, ecx
movabs r8, 0x6958787d88fce402
movabs rcx, 0x96a7878277031bfd
xor r8, rcx
mov rcx, rax
xor rcx, r8
and rcx, rdx
xor rdx, 0xffffffffffffffff
and rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x38
jmp fcn.14000ffaa

Function at 0x1400122b3
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, 0x10
call fcn.14000a42f
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
sub rcx, rax
add rsp, 0x38
jmp fcn.1400121fd
Function at 0x140013f0f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x3f], cl
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x3f]
mov rax, qword [rdx + 8]
mov qword [rsp + 0x40], rax
test cl, 1
jne 0x140013f4d
jmp 0x140013f81
mov rax, qword [rsp + 0x40]
movabs rcx, 0x7fa26a1835bb9c8a
movabs rdx, 0x7fa26a1835bb9c8a
xor rcx, rdx
cmp rax, rcx
jle 0x14001407f
mov rcx, qword [rsp + 0x30]
call fcn.14000e740
jmp 0x14001407f
mov rax, qword [rsp + 0x40]
movabs rcx, 0xa62b93cbdfa2a006
movabs rdx, 0xa62b93cbdfa2a006
xor rcx, rdx
cmp rax, rcx
jne 0x14001407f
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov rcx, rax
add rcx, 1
xor rax, 0xffffffffffffffff
movabs rdx, 0x9914f9521d9f9a39
movabs r8, 0x9914f9521d9f9a38
xor rdx, r8
or rax, rdx
add rax, rcx
movabs rcx, 0x91194e8b7fa84ffe
movabs rdx, 0x91194e8b7fa84ffe
xor rcx, rdx
cmp rax, rcx
jne 0x14001407f
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
or rax, rax
xor rax, 0xffffffffffffffff
movabs r8, 0x4034e347180ad6d9
movabs r9, 0xbfcb1cb8e7f52925
xor r8, r9
movabs r9, 0x441015369e57e04f
movabs r10, 0xbbefeac961a81fb3
xor r9, r10
or r8, r9
movabs r9, 0x6b5a4a06e3880618
movabs r10, 0x94a5b5f91c77f9e7
xor r9, r10
xor r8, r9
xor rax, 0xffffffffffffffff
movabs r9, 0x666b673cce62c645
movabs r10, 0x999498c3319d39ba
xor r9, r10
xor r8, r9
and rax, r8
mov qword [rcx], rax
call fcn.140013b7f
nop
add rsp, 0x48
ret

Function at 0x140014085
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
cmp rcx, 0
mov qword [rsp + 0x40], rax
je 0x1400140e6
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14001412e
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movsx rdx, word [rax + 0x10]
mov qword [rsp + 0x20], rdx
mov ecx, 0x10
call fcn.14000a42f
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov r8, rax
movabs rax, 0x1c67be53faeceed6
movabs r9, 0x1c67be53faeceed6
xor rax, r9
sub rax, r8
add rcx, rax
call fcn.1400121fd
nop
add rsp, 0x48
ret

Function at 0x140014134
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140014168
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x28
ret