joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800aea00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1801902f8]
mov rdi, rcx
mov rbp, qword [rcx]
mov esi, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x18018fdf0]
xor r14d, r14d
test rax, rax
je 0x1800aea4b
test ecx, ecx
jle 0x1800aea4b
cmp ecx, dword [rax + 8]
jge 0x1800aea4b
mov rax, qword [rax]
mov r14, qword [rax + rcx*8]
test r14, r14
jne 0x1800aea99
lea ecx, [r14 + 0x48]
call sym.tcl86t.dll_hclpAlloc
mov r14, rax
test rax, rax
je 0x1800aebc1
xor eax, eax
lea rcx, [0x18018fdf0]
mov qword [r14], rax
mov rdx, r14
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rax
mov qword [r14 + 0x40], rax
call fcn.180106bc0
test esi, esi
je 0x1800aebab
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x1800aeadb
mov rcx, qword [rax + 0x10]
mov rdi, rax
mov rax, qword [rcx + 8]
sub rax, 2
cmp rax, 3
ja 0x1800aead2
mov rax, qword [rcx + 0x68]
test rax, rax
je 0x1800aead2
mov rcx, qword [rdi + 8]
mov edx, esi
call rax
mov esi, eax
test esi, esi
jne 0x1800aeaa1
jmp 0x1800aebab
test esi, esi
je 0x1800aebab
inc dword [rdi + 0x38]
mov rcx, rbp
mov qword [rsp + 0x40], rbx
call sym.tcl86t.dll_hcl_Preserve
test byte [rbp + 8], 0x80
je 0x1800aeb16
test sil, 4
je 0x1800aeb16
mov r8d, 1
mov rdx, rdi
xor ecx, ecx
call fcn.1800a8e70
test eax, eax
jne 0x1800aeb16
and esi, 0xfffffffb
mov qword [rsp + 0x20], 0
mov rax, qword [r14]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [r14], rax
mov rbx, qword [rbp + 0x90]
test rbx, rbx
je 0x1800aeb69
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test dword [rbx + 8], esi
je 0x1800aeb61
mov qword [rsp + 0x20], rax
mov edx, dword [rbx + 8]
mov rcx, qword [rbx + 0x18]
and edx, esi
call qword [rbx + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x20]
jmp 0x1800aeb64
mov rbx, rax
test rbx, rbx
jne 0x1800aeb40
cmp qword [rdi + 0x10], 0
mov rbx, qword [rsp + 0x40]
je 0x1800aeb7d
mov rcx, rdi
call fcn.1800aebe0
mov rcx, rbp
call sym.tcl86t.dll_hcl_Release
mov eax, dword [rdi + 0x38]
test eax, eax
je 0x1800aebd3
sub eax, 1
mov dword [rdi + 0x38], eax
jne 0x1800aeba3
cmp qword [rdi + 0x10], 0
jne 0x1800aeba3
mov rcx, rdi
call sym.tcl86t.dll_hclpFree
mov rax, qword [rsp + 0x28]
mov qword [r14], rax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov edx, 0x48
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
lea rcx, str.Channel_released_more_than_preserved
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x1800aee10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov r14, rcx
mov rbp, r8
mov r15, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd r9, dword [0x18018fdf0]
xor ebx, ebx
mov edi, ebx
test rax, rax
je 0x1800aee5d
test r9d, r9d
jle 0x1800aee5d
cmp r9d, dword [rax + 8]
jge 0x1800aee5d
mov rax, qword [rax]
mov rdi, qword [rax + r9*8]
test rdi, rdi
jne 0x1800aeeaa
lea ecx, [rdi + 0x48]
call sym.tcl86t.dll_hclpAlloc
mov rdi, rax
test rax, rax
je 0x1800aef77
xor eax, eax
lea rcx, [0x18018fdf0]
mov qword [rdi], rax
mov rdx, rdi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rax
call fcn.180106bc0
mov qword [rsp + 0x40], rsi
mov r8, rbx
mov rsi, qword [r14]
mov rcx, qword [rsi + 0x90]
test rcx, rcx
je 0x1800aef5e
cmp qword [rcx], r14
jne 0x1800aeed6
cmp qword [rcx + 0x18], rbp
jne 0x1800aeed6
cmp qword [rcx + 0x10], r15
je 0x1800aeee7
mov r8, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
jne 0x1800aeec5
jmp 0x1800aef5e
test rcx, rcx
je 0x1800aef5e
mov rdx, qword [rdi]
test rdx, rdx
je 0x1800aef09
cmp qword [rdx], rcx
jne 0x1800aef00
mov rax, qword [rcx + 0x20]
mov qword [rdx], rax
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x1800aeef4
mov rax, qword [rcx + 0x20]
test r8, r8
jne 0x1800aef1b
mov qword [rsi + 0x90], rax
jmp 0x1800aef1f
mov qword [r8 + 0x20], rax
call sym.tcl86t.dll_hclpFree
mov rax, qword [rsi + 0x90]
mov dword [rsi + 0x98], ebx
test rax, rax
je 0x1800aef52
nop word [rax + rax]
