joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802f12f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
xor ebx, ebx
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov r14, r9
mov qword [rsp + 0x50], rdi
mov rsi, rdx
mov qword [rsp + 0x40], r15
mov edi, r8d
mov r15, rcx
mov ebp, ebx
jne 0x1802f1335
mov ebx, 1
jmp 0x1802f1386
mov qword [rsp + 0x48], r12
mov r12d, 0x100000
mov rcx, qword [r15 + 0x20]
lea r9, [rsp + 0x30]
mov r8d, edi
mov dword [rsp + 0x30], ebx
cmp edi, r12d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
cmova r8d, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
add ebp, ecx
test eax, eax
je 0x1802f137c
test ecx, ecx
je 0x1802f1381
add rsi, rcx
sub edi, ecx
jne 0x1802f1340
jmp 0x1802f1381
mov ebx, 1
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test r14, r14
je 0x1802f139f
mov dword [r14], ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret

Function at 0x1802f1d10
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x1802f1d4b
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1802f1d4b
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x20]
call fcn.1802f9710
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1802f9710
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
je 0x1802f976e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1802f9759
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1802f976e
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x1802f9770
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18030cd30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.1802fc670
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x18030cd86
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x18030cddd
mov ebp, 0x4b0000
jmp 0x18030cdeb
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.1802fe660
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x18030ce01
mov eax, r12d
jmp 0x18030ce0a
mov edx, edi
mov ecx, ebp
call fcn.1802fe660
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x18030ce26
shl esi, 0x10
mov ecx, esi
jmp 0x18030cf15
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x18030ce84
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.1802fc670
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x18030ce74
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.1802fe450
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.1802fc670
add ebx, eax
jmp 0x18030cf1e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x18030ce91
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x18030ced0
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.1802fc670
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x18030ced5
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.1802fe450
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.1802fc670
add ebx, eax
jmp 0x18030cf1e
cmp eax, r12d
jge 0x18030cf0e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.1802fc670
sub ebp, eax
sub r15d, esi
je 0x18030cf0e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.1802fe450
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.1802fc670
add ebx, eax
jmp 0x18030cf1e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.1802fc670
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
call fcn.1802fc670
mov r15, qword [rsp + 0x30]
add eax, 0x8000
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
shr eax, 0x10
cwde
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x180343980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
mov esi, r14d
mov dword [rcx + 0x3c], r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x180343ac8
movzx r11d, r14w
mov edi, r14d
mov rax, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r11w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + rax]
call fcn.180343db0
test al, al
jne 0x180343ad4
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r11d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x180343a5c
cmp edx, dword [rbx + 0x60]
jl 0x180343a5c
cmp edx, dword [rbx + 0x64]
jg 0x180343a5c
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x180343a5c
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rax + 0x18]
xor cl, byte [r9 + 0x18]
test cl, 8
jne 0x180343a5c
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r10, qword [rbx + 0x70]
mov rax, qword [r10 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x180343a7f
test byte [r10 + 0x18], 8
je 0x180343a7f
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x180343a90
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.1803447b0
test al, al
jne 0x180343ad4
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x180343aaf
mov qword [r10 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc esi
add rdi, 2
inc r11w
cmp esi, eax
jl 0x1803439e4
mov rcx, rbx
call fcn.180344850
test al, al
je 0x180343ad8
mov al, 1
jmp 0x180343ae3
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1803691e0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18042dd60
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x18036f250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.18042dd60
sub rsp, rax
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.180364780
test eax, eax
je 0x18036f28f
xor edx, edx
mov rcx, rbx
call fcn.180364c30
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x18036f2d7
mov edx, ebp
mov rcx, rbx
call fcn.1803651a0
test rax, rax
je 0x18036f33d
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x18036f2f7
mov qword [r8], rcx
test rdi, rdi
jle 0x18036f32e
sub r14, rax
nop
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x18036f300
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x18036f338
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x1803748a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18042dd60
sub rsp, rax
lea rcx, [0x18067b318]
add rsp, 0x28
jmp fcn.180369040
Function at 0x18037edd0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x30
call fcn.18042dd60
sub rsp, rax
xor esi, esi
lea edx, [rax - 0x2f]
mov ebx, esi
mov rdi, rcx
call fcn.180371570
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.1803713e0
mov r14, rax
test rax, rax
je 0x18037ee7a
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18037ee53
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.180371470
mov rcx, rdi
call fcn.180371620
mov rbx, rax
test rax, rax
jne 0x18037ef16
mov edx, 1
mov rcx, rdi
call fcn.180371570
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.1803713e0
mov r14, rax
test rax, rax
je 0x18037ef04
mov r9d, 0x16
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18037eee6
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.180371470
mov rcx, rdi
call fcn.180371620
mov rbx, rax
test rbx, rbx
je 0x18037ef0e
mov rax, rbx
jmp 0x18037ef16
mov rcx, rdi
call fcn.180371620
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x18037f6f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.18042dd60
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x18037f720
xor r9d, r9d
cmp rdx, r8
jae 0x18037f739
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x18037f761
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18037f750
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.18039dcc0
test eax, eax
je 0x18037f792
cmp dword [rsp + 0x40], 0x10
jne 0x18037f792
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x18037f940
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x18037f9c8
test r8, r8
je 0x18037f9c8
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x18037f986
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x18037f970
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x18037f9c8
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x18037f9c8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x18037f9b0
ret

Function at 0x18038f700
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x20
call fcn.18042dd60
sub rsp, rax
mov rbx, rcx
call fcn.18007f290
test eax, eax
je 0x18038f723
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]

Function at 0x1803b3f50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.18042dd60
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1803b3f79
lea rax, [0x1803b25c0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1803aaae0
lea rax, [0x1803b1780]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1803aa830
Function at 0x1803bbbc9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1803bbdba
push rbx
mov eax, 0xd0
call fcn.18042dd60
sub rsp, rax
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1803a25b0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1803a1f50
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.18039ec90
mov rcx, r15
call fcn.1803a25b0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1803a1f50
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.18039ec90
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1803bbc30
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0xd0
pop rbx
ret
Function at 0x1803e9e50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, Ordinal_203
call fcn.18042dd60
sub rsp, rax
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, qword [rsp + 0x130]
xor r14d, r14d
mov rax, qword [rcx]
mov rbp, r9
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov r15d, r14d
lea r13d, [r14 + 1]
test r9, r9
je 0x1803e9eb9
cmp r9, rax
je 0x1803e9eb1
test rdx, rdx
je 0x1803e9f2a
test r8d, r8d
js 0x1803e9f2a
mov r15d, r13d
mov qword [rcx], r9
jmp 0x1803e9ec1
test rax, rax
je 0x1803e9f2a
mov rbp, rax
mov rcx, rbp
call fcn.1800cc580
test al, 2
jne 0x1803e9f2a
test rsi, rsi
je 0x1803e9f92
mov rcx, rbp
mov r15d, r13d
call fcn.180394950
cmp eax, 0x90
jg 0x1803e9f2a
cmp eax, edi
jge 0x1803e9f50
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.1803e0520
test eax, eax
je 0x1803e9f2a
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1803e0770
test eax, eax
je 0x1803e9f2a
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.1803e0440
test eax, eax
jne 0x1803e9f6d
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp edi, 0x90
ja 0x1803e9f2a
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x1803e9f9b
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x1803e9f9b
test r15d, r15d
je 0x1803ea076
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1803e9fc0
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.1803e0520
test eax, eax
je 0x1803ea089
mov rcx, rbp
call fcn.180394950
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1803e0770
test eax, eax
je 0x1803ea089
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1803ea020
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.1803e0520
test eax, eax
je 0x1803ea089
mov rcx, rbp
call fcn.180394950
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1803e0770
test eax, eax
je 0x1803ea089
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.1803e07a0
test eax, eax
cmovne r14d, r13d
test r15d, r15d
je 0x1803ea09d
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.180001c80
mov eax, r14d
jmp 0x1803e9f2c
Function at 0x180473280
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180704380]
test rax, rax
jne 0x1804733dd
mov rax, qword [0x1807036a0]
test rax, rax
jne 0x1804732cd
lea ecx, [rax + 8]
call fcn.18042ce24
mov qword [rsp + 0x88], rax
mov rcx, rax
call fcn.1804735b0
nop
mov qword [0x1807036a0], rax
mov qword [rsp + 0x80], rax
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x180704380]
test rax, rax
jne 0x1804733cc
lea ecx, [rax + 0x40]
call fcn.18042ce24
mov rdi, rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rdi], eax
cmp eax, 0xffffffff
je 0x1804733ec
mov ecx, 0x30
call fcn.18042ce24
mov rbx, rax
mov qword [rsp + 0x90], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx + 0x28], 1
mov qword [rdi + 8], rbx
lea rcx, [rdi + 0x10]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rax
mov rax, qword [rcx + 0x10]
sub rax, qword [rcx]
sar rax, 2
movabs rsi, 0x7fffffffffffffff
cmp rax, 0x20
jae 0x180473395
movabs rax, 0x3fffffffffffffff
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], rsi
mov edx, 0x20
call fcn.18013a500
mov rax, qword [rdi + 0x38]
sub rax, qword [rdi + 0x28]
sar rax, 3
cmp rax, 0x20
jae 0x1804733c5
movabs rax, 0x1fffffffffffffff
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
lea rcx, [rdi + 0x28]
call fcn.18013a480
nop
mov qword [0x180704380], rdi
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x180704380]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.tlsKey___TLS_OUT_OF_INDEXES
lea rcx, [rsp + 0x50]
call fcn.180115210
nop
mov dword [rsp + 0x20], 0x3c8
lea r9, str.e:zhanlue_rcimage_vendordependsopencvmodulescore_src_system.cpp
lea r8, str.cv::TlsAbstraction::TlsAbstraction
lea rdx, [rsp + 0x50]
mov ecx, 0xffffff29
call fcn.180474550
int3
Function at 0x180490c90
Capabilities:
Encode data using xor

Disassembly:
movsxd r11, edx
xor r8d, r8d
mov r9, rcx
xorps xmm3, xmm3
lea eax, [r11 - 4]
movsxd r10, eax
test eax, eax
js 0x180490d19
add rcx, 8
add r10, 4
shr r10, 2
lea r8d, [r10*4]
nop dword [rax + rax]
mov eax, dword [rcx - 8]
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
mov eax, dword [rcx - 4]
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mov eax, dword [rcx]
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movd xmm0, eax
mov eax, dword [rcx + 4]
add rcx, 0x10
cvtdq2pd xmm0, xmm0
cdq
xor eax, edx
sub eax, edx
addsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
addsd xmm3, xmm1
sub r10, 1
jne 0x180490cc0
mov ecx, r11d
sub ecx, r8d
cmp r8d, r11d
jge 0x180490da7
cmp ecx, 4
jb 0x180490da7
cmp dword [0x18066dce0], 2
jl 0x180490da7
movsxd rdx, r8d
xorps xmm4, xmm4
xorps xmm5, xmm5
and ecx, 0x80000003
jge 0x180490d4e
dec ecx
or ecx, 0xfffffffc
inc ecx
mov eax, r11d
sub eax, ecx
movsxd rcx, eax
nop word [rax + rax]
movq xmm0, qword [r9 + rdx*4]
add r8d, 4
pabsd xmm1, xmm0
movq xmm0, qword [r9 + rdx*4 + 8]
cvtdq2pd xmm2, xmm1
add rdx, 4
pabsd xmm1, xmm0
addpd xmm4, xmm2
cvtdq2pd xmm2, xmm1
addpd xmm5, xmm2
cmp rdx, rcx
jl 0x180490d60
addpd xmm4, xmm5
movaps xmm0, xmm4
unpckhpd xmm0, xmm4
addsd xmm4, xmm0
addsd xmm3, xmm4
movsxd rcx, r8d
mov r10, r11
cmp rcx, r11
jge 0x180490e65
mov rax, r11
sub rax, rcx
cmp rax, 4
jl 0x180490e43
mov r8, r10
lea r11, [r9 + 8]
sub r8, rcx
lea r11, [r11 + rcx*4]
sub r8, 4
shr r8, 2
inc r8
lea rcx, [rcx + r8*4]
mov eax, dword [r11 - 8]
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
mov eax, dword [r11 - 4]
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mov eax, dword [r11]
addsd xmm1, xmm3
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm0, xmm0
movaps xmm3, xmm1
addsd xmm3, xmm0
movd xmm0, eax
mov eax, dword [r11 + 4]
add r11, 0x10
cvtdq2pd xmm0, xmm0
cdq
xor eax, edx
sub eax, edx
addsd xmm3, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm3, xmm0
sub r8, 1
jne 0x180490de3
cmp rcx, r10
jge 0x180490e65
mov eax, dword [r9 + rcx*4]
inc rcx
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm3, xmm1
cmp rcx, r10
jl 0x180490e48
movaps xmm0, xmm3
ret