joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15b27d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x15b27dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x15b27ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x15b27d5
lea eax, [rcx + 1]
jmp 0x15b27fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x15b280e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x15b27f4
sub eax, 3
jb 0x15b282e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x15b287d
sar eax, 1
movsxd rbp, eax
jb 0x15b2864
jmp 0x15b283c
add ebx, ebx
jne 0x15b283a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x15b2864
inc ecx
add ebx, ebx
jne 0x15b284a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x15b2864
call r11
adc ecx, ecx
add ebx, ebx
jne 0x15b285d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x15b284c
add ecx, 2
jmp 0x15b2869
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.015b2792
jmp 0x15b27dd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1184000]
mov eax, dword [rdi]
or eax, eax
je 0x15b28d9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x11b2000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x15b2889
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x15b28d3
mov qword [rbx], rax
add rbx, 8
jmp 0x15b28a9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x15b291d
cmp al, 0xef
ja 0x15b2905
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x15b28e5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x15b28f4
mov eax, dword [rdi]
add rdi, 4
jmp 0x15b28f4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x15b2971
sub rsp, 0xffffffffffffff80
jmp 0x46fc40
Function at 0x140001c50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rdx]
call fcn.1400011e8
cmp eax, 0x1c
ja 0x140001ce9
lea rcx, [rsp + 0x30]
call fcn.1400014e8
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
cmp qword [rsp + 0x20], 0
je 0x140001ce9
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x60]
test rax, rax
je 0x140001cd4
lea rbx, [rax + 0x1000]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.1400031e0
mov rcx, qword [rsp + 0x20]
call fcn.140002e20
call rbx
jmp 0x140001ce9
mov rcx, qword [rsp + 0x20]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [rsp + 0x20]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140004777
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14002c0b0]
jne 0x140002e1a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002e16
repz ret
ror rcx, 0x10
jmp 0x1400046d0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002d5d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14002d6c8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140004755
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002d5d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140004777
mov rax, qword [rsp + 0x88]
mov qword [0x14002d6c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002d668], rax
mov rax, qword [0x14002d6c8]
mov qword [0x14002d540], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002d650], rax
mov dword [0x14002d530], 0xc0000409
mov dword [0x14002d534], 1
mov rax, qword [0x14002c0b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14002c0b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002d5c8], eax
mov ecx, 1
call fcn.14000b2b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140022b10]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002d5c8], 0
jne 0x1400047fe
mov ecx, 1
call fcn.14000b2b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000e1f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140222820]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x410
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbx]
cmp dword [r8 + 4], 0
je 0x14000e26f
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r9, rdi
lea r8, str.__s___s
lea rcx, [rbp]
mov qword [rsp + 0x20], rax
mov edx, 0x410
call fcn.1400040e8
and qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e39f
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
and qword [rsp + 0x68], 0
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x20f01ff
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
and qword [rsp + 0x70], 0
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
xor eax, eax
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
xor edx, edx
movups xmmword [rsp + 0x78], xmm0
lea ebx, [rax + 0x70]
mov r8d, ebx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x68]
lea rax, str.winsta0default
mov qword [rbp - 0x60], rax
lea r8, [rbp]
lea rax, [rsp + 0x78]
mov dword [rbp - 0x70], ebx
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov rdx, rdi
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x628
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne bl
test eax, eax
je 0x14000e376
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test bl, bl
je 0x14000e39f
mov al, 1
jmp 0x14000e3a1
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.14001af60
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140010c5c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
mov rdx, rcx
je 0x140010c8f
xor r8d, r8d
mov cl, r8b
movabs rax, 0x51533f1509c71599
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0xa
jb 0x140010c68
mov byte [rdx + 0xa], 0
mov rax, rdx
ret
Function at 0x140010c94
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
mov rdx, rcx
je 0x140010cc7
xor r8d, r8d
mov cl, r8b
movabs rax, 0x61a7ddf587214d1b
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x25
jb 0x140010ca0
mov byte [rdx + 0x25], 0
mov rax, rdx
ret

Function at 0x140010ccc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
mov rdx, rcx
je 0x140010cff
xor r8d, r8d
mov cl, r8b
movabs rax, 0x33936bbb8fbf972b
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0xa
jb 0x140010cd8
mov byte [rdx + 0xa], 0
mov rax, rdx
ret

Function at 0x140010d04
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
mov rdx, rcx
je 0x140010d37
xor r8d, r8d
mov cl, r8b
movabs rax, 0xb5e3ff6f79e787bf
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 9
jb 0x140010d10
mov byte [rdx + 9], 0
mov rax, rdx
ret

Function at 0x140010d3c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
mov rdx, rcx
je 0x140010d6f
xor r8d, r8d
mov cl, r8b
movabs rax, 0x717f5d0f8b9d9be7
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 9
jb 0x140010d48
mov byte [rdx + 9], 0
mov rax, rdx
ret
Function at 0x420420
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005aa6d3], 0
jne 0x420585
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x42052e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x42057a
lea rbx, [0x005a1ca0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x4204ef
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x42054a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x420455
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x420455
mov ecx, 0x40
nop
call fcn.00464ca0
lea rax, [0x004dd0b0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00435e40
nop
int3
Function at 0x456e80
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x456f61
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x0045ebc0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00462a20
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.00462b80
jmp fcn.00456e80
Function at 0x464720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x005aa960]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x005aa6d2], 0
je 0x46475d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005aabc0]
aesenc xmm0, xmmword [0x005aabd0]
aesenc xmm0, xmmword [0x005aabe0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x409740

Function at 0x46e380
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x46e459
lea rsi, [rdx + rdx*2]
lea rdi, [0x0056fc00]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x46e402
inc rdx
nop
jmp 0x46e3d8
cmp r9, 0xffffffffffffffe0
jle 0x46e40d
dec rdx
jmp 0x46e3d8
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.00464c80
nop
int3
Function at 0x18000174c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
test edx, edx
jne 0x18000176d
mov rax, qword [rcx + 0x48]
jmp 0x18000176f
xor eax, eax
and dword [rbp - 0x4c], 0
lea rdx, [rbp - 0x50]
and dword [rbp - 0x48], 0
and qword [rbp - 0x40], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov qword [rbp - 0x38], rax
mov rax, qword [rcx + 0x28]
mov ecx, dword [0x180027910]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x20], 0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r8, qword [rbx + 0x18]
mov edx, dword [rbx + 0x20]
mov rcx, qword [rbx + 0x10]
call fcn.1800017f8
mov ecx, dword [0x180027910]
test edi, edi
jne 0x1800017cd
mov rdx, qword [rbp - 0x38]
jmp 0x1800017cf
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1800017e3
call fcn.180009d80
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x180001ac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x180001b3b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov ebx, 0xa
mov ebp, 0x3e8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x180001b3b
add ebx, ebx
cmp ebx, ebp
cmova ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jae 0x180001b50
jmp 0x180001b02
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call fcn.18000142c
int3

Function at 0x180001b58
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 4]
mov rbx, rcx
cmp eax, 2
je 0x180001be5
cmp byte [0x18002791c], 0
mov esi, 1
je 0x180001bb1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov ecx, dword [0x180028b04]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x180001be5
pause
sub ecx, esi
test ecx, ecx
jg 0x180001b94
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x64
jb 0x180001b88
xor eax, eax
lock cmpxchg dword [rbx + 4], esi
jne 0x180001be5
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jne 0x180001bd9
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], sil
call fcn.1800021d4
mov qword [rbx + 0x10], rax
mov rcx, rax
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180001cd8
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180027910]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
add rsp, 0x28
jmp fcn.180005bd4

Function at 0x180001d04
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov r14, rdx
mov ecx, dword [0x180027910]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r15, rax
mov rdi, qword [rax + 0x28]
movsxd rsi, dword [rax]
mov r8, qword [rdi]
mov rbx, qword [r8 + 0x20]
mov rcx, rbx
call fcn.1800196e8
mov r9d, esi
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call rbx
test al, al
je 0x180001d7e
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x180001d77
mov eax, dword [r14]
xor r8d, r8d
mov r9d, dword [rbp]
mov edx, esi
mov dword [rsp + 0x20], eax
call fcn.180003d08
mov eax, 1
jmp 0x180001db6
cmp byte [rsi + rdi + 0x38], 0
mov ecx, dword [rdi + 0x20]
jne 0x180001d8a
dec ecx
mov dword [r14], ecx
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x180001dac
mov r9d, dword [rdi + 0x20]
mov r8d, 1
mov edx, esi
mov dword [rsp + 0x20], r9d
call fcn.180003d08
mov rcx, r15
call fcn.180005bd4
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x180001dd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov r14, rdx
mov ecx, dword [0x180027910]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r15, rax
mov rdi, qword [rax + 0x28]
movsxd rsi, dword [rax]
mov r8, qword [rdi]
mov rbx, qword [r8 + 0x20]
mov rcx, rbx
call fcn.1800196e8
mov r9d, esi
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call rbx
test al, al
je 0x180001e4b
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x180001e44
mov rax, qword [r14]
xor r8d, r8d
mov r9, qword [rbp]
mov edx, esi
mov qword [rsp + 0x20], rax
call fcn.180003eb0
mov eax, 1
jmp 0x180001e85
cmp byte [rsi + rdi + 0x48], 0
mov rcx, qword [rdi + 0x28]
jne 0x180001e59
dec rcx
mov qword [r14], rcx
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x180001e7b
mov r9, qword [rdi + 0x28]
mov r8d, 1
mov edx, esi
mov qword [rsp + 0x20], r9
call fcn.180003eb0
mov rcx, r15
call fcn.180005bd4
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180001ea0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x180027910]
cmp ecx, 0xffffffff
je 0x180001f36
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x180001f36
cmp qword [rax + 0x40], 0
jne 0x180001f57
mov rsi, qword [rax + 0x28]
mov rax, qword [rsi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1800196e8
mov rcx, rsi
call rbx
cmp eax, 3
jne 0x180001f02
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x180001f2d
mov edx, dword [rdi]
call fcn.18000227c
jmp 0x180001f47
mov rax, qword [rsi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1800196e8
mov rcx, rsi
call rbx
cmp eax, 6
jne 0x180001f2d
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x180001f2d
mov edx, dword [rdi]
call fcn.180002430
jmp 0x180001f47
lea rdx, str.pragma_omp_ordered
jmp 0x180001f3d
lea rdx, [0x1800220f8]
mov ecx, 0x7d5
call fcn.1800013b0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r8, [0x180022128]
mov ecx, 0xbbb
lea rdx, [0x180022158]
call fcn.1800013e8
int3

Function at 0x180001f70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x180027910]
cmp ecx, 0xffffffff
je 0x180001ff0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x180001ff0
mov rdi, qword [rax + 0x28]
mov rcx, qword [rdi]
mov rbx, qword [rcx + 8]
mov rcx, rbx
call fcn.1800196e8
mov rcx, rdi
call rbx
cmp eax, 3
jne 0x180001fc7
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x180001ff0
mov edx, dword [rsi]
call fcn.180002364
jmp 0x180001ff0
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1800196e8
mov rcx, rdi
call rbx
cmp eax, 6
jne 0x180001ff0
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x180001ff0
mov edx, dword [rsi]
call fcn.18000251c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180002000
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x180027910]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rdi, qword [rax + 0x28]
mov rcx, qword [rdi]
mov rbx, qword [rcx + 8]
mov rcx, rbx
call fcn.1800196e8
mov rcx, rdi
call rbx
cmp eax, 3
jne 0x180002062
mov r8, qword [rdi + 0x30]
test r8, r8
je 0x1800020a1
movsxd rax, dword [rsi]
add rax, 3
lea rdx, [rax + rax*2]
mov byte [r8 + rdx*8], 0
mov rax, qword [r8 + 0x28]
mov ecx, dword [rax + 0x24]
add dword [r8 + rdx*8 + 4], ecx
jmp 0x1800020a1
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1800196e8
mov rcx, rdi
call rbx
cmp eax, 6
jne 0x1800020a1
mov r8, qword [rdi + 0x40]
test r8, r8
je 0x1800020a1
movsxd rax, dword [rsi]
add rax, 2
lea rdx, [rax + rax*4]
mov byte [r8 + rdx*8], 0
mov rax, qword [r8 + 0x28]
mov rcx, qword [rax + 0x30]
add qword [r8 + rdx*8 + 8], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret