joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18019eb20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xce50]
mov rbp, rdx
mov rbx, rcx
cmp dword [rcx + 0xc], eax
jne 0x18019ec22
test eax, eax
je 0x18019eb52
lea edi, [rax + rax]
jmp 0x18019eb57
mov edi, 0x10
cmp edi, eax
jae 0x18019eb65
mov eax, 0x80070216
jmp 0x18019ec3f
mov esi, edi
movabs rax, 0x1fffffffffffffff
cmp rsi, rax
ja 0x18019ec54
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18019eb88
xor eax, eax
jmp 0x18019eb8e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
lea r8, [rsi*8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x18019ec54
mov r8d, dword [rbx + 0xc]
mov rdx, qword [rbx + 0xce58]
mov rcx, rax
shl r8, 3
mov qword [rsp + 0x30], r12
call sub.msvcrt.dll_memcpy
mov r11d, dword [rbx + 0xc]
mov r8d, edi
sub r8d, r11d
lea rcx, [rsi + r11*8]
xor edx, edx
shl r8, 3
call fcn.18024adb8
mov r12, qword [rbx + 0xce58]
test r12, r12
je 0x18019ec10
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18019ebfc
xor eax, eax
jmp 0x18019ec02
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x30]
mov qword [rbx + 0xce58], rsi
mov dword [rbx + 0xce50], edi
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx + 0xce58]
mov qword [rcx + rdx*8], rbp
mov ecx, dword [rbx + 0xc]
mov dword [rbp], ecx
inc dword [rbx + 0xc]
or dword [rbx + 0x28], 4
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov eax, 0x8007000e
jmp 0x18019ec3f
Function at 0x18019ed50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x18025e63c]
xor r13d, r13d
mov rbp, r9
mov r12d, r8d
mov rsi, rdx
test ecx, ecx
jns 0x18019ed86
mov rax, r13
jmp 0x18019ed8c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
xor edx, edx
lea r8d, [rdx + 0x60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18019ee63
mov dword [rax], 0xffffffff
mov dword [rax + 4], 0xffffffff
mov dword [rax + 0x28], 0xffffffff
mov dword [rax + 0x2c], 0xffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x10], r13
mov dword [rax + 0x58], r13d
mov qword [rax + 8], rbp
mov dword [rax + 4], r12d
mov dword [rax + 0x28], 0xffffffff
mov dword [rax + 0x2c], 0xffffffff
mov dword [rax + 0x30], r13d
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov dword [rax + 0x34], r13d
mov dword [rax + 0x38], r13d
mov dword [rax + 0x3c], r13d
mov qword [rax + 0x50], r13
mov qword [rax + 0x48], r13
mov rax, qword [rsp + 0x60]
and rax, 0xfffffffffffffe7f
mov rdx, rbx
mov rcx, rdi
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x58], r13d
call fcn.18019ea00
mov ebp, eax
test eax, eax
js 0x18019ee52
mov ecx, dword [rdi + 0xce60]
mov eax, r13d
mov dword [rbx], ecx
inc dword [rdi + 0xce60]
mov qword [rsi], rbx
jmp 0x18019ee68
mov edx, 1
mov rcx, rbx
call fcn.18019e250
mov eax, ebp
jmp 0x18019ee68
mov eax, 0x8007000e
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18019ee90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x18025e63c]
xor ebx, ebx
mov r13, r9
mov r14, r8
mov r12, rdx
test ecx, ecx
jns 0x18019eec6
mov rax, rbx
jmp 0x18019eecc
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
xor edx, edx
mov r8d, 0xd0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18019f015
mov ecx, dword [rsp + 0x70]
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rbx
mov dword [rax], 0xffffffff
mov eax, 4
mov rdx, rdi
cmp ecx, eax
mov qword [rsp + 0x40], rbp
mov qword [rdi + 8], r14
cmova ecx, eax