or ebx, dword [rax + 8]
mov dword [rsi + 0x98], ebx
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x1800aef40
mov rcx, qword [rsi + 0xc8]
call fcn.1800aebe0
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov edx, 0x48
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x1800aef90
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rdx]
xor eax, eax
mov r11, rdx
mov r10, qword [r9 + 0xa0]
mov rbx, r10
test r10, r10
je 0x1800af068
cmp qword [rbx + 0x10], rcx
jne 0x1800aefbd
cmp dword [rbx + 0x18], r8d
je 0x1800aefcf
mov rax, rbx
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x1800aefb1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x20]
cmp rbx, r10
jne 0x1800aefe1
mov qword [r9 + 0xa0], rcx
jmp 0x1800aefe5
mov qword [rax + 0x20], rcx
mov r8, rbx
lea rdx, [sym.tcl86t.dll_hclChannelEventScriptInvoker]
mov rcx, r11
call sym.tcl86t.dll_hcl_DeleteChannelHandler
mov rcx, qword [rbx + 8]
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x1800af05b
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1800af030
cmp qword [rcx + 8], 0
je 0x1800af030
mov rcx, rax
call sym.tcl86t.dll_hclFreeObj
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.tcl86t.dll_hclpFree
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800af04b
cmp rcx, qword [0x18018f080]
je 0x1800af04b
call sym.tcl86t.dll_hclpFree
mov rax, qword [rbx + 8]
mov dword [rax + 0x10], 0xffffffff
mov rcx, qword [rbx + 8]
call fcn.1801063c0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.tcl86t.dll_hclpFree
add rsp, 0x20
pop rbx
ret
Function at 0x1800b0c80
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov rax, qword [0x1801902f8]
mov r14, rcx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rdx, dword [0x18018fdf0]
xor ebx, ebx
test rax, rax
je 0x1800b0cb8
test edx, edx
jle 0x1800b0cb8
cmp edx, dword [rax + 8]
jge 0x1800b0cb8
mov rax, qword [rax]
mov rbx, qword [rax + rdx*8]
test rbx, rbx
jne 0x1800b0d05
lea ecx, [rbx + 0x48]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800b0dbc
xor eax, eax
lea rcx, [0x18018fdf0]
mov qword [rbx], rax
mov rdx, rbx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
call fcn.180106bc0
mov qword [rsp + 0x48], rsi
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
inc rsi
cmp byte [r14 + rsi], 0
jne 0x1800b0d16
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], r15
test rdi, rdi
je 0x1800b0d97
mov rbp, qword [rbx + 0x10]
movzx r15d, byte [r14]
nop dword [rax + rax]
mov rax, qword [rdi + 0xc8]
cmp rax, rbp
jne 0x1800b0d55
lea rcx, str.stdin
jmp 0x1800b0d74
cmp rax, qword [rbx + 0x20]
jne 0x1800b0d64
lea rcx, str.stdout
jmp 0x1800b0d74
lea rcx, str.stderr
cmp rax, qword [rbx + 0x30]
je 0x1800b0d74
mov rcx, qword [rdi]
cmp r15b, byte [rcx]
jne 0x1800b0d8b
movsxd r8, esi
mov rdx, r14
inc r8
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800b0db5
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x1800b0d40
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rbx
ret
mov eax, 1
jmp 0x1800b0d99
mov edx, 0x48
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3

Function at 0x1800b4130
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
sub dword [rcx + 0x58], 1
mov rbx, rcx
jne 0x1800b4189
cmp qword [rcx + 0x48], 0
mov qword [rcx + 0x50], 0
je 0x1800b4167
mov rcx, qword [rcx + 0x40]
call sym.tcl86t.dll_hclpFree
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov rcx, qword [rbx + 0x38]
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x1800b417c
call sym.tcl86t.dll_hclFreeObj
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.tcl86t.dll_hclpFree
add rsp, 0x20
pop rbx
ret
Function at 0x1800b5fb0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1001
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x58], eax
jge 0x1800b6017
lea r9, [rsp + 0x48]
mov dword [rsp + 0x50], 4
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1002
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x58], eax
jge 0x1800b6075
lea r9, [rsp + 0x48]
mov dword [rsp + 0x50], 4
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1800b6880
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov r14, rcx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rdx, dword [0x18018fe08]
xor esi, esi
mov ebx, esi
test rax, rax
je 0x1800b68c2
test edx, edx
jle 0x1800b68c2
cmp edx, dword [rax + 8]
jge 0x1800b68c2
mov rax, qword [rax]
mov rbx, qword [rax + rdx*8]
test rbx, rbx
jne 0x1800b6907
lea ecx, [rbx + 0x38]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800b6a64
xor eax, eax
lea rcx, [0x18018fe08]
mov qword [rbx], rax
mov rdx, rbx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
call fcn.180106bc0
lea rcx, [0x18018fe20]
mov qword [rsp + 0x38], rdi
call sym.tcl86t.dll_hcl_MutexLock
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1800b693f
mov rax, qword [0x18018fe28]
cmp qword [rbx + 8], rax
je 0x1800b698f
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x1800b693f
call sym.tcl86t.dll_hclFreeObj
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800b694d
call sym.tcl86t.dll_hclpFree
mov rcx, qword [0x18018fe10]
test rcx, rcx
jne 0x1800b695f
mov qword [rbx + 0x18], rsi
jmp 0x1800b696a
call sym.tcl86t.dll_hcl_DuplicateObj
mov qword [rbx + 0x18], rax
inc dword [rax]
mov rcx, qword [0x18018fe18]
test rcx, rcx
jne 0x1800b697b
mov rax, rsi
jmp 0x1800b6980
call fcn.180138c40
mov qword [rbx + 0x20], rax
mov rax, qword [0x18018fe28]
mov qword [rbx + 8], rax
mov rcx, qword [0x18018fe20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rbx], esi
jne 0x1800b69b5
mov rdx, rbx
lea rcx, [0x1800b6800]
call sym.tcl86t.dll_hcl_CreateThreadExitHandler
mov dword [rbx], 1
mov rdi, qword [rbx + 0x18]
test r14, r14
jne 0x1800b69cc
test rdi, rdi
sete sil
mov eax, esi
jmp 0x1800b6a4e
mov rsi, qword [r14]
cmp rdi, rsi
jne 0x1800b69db
mov eax, 1
jmp 0x1800b6a4e
mov qword [rsp + 0x30], rbp
mov rbp, qword [rdi + 8]
test rbp, rbp
jne 0x1800b69f8
mov rcx, rdi
call sym.tcl86t.dll_hcl_GetString
mov rbp, qword [rdi + 8]
mov rsi, qword [r14]
cmp qword [rsi + 8], 0
movsxd rdi, dword [rdi + 0x10]
jne 0x1800b6a0b
mov rcx, rsi
call sym.tcl86t.dll_hcl_GetString
cmp edi, dword [rsi + 0x10]
jne 0x1800b6a47
mov rdx, qword [rsi + 8]
mov r8, rdi
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800b6a47
mov rcx, qword [r14]
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x1800b6a37
call sym.tcl86t.dll_hclFreeObj
mov rax, qword [rbx + 0x18]
mov qword [r14], rax
inc dword [rax]
mov eax, 1
jmp 0x1800b6a49
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, gethostname
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x1800b6ce0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x18018fe08]
xor ebx, ebx
test rax, rax
je 0x1800b6d13
test ecx, ecx
jle 0x1800b6d13
cmp ecx, dword [rax + 8]
jge 0x1800b6d13
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1800b6d54
lea ecx, [rbx + 0x38]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800b6d5e
xor eax, eax
lea rcx, [0x18018fe08]
mov qword [rbx], rax
mov rdx, rbx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
call fcn.180106bc0
inc qword [rbx + 0x30]
add rsp, 0x20
pop rbx
ret
mov edx, gethostname
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3

Function at 0x1800b6d70
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x18018fe08]
xor ebx, ebx
test rax, rax
je 0x1800b6da3
test ecx, ecx
jle 0x1800b6da3
cmp ecx, dword [rax + 8]
jge 0x1800b6da3
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1800b6de4
lea ecx, [rbx + 0x38]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800b6dee
xor eax, eax
lea rcx, [0x18018fe08]
mov qword [rbx], rax
mov rdx, rbx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
call fcn.180106bc0
dec qword [rbx + 0x30]
add rsp, 0x20
pop rbx
ret
mov edx, gethostname
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3

Function at 0x1800b6e00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x18018fe08]
xor ebx, ebx
test rax, rax
je 0x1800b6e33
test ecx, ecx
jle 0x1800b6e33
cmp ecx, dword [rax + 8]
jge 0x1800b6e33
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1800b6e74
lea ecx, [rbx + 0x38]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800b6e7e
xor eax, eax
lea rcx, [0x18018fe08]
mov qword [rbx], rax
mov rdx, rbx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
call fcn.180106bc0
mov rax, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
ret
mov edx, gethostname
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x1800b6e90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov rdi, rcx
mov r14, rdx
xor esi, esi
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x18018fe08]
xor ebx, ebx
test rax, rax
je 0x1800b6ed2
test ecx, ecx
jle 0x1800b6ed2
cmp ecx, dword [rax + 8]
jge 0x1800b6ed2
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1800b6f17
lea ecx, [rbx + 0x38]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800b7035
xor eax, eax
lea rcx, [0x18018fe08]
mov qword [rbx], rax
mov rdx, rbx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
call fcn.180106bc0
mov qword [rsp + 0x40], rbp
test rdi, rdi
je 0x1800b6f3b
mov rsi, qword [rdi + 8]
test rsi, rsi
jne 0x1800b6f36
mov rcx, rdi
call sym.tcl86t.dll_hcl_GetString
mov rsi, qword [rdi + 8]
mov ebp, dword [rdi + 0x10]
jmp 0x1800b6f3f
mov ebp, dword [rsp + 0x50]
lea rcx, [0x18018fe20]
call sym.tcl86t.dll_hcl_MutexLock
mov rcx, qword [0x18018fe10]
test rcx, rcx
je 0x1800b6f68
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x1800b6f68
call sym.tcl86t.dll_hclFreeObj
mov rcx, qword [0x18018fe18]
test rcx, rcx
je 0x1800b6f79
call sym.tcl86t.dll_hclpFree
test rdi, rdi
jne 0x1800b6f89
mov qword [0x18018fe10], rdi
xor eax, eax
jmp 0x1800b6fa4
mov edx, ebp
mov rcx, rsi
call sym.tcl86t.dll_hcl_NewStringObj
mov rcx, r14
mov qword [0x18018fe10], rax
inc dword [rax]
call fcn.180138c40
mov qword [0x18018fe18], rax
mov ecx, 1
mov rax, qword [0x18018fe28]
add rax, 1
cmove rax, rcx
mov qword [rbx + 8], rax
mov rcx, qword [0x18018fe20]
mov qword [0x18018fe28], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1800b6ff1
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x1800b6ff1
call sym.tcl86t.dll_hclFreeObj
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800b6fff
call sym.tcl86t.dll_hclpFree
test rdi, rdi
jne 0x1800b700e
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
jmp 0x1800b7022
mov edx, ebp
mov rcx, rsi
call sym.tcl86t.dll_hcl_NewStringObj
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], r14
inc dword [rax]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov edx, gethostname
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x1800b9170
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x60
mov rax, qword [0x18018f008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [0x1801902f8]
mov rsi, rcx
xor r14d, r14d
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
xor ebx, ebx
movsxd rax, dword [0x18018fe08]
test rdx, rdx
je 0x1800b91c1
test eax, eax
jle 0x1800b91c1
cmp eax, dword [rdx + 8]
jge 0x1800b91c1
mov rcx, rax
mov rax, qword [rdx]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1800b9206
lea ecx, [rbx + 0x38]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800b9375
xor eax, eax
lea rcx, [0x18018fe08]
mov qword [rbx], rax
mov rdx, rbx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
call fcn.180106bc0
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x88], rbp
mov ebp, 0xffffffff
test rcx, rcx
je 0x1800b9224
call sym.tcl86t.dll_hcl_FSGetFileSystemForPath
mov r14, rax
mov rdx, rsi
xor ecx, ecx
call sym.tcl86t.dll_hcl_FSGetNormalizedPath
test rax, rax
jne 0x1800b9246
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
mov eax, ebp
jmp 0x1800b9357
mov rcx, rsi
mov qword [rsp + 0x90], rdi
call sym.tcl86t.dll_hcl_FSGetFileSystemForPath
mov rdi, rax
test rax, rax
je 0x1800b9341
mov rax, qword [rax + 0xf0]
mov rcx, rsi
test rax, rax
je 0x1800b927f
call rax
mov ebp, eax
test eax, eax
jne 0x1800b934d
jmp 0x1800b92db
call sym.tcl86t.dll_hcl_FSGetFileSystemForPath
test rax, rax
je 0x1800b9341
mov r8, qword [rax + 0x58]
test r8, r8
je 0x1800b9341
lea rdx, [rsp + 0x20]
mov rcx, rsi
call r8
test eax, eax
jne 0x1800b934d
movzx eax, word [rsp + 0x26]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x4000
cmp ax, cx
jne 0x1800b934d
mov edx, 4
mov rcx, rsi
call sym.tcl86t.dll_hcl_FSAccess
test eax, eax
jne 0x1800b934d
xor ebp, ebp
mov rdx, rsi
xor ecx, ecx
call sym.tcl86t.dll_hcl_FSGetNormalizedPath
mov rsi, rax
test rax, rax
jne 0x1800b92fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
lea eax, [rsi - 1]
jmp 0x1800b934f
lea rax, str.native
cmp rdi, rax
jne 0x1800b9324
mov rbx, qword [rbx + 0x20]
mov rax, qword [rdi + 0xe8]
mov rcx, rbx
call rax
cmp rax, rbx
je 0x1800b932e
mov rdx, rax
jmp 0x1800b9326
xor edx, edx
mov rcx, rsi
call fcn.1800b6e90
test r14, r14
je 0x1800b934d
cmp rdi, r14
je 0x1800b934d
xor ecx, ecx
call sym.tcl86t.dll_hcl_FSMountsChanged
jmp 0x1800b934d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
mov eax, ebp
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180146240
add rsp, 0x60
pop r14
pop rsi
pop rbx
ret
mov edx, gethostname
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x1800bd120
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x18018fe48]
xor edi, edi
mov ebx, edi
test rax, rax
je 0x1800bd159
test ecx, ecx
jle 0x1800bd159
cmp ecx, dword [rax + 8]
jge 0x1800bd159
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1800bd186
lea ecx, [rbx + 8]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800bd207
xor eax, eax
lea rcx, [0x18018fe48]
mov rdx, rbx
mov qword [rbx], rax
call fcn.180106bc0
mov rax, qword [rbx]
test rax, rax
jne 0x1800bd1fc
lea ecx, [rax + 0x58]
call sym.tcl86t.dll_hclpAlloc
mov rcx, rax
test rax, rax
je 0x1800bd219
mov qword [rbx], rax
xor edx, edx
add rax, 8
mov qword [rcx], rax
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x20], rdi
mov qword [rax], rdi
lea rax, [fcn.18009de20]
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x40], rax
lea rax, [fcn.18009de40]
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x28], 4
mov dword [rcx + 0x30], reloc.WS2_32.dll_inet_ntoa
mov dword [rcx + 0x34], 0x1c
mov qword [rcx + 0x38], 3
lea rcx, [0x1800bd230]
call sym.tcl86t.dll_hcl_CreateThreadExitHandler
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 8
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
mov edx, 0x58
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x1800bfac0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x18018fe70]
xor edi, edi
mov ebx, edi
test rax, rax
je 0x1800bfaf9
test ecx, ecx
jle 0x1800bfaf9
cmp ecx, dword [rax + 8]
jge 0x1800bfaf9
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1800bfb26
lea ecx, [rbx + 8]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1800bfba7
xor eax, eax
lea rcx, [0x18018fe70]
mov rdx, rbx
mov qword [rbx], rax
call fcn.180106bc0
mov rax, qword [rbx]
test rax, rax
jne 0x1800bfb9c
lea ecx, [rax + 0x58]
call sym.tcl86t.dll_hclpAlloc
mov rcx, rax
test rax, rax
je 0x1800bfbb9
mov qword [rbx], rax
xor edx, edx
add rax, 8
mov qword [rcx], rax
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x20], rdi
mov qword [rax], rdi
lea rax, [fcn.18009de20]
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x40], rax
lea rax, [fcn.18009de40]
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x28], 4
mov dword [rcx + 0x30], reloc.WS2_32.dll_inet_ntoa
mov dword [rcx + 0x34], 0x1c
mov qword [rcx + 0x38], 3
lea rcx, [0x1800bfbd0]
call sym.tcl86t.dll_hcl_CreateThreadExitHandler
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 8
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
mov edx, 0x58
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3