mov eax, dword [rsp + 0x68]
mov qword [rdi + 0xa0], 0xffffffffffffffff
mov dword [rdi + 0x18], eax
mov rax, qword [rsp + 0x60]
mov dword [rdi + 0x1c], ecx
mov qword [rdi + 0x20], rax
movabs rax, 0xffffffe3ffffffff
mov rcx, rsi
and r13, rax
mov dword [rdi + 0x28], ebx
mov dword [rdi + 0x2c], ebx
mov qword [rdi + 0x68], rbx
mov dword [rdi + 0x98], 0xffffffff
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x10], r13
mov dword [rdi + 0x70], 0xffffffff
mov qword [rdi + 0x80], rbx
mov dword [rdi + 0x74], ebx
mov dword [rdi + 0x78], 0xffffffff
mov qword [rdi + 0x88], rbx
mov dword [rdi + 0x7c], ebx
mov qword [rdi + 0xb0], 0xffffffffffffffff
mov dword [rdi + 0xa8], 0xffffffff
mov dword [rdi + 0xb8], 0xffffffff
call fcn.18019eb20
mov r13d, eax
test eax, eax
js 0x18019efde
mov eax, dword [rsi + 0xce64]
mov dword [rdi], eax
inc dword [rsi + 0xce64]
mov qword [r12], rdi
mov eax, ebx
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
lea rcx, [rdi + 0x30]
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
call fcn.1801fde80
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x18019f002
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r13d
jmp 0x18019efbf
mov eax, 0x8007000e
jmp 0x18019efc4
Function at 0x18019f5f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x18025e63c]
xor r12d, r12d
mov rbp, r8
mov rsi, rdx
test ecx, ecx
jns 0x18019f625
mov rax, r12
jmp 0x18019f62b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
xor edx, edx
lea r8d, [rdx + 0x60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18019f6df
mov rdx, rsi
mov rcx, rax
mov dword [rax], 0xffffffff
mov dword [rax + 4], 0xffffffff
mov qword [rax + 8], r12
mov dword [rax + 0x28], 0xffffffff
mov dword [rax + 0x2c], 0xffffffff
mov dword [rax + 0x30], r12d
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov dword [rax + 0x34], r12d
mov dword [rax + 0x38], r12d
mov dword [rax + 0x3c], r12d
mov qword [rax + 0x50], r12
mov qword [rax + 0x48], r12
mov qword [rax + 0x10], r12
mov dword [rax + 0x58], r12d
call fcn.1801fdf30
mov esi, eax
test eax, eax
js 0x18019f6ce
mov rdx, rbx
mov rcx, rdi
call fcn.18019ea00
mov esi, eax
test eax, eax
js 0x18019f6ce
mov ecx, dword [rdi + 0xce60]
mov qword [rbp], rbx
mov eax, r12d
mov dword [rbx], ecx
inc dword [rdi + 0xce60]
jmp 0x18019f6e4
mov edx, 1
mov rcx, rbx
call fcn.18019e250
mov eax, esi
jmp 0x18019f6e4
mov eax, 0x8007000e
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x18019f710
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x18025e63c]
xor ebx, ebx
mov r13, r8
mov r12, rdx
test ecx, ecx
jns 0x18019f73d
mov rax, rbx
jmp 0x18019f743
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
xor edx, edx
mov r8d, 0xd0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18019f7fb
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rbx
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x40], rbp
mov dword [rax], 0xffffffff
call fcn.1801fdd70
mov r12d, eax
test eax, eax
js 0x18019f7c4
mov rdx, rdi
mov rcx, rsi
call fcn.18019eb20
mov r12d, eax
test eax, eax
js 0x18019f7c4
mov eax, dword [rsi + 0xce64]
mov dword [rdi], eax
inc dword [rsi + 0xce64]
mov qword [r13], rdi
mov eax, ebx
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
lea rcx, [rdi + 0x30]
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
call fcn.1801fde80
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x18019f7e8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r12d
jmp 0x18019f7ab
mov eax, 0x8007000e
jmp 0x18019f7b0
Function at 0x18019fe40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
cmp dword [rcx + 0x14], edx
jbe 0x18019ff7d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
xor ebp, ebp
nop word [rax + rax]
mov rbx, qword [rdi + 0x20]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18019fe85
mov rax, qword [rbx]
mov qword [rcx], rax
jmp 0x18019fe8c
mov rax, qword [rbx]
mov qword [rdi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x18019fe9e
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
jmp 0x18019fea6
mov rax, qword [rbx + 8]
mov qword [rdi + 0x20], rax
mov qword [rbx], 0xffffffffffffffff
mov qword [rbx + 8], 0xffffffffffffffff
dec dword [rdi + 0x14]
or dword [rdi + 0x28], 7
cmp word [rbx + 0x7c], bp
je 0x18019ff0f
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18019fed1
mov rax, rbp
jmp 0x18019fed7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, word [rbx + 0x7c]
cmp ecx, dword [rax + 0x250]
ja 0x18019ff07
mov r8, qword [rbx + 0x18]
dec ecx
movsxd rdx, ecx
shl rdx, 5
add rdx, qword [rax + 0x248]
test r8, r8
je 0x18019ff07
mov rax, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r8
mov word [rbx + 0x7c], bp
mov qword [rbx + 0x18], rbp
cmp word [rbx + 0x7e], bp
je 0x18019ff62
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18019ff24
mov rax, rbp
jmp 0x18019ff2a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, word [rbx + 0x7e]
cmp ecx, dword [rax + 0x250]
ja 0x18019ff5a
mov r8, qword [rbx + 0x28]
dec ecx
movsxd rdx, ecx
shl rdx, 5
add rdx, qword [rax + 0x248]
test r8, r8
je 0x18019ff5a
mov rax, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r8
mov word [rbx + 0x7e], bp
mov qword [rbx + 0x28], rbp
mov rcx, rbx
call fcn.1801979c0
cmp dword [rdi + 0x14], esi
ja 0x18019fe70
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
or dword [rdi + 0x28], 7
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1801fde80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
cmp qword [rcx], 0
mov rsi, rcx
je 0x1801fdf23
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], r12
xor r12d, r12d
mov qword [rsp + 0x40], rdi
nop word [rax + rax]
mov rbx, qword [rsi]
mov rbp, qword [rbx]
test rbx, rbx
je 0x1801fdf07
mov rcx, rbx
call fcn.1801991c0
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1801fded2
mov rdi, r12
jmp 0x1801fdedb
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 0xfe
mov r8d, 0x188
mov rcx, rbx
call fcn.18024adb8
mov qword [rbx], r12
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x1801fdeff
mov qword [rax], rbx
jmp 0x1801fdf03
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov qword [rsi], rbp
cmp rbp, r12
jne 0x1801fdeb0
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x1802105f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov edi, dword [rcx + 0x14]
movabs rax, 0x555555555555555
mov rbx, rcx
cmp rdi, rax
jbe 0x18021062c
mov rax, rbp
jmp 0x180210654
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18021063b
mov rax, rbp
jmp 0x180210641
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
lea r8, [rdi + rdi*2]
xor edx, edx
shl r8, 4
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
test rax, rax
je 0x1802106ec
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x1802106a2
lea rcx, [rax + 0x10]
nop dword [rax]
lea rax, [rcx - 0x10]
add rcx, 0x30
mov qword [rdx + 0x60], rax
mov dword [rcx - 0x34], ebp
mov qword [rcx - 0x30], rbp
mov dword [rcx - 0x28], ebp
mov qword [rcx - 0x20], rbp
mov dword [rcx - 0x3c], ebp
mov dword [rcx - 0x38], ebp
mov qword [rcx - 0x18], 0xffffffffffffffff
mov dword [rax], ebp
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180210670
mov edi, dword [rbx + 0x10]
movabs rax, 0xfffffffffffffff
cmp rdi, rax
jbe 0x1802106b9
mov r11, rbp
jmp 0x1802106e3
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1802106c8
mov rax, rbp
jmp 0x1802106ce
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
shl rdi, 4
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r11, rax
mov qword [rsi + 8], r11
test r11, r11
jne 0x1802106f3
mov eax, 0x8007000e
jmp 0x180210767
mov edx, dword [rbx + 0xc]
or r8d, 0xffffffff
nop word [rax + rax]
inc r8d
cmp r8d, edx
jae 0x180210765
mov rax, qword [rbx + 0xce58]
mov rax, qword [rax + r8*8]
cmp qword [rax + 0x30], rbp
je 0x180210700
mov rax, qword [rax + 0x30]
mov rcx, qword [rax]
mov qword [rax + 0x48], r11
mov qword [r11 + 8], rbp
add r11, 0x10
test rcx, rcx
je 0x180210739
mov rax, rcx
mov rcx, qword [rcx]
jmp 0x180210760
mov r10d, dword [rbx + 0xc]
nop dword [rax]
inc r8d
cmp r8d, r10d
jae 0x180210765
mov rcx, qword [rbx + 0xce58]
mov r9, qword [rcx + r8*8]
cmp qword [r9 + 0x30], rbp
je 0x180210740
mov rax, qword [r9 + 0x30]
mov rcx, qword [rax]
test rax, rax
jne 0x180210720
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180217a80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
or r9d, 0xffffffff
mov r10, rcx
mov ecx, dword [rcx + 0xc]
mov r8d, r9d
mov rdi, rdx
nop
inc r8d
xor esi, esi
cmp r8d, ecx
jae 0x180217afc
mov rax, qword [r10 + 0xce58]
mov rax, qword [rax + r8*8]
cmp qword [rax + 0x30], rsi
je 0x180217aa0
mov rax, qword [rax + 0x30]
mov rcx, qword [rax]
mov qword [rax + 0x40], rsi
test rcx, rcx
je 0x180217ad3
mov rax, rcx
mov rcx, qword [rcx]
jmp 0x180217af7
mov r11d, dword [r10 + 0xc]
inc r8d
cmp r8d, r11d
jae 0x180217afc
mov rax, qword [r10 + 0xce58]
mov rdx, qword [rax + r8*8]
cmp qword [rdx + 0x30], rsi
je 0x180217ad7
mov rax, qword [rdx + 0x30]
mov rcx, qword [rax]
test rax, rax
jne 0x180217ac2
cmp byte [rdi + 0xb8], sil
je 0x180217be9
mov eax, dword [rdi + 0xa8]
mov rbx, qword [rdi]
inc eax
mov dword [rbx + 0x18], eax
mov edx, dword [r10 + 0xc]
nop dword [rax + rax]
inc r9d
cmp r9d, edx
jae 0x180217be9
mov rax, qword [r10 + 0xce58]
mov r8, qword [rax + r9*8]
cmp qword [r8 + 0x30], rsi
je 0x180217b20
mov r8, qword [r8 + 0x30]
mov r11, qword [r8]
cmp qword [r8 + 0xf0], 0xffffffffffffffff
jne 0x180217bae
mov rcx, qword [r8 + 0xa8]
mov rdx, qword [rcx + 0x10]
mov rax, rdx
shr rax, 0xc
test al, 1
je 0x180217b7c
test rdx, 0x4200000
jne 0x180217b7c
mov edx, dword [rdi + 0x98]
add edx, dword [r8 + 0xc8]
jmp 0x180217b88
cmp rbx, rcx
jne 0x180217bae
mov edx, dword [r8 + 0xc8]
mov rax, qword [rdi + 0x68]
mov ecx, dword [rax + rdx*4]
mov eax, dword [r8 + 0xcc]
mov dword [r8 + 0xc8], ecx
lea ecx, [rax + rdx*4]
mov rax, qword [rdi + 0x60]
mov ecx, dword [rax + rcx*4]
mov dword [r8 + 0xcc], ecx
test r11, r11
je 0x180217bbb
mov r8, r11
mov r11, qword [r11]
jmp 0x180217be0
mov r8d, dword [r10 + 0xc]
nop
inc r9d
cmp r9d, r8d
jae 0x180217be9
mov rax, qword [r10 + 0xce58]
mov rdx, qword [rax + r9*8]
cmp qword [rdx + 0x30], rsi
je 0x180217bc0
mov r8, qword [rdx + 0x30]
mov r11, qword [r8]
test r8, r8
jne 0x180217b44
mov rbx, qword [rdi + 0x80]
test rbx, rbx
je 0x180217c18
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x180217c04
mov rax, rsi
jmp 0x180217c0a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rdi + 0x10]
mov qword [rdi + 0x80], rsi
test rbx, rbx
je 0x180217c4b
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x180217c37
mov rax, rsi
jmp 0x180217c3d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x10], rsi
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x18021bdd0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov dword [rcx + 0x34], 1
mov rbx, rcx
mov qword [rcx + 0x20], rdi
mov dword [rcx + 0x28], edi
mov dword [rcx + 0x2c], edi
mov dword [rcx + 0x30], edi
mov dword [rcx], edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov byte [rcx + 0x18], dil
mov qword [rcx + 0x58], rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov r8d, 0xc28
lea edx, [rax - 1]
add eax, 0xffff
mov dword [rbx + 0x64], edi
not edx
mov dword [rbx + 0x68], edi
mov dword [rbx + 0x6c], edi
and edx, eax
mov dword [rbx + 0x60], edx
lea ecx, [rdx - 1]
lea eax, [rdx + 0xfffff]
xor edx, edx
not ecx
and ecx, eax
mov dword [rbx + 0x70], ecx
lea rcx, [rbx + 0x78]
call fcn.18024adb8
lea rcx, [rbx + 0xce0]
xor edx, edx
mov r8d, 0x3f8
mov dword [rbx + 0xca0], edi
mov byte [rbx + 0x1148], dil
mov qword [rbx + 0x1150], rdi
mov dword [rbx + 0x38], edi
mov qword [rbx + 0x40], rdi
mov dword [rbx + 0x50], edi
mov dword [rbx + 0xca4], 1
mov dword [rbx + 0xca8], edi
mov dword [rbx + 0xcac], edi
mov dword [rbx + 0xcb0], 1
mov dword [rbx + 0xcb4], 1
mov dword [rbx + 0xcb8], 1
mov dword [rbx + 0xcbc], edi
mov qword [rbx + 0xcc0], rdi
mov qword [rbx + 0xcc8], rdi
mov qword [rbx + 0xcd0], rdi
mov qword [rbx + 0xcd8], rdi
mov qword [rbx + 0x10e0], rdi
mov qword [rbx + 0x10e8], rdi
mov qword [rbx + 0x10f0], rdi
mov qword [rbx + 0x48], rdi
call fcn.18024adb8
xor eax, eax
mov qword [rbx + 0x1100], rax
mov qword [rbx + 0x1108], rax
mov qword [rbx + 0x1110], rax
mov qword [rbx + 0x1118], rax
mov qword [rbx + 0x1120], rax
mov qword [rbx + 0x1128], rax
mov qword [rbx + 0x1130], rax
lea ecx, [rdi + 4]
xor edx, edx
mov dword [rbx + 0x10d8], edi
mov dword [rbx + 0x1138], 1
call sub.msvcrt.dll_setlocale
mov rcx, rax
call sub.msvcrt.dll__strdup
mov qword [rbx + 0x1140], rax
test rax, rax
je 0x18021bf6c
mov qword [rsp + 0x60], rsi
lea rdi, [0x180059314]
mov ecx, 2
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
mov rsi, qword [rsp + 0x60]
je 0x18021bf7d
lea rdx, [0x180059314]
mov ecx, 4
call sub.msvcrt.dll_setlocale
xor eax, eax
mov qword [rbx + 0x1158], rax
mov qword [rbx + 0x1160], rax
mov qword [rbx + 0x1168], rax
mov qword [rbx + 0x1170], rax
mov qword [rbx + 0x1178], rax
mov qword [rbx + 0x1180], rax
mov qword [rbx + 0x1188], rax
mov qword [rbx + 0x1190], rax
mov qword [rbx + 0x1198], rax
mov qword [rbx + 0x11a0], rax
mov qword [rbx + 0x11a8], rax
mov qword [rbx + 0x11b0], rax
call fcn.1802438b0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18021c3d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x1148], 0
mov rbx, rcx
jne 0x18021c436
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x18021c423
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18021c423
mov r8, qword [rax + 0x40]
lea rcx, [rbx + 0x58]
add rax, 0x48
mov qword [rax - 8], rcx
xor ecx, ecx
mov edx, 0xf
nop
mov qword [rax], rcx
mov qword [rax + 8], rcx
add rax, 0x10
sub rdx, 1
jne 0x18021c410
jmp 0x18021c428
xor ecx, ecx
mov r8, rcx
mov qword [rbx + 0x1150], r8
mov byte [rbx + 0x1148], 1
add rsp, 0x20
pop rbx
ret

Function at 0x18021c450
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x1148], 0
mov rbx, rcx
je 0x18021c4bd
mov qword [rsp + 0x30], rdi
mov rdi, qword [rcx + 0x1150]
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x18021c4b1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18021c4b1
mov qword [rax + 0x40], rdi
add rax, 0x48
mov ecx, 0xf
xor edx, edx
nop word [rax + rax]
mov qword [rax], rdx
mov qword [rax + 8], rdx
add rax, 0x10
sub rcx, 1
jne 0x18021c4a0
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 0x1148], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1802245b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
mov eax, 0x17b0
call fcn.18024afa0
sub rsp, rax
mov rax, qword [0x18025e100]
xor rax, rsp
mov qword [rsp + 0x17a0], rax
mov rax, r9
movzx edi, cl
mov rsi, r8
mov rbx, rdx
lea r9, [rsp + 0x17f0]
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 0xbb7
call sub.msvcrt.dll__vsnprintf
test eax, eax
js 0x18022460d
cdqe
cmp rax, 0xbb7
ja 0x18022460d
jne 0x180224615
mov byte [rsp + 0xbd7], 0
lea r9, [rsp + 0x20]
mov edx, 0xbb8
lea rcx, [rsp + 0xbe0]
lea r8, [0x1800599c0]
test dil, dil
jne 0x18022463a
lea r8, [0x1800599f0]
call fcn.18006bc00
test rbx, rbx
je 0x180224653
lea rdx, [rsp + 0xbe0]
mov rcx, rsi
call rbx
jmp 0x18022466e
lea rcx, [rsp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180034e20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x17a0]
xor rcx, rsp
call fcn.18024a670
add rsp, 0x17b0
pop rdi
pop rsi
pop rbx
ret

Function at 0x180224690
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x17b8
call fcn.18024afa0
sub rsp, rax
mov rax, qword [0x18025e100]
xor rax, rsp
mov qword [rsp + 0x17a0], rax
mov rbx, rcx
mov rdi, rdx
lea r9, [rsp + 0x17e8]
lea rcx, [rsp + 0x20]
mov edx, 0xbb7
call sub.msvcrt.dll__vsnprintf
test eax, eax
js 0x1802246e8
cdqe
cmp rax, 0xbb7
ja 0x1802246e8
jne 0x1802246f0
mov byte [rsp + 0xbd7], 0
lea r9, [rsp + 0x20]
lea r8, [0x180059a28]
lea rcx, [rsp + 0xbe0]
mov edx, 0xbb8
call fcn.18006bc00
test rbx, rbx
je 0x180224722
lea rdx, [rsp + 0xbe0]
mov rcx, rdi
call rbx
jmp 0x18022473d
lea rcx, [rsp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180034e20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x17a0]
xor rcx, rsp
call fcn.18024a670
add rsp, 0x17b8
pop rdi
pop rbx
ret
Function at 0x1802438b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x180268ae8], 0
jne 0x18024395e
xor ecx, ecx
mov dword [0x180268ae8], 1
xor esi, esi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
xor ecx, ecx
mov rdi, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
test rdi, rdi
je 0x1802438fb
test rax, rax
je 0x1802438fb
cmp rdi, rax
jne 0x180243900
mov esi, 1
test rdi, rdi
je 0x18024390d
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
je 0x18024391f
cmp rbx, rdi
je 0x18024391f
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor ecx, ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test esi, esi
je 0x18024395e
lea rcx, [0x180067b60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180067bc0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180067c20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x180067c78]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret