joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800310a0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
jne 0x1800310b9
mov eax, 0x80070057
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1800310e0
call fcn.1800030e0
add rsp, 0x20
pop rbx
ret
mov rax, qword [rsp + 0x38]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800310f0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov rdi, rdx
lea r8, [rsp + 0x30]
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180031134
call fcn.1800030e0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180031124
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x180031124
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180031124
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180031180
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x20]
mov eax, r8d
mov rbx, r9
xor r9d, r9d
mov r8d, 0x400000
mov dword [rsp + 0x50], r9d
cmp eax, r8d
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x50]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800311c4
call fcn.1800030e0
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x1800311cf
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1800317f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
lea rax, [rcx + 0x18]
xor r12d, r12d
mov rdi, rcx
mov qword [r8], rax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov rbp, r9
mov rsi, r8
lea rbx, [rdx + rax]
lea r9d, [r12 + 1]
lea r8, [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x50]
cmp rax, rbx
je 0x180031864
mov rcx, qword [rdi + 8]
sub rbx, rax
lea r9d, [r12 + 1]
lea r8, [rsp + 0x5c]
mov edx, ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [rsi]
mov rcx, qword [rdi + 8]
mov r9, rbp
mov r8d, 0x20000
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
test eax, eax
mov ecx, 0x1e
cmovne ecx, r12d
mov eax, ecx
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1800318a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rbp, r8
mov rsi, r9
lea rbx, [rdx + rax]
lea r8, [rsp + 0x54]
xor edx, edx
mov r9d, 1
mov qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x50]
cmp rax, rbx
je 0x18003190a
mov rcx, qword [rdi + 8]
sub rbx, rax
lea r8, [rsp + 0x5c]
mov edx, ebx
mov r9d, 1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsi]
mov eax, 0x20000
lea rdx, [rdi + 0x18]
mov qword [rbp], rdx
mov rcx, qword [rdi + 8]
cmp r8d, eax
cmova r8d, eax
mov r9, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180031950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x20020]
jmp 0x18003c720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x180104068]
xor r15d, r15d
mov r13, r9
mov r14, r8
mov r12d, r15d
call fcn.18003feb0
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x20], rbp
jbe 0x18003c7e3
cmp dword [rbx + 0x3c], 1
je 0x18003c785
mov rdx, qword [rbx + 0x50]
lea rcx, [0x180104068]
xor r9d, r9d
xor r8d, r8d
call fcn.180040200
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov ecx, dword [0x1800fbf64]
mov rdi, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x18003c7a6
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x18003c7e3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov eax, dword [rbx + 0x3c]
cmp eax, 2
jne 0x18003c809
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x38]
mov qword [rbx + 0x28], rdx
mov rax, qword [rcx]
lea r8, [rbx + 0x30]
call qword [rax]
mov r12d, eax
jmp 0x18003c78d
cmp eax, 3
jne 0x18003c828
movsxd rdx, dword [rbx + 0x48]
add rdx, qword [rbx + 0x20]
cmp rdx, rbp
ja 0x18003c828
mov qword [rbx + 0x20], rdx
mov dword [rbx + 0x48], r15d
jmp 0x18003c78d
mov edi, r15d
mov rsi, r15
test r12d, r12d
jne 0x18003c856
cmp eax, 1
jne 0x18003c83e
lea r12d, [rax + 0xa]
jmp 0x18003c856
movsxd rax, dword [rbx + 0x20]
mov edi, dword [rbx + 0x48]
mov rsi, qword [rbx + 0x40]
sub edi, ebp
sub rsi, rax
add edi, eax
movsxd rax, ebp
add rsi, rax
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x18003c888
mov ecx, dword [0x1800fbf64]
xor edx, edx
mov dword [rax], r15d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x180103c60]
test r11, r11
je 0x18003c888
call r11
lea r11, [rsp + 0x50]
mov qword [rbx + 0x58], r15
mov qword [r14], rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r13], edi
mov eax, r12d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18003b230
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
lea r8, [0x180100610]
nop dword [rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x18003b254
shr eax, 1
xor eax, 0xedb88320
jmp 0x18003b256
shr eax, 1
sub rcx, 1
jne 0x18003b247
inc edx
mov dword [r8], eax
add r8, 4
cmp edx, 0x100
jl 0x18003b240
repz ret
Function at 0x18003b270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
xor r11d, r11d
mov qword [rsp + 0x10], rbx
mov r10, rdx
mov r9d, ecx
lea rdi, [0x180100610]
cmp dword [0x180100614], r11d
jne 0x18003b2cc
mov edx, r11d
mov rbx, rdi
nop word [rax + rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x18003b2b4
shr eax, 1
xor eax, 0xedb88320
jmp 0x18003b2b6
shr eax, 1
sub rcx, 1
jne 0x18003b2a7
inc edx
mov dword [rbx], eax
add rbx, 4
cmp edx, 0x100
jl 0x18003b2a0
test r8, r8
je 0x18003b2f8
test r10b, 7
je 0x18003b2f8
movzx ecx, byte [r10]
movzx eax, r9b
inc r10
xor rcx, rax
mov eax, r9d
mov r9d, dword [rdi + rcx*4]
shr eax, 8
xor r9d, eax
sub r8, 1
jne 0x18003b2d1
cmp r8, 8
jb 0x18003b38e
mov rbx, r8
shr rbx, 3
mov rax, rbx
imul rax, rax, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
xor r9d, dword [r10]
add r10, 8
movzx eax, r9b
shr r9d, 8
mov ecx, dword [rdi + rax*4]
xor ecx, r9d
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, dword [r10 - 4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov r9d, dword [rdi + rax*4]
xor r9d, ecx
sub rbx, 1
jne 0x18003b320
mov rbx, qword [rsp + 0x10]
test r8, r8
je 0x18003b3c1
nop dword [rax + rax]
movzx ecx, byte [r11 + r10]
movzx eax, r9b
inc r11
xor rcx, rax
mov eax, r9d
mov r9d, dword [rdi + rcx*4]
shr eax, 8
xor r9d, eax
cmp r11, r8
jb 0x18003b3a0
mov eax, r9d
pop rdi
ret
Function at 0x18003b820
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x18003b967
test r8d, r8d
jle 0x18003b967
mov rax, qword [rbx + 4]
lea rcx, [r11 - 0x60]
mov qword [r11 + 0x18], rdi
mov qword [rcx], rax
mov rax, qword [rbx + 0xc]
mov qword [r11 - 0x20], r12
mov qword [rcx + 8], rax
mov eax, r8d
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov edi, eax
mov dword [rsp + 0x20], eax
mov r12d, eax
test eax, eax
jle 0x18003b93f
mov edi, dword [rsp + 0x28]
mov qword [r11 - 0x28], r13
mov r13d, dword [r11 - 0x54]
mov qword [r11 - 0x30], r14
mov r14d, dword [r11 - 0x58]
mov qword [r11 - 0x38], r15
mov r15d, dword [r11 - 0x5c]
nop dword [rax + rax]
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rbx
call fcn.18003bd10
mov r11d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
xor r11d, edi
mov edi, dword [rsi]
xor edx, r15d
mov r15d, dword [rsi + 4]
xor ecx, r14d
mov r14d, dword [rsi + 8]
xor eax, r13d
mov r13d, dword [rsi + 0xc]
dec r12d
mov dword [rbp], r11d
mov dword [rbp + 4], edx
mov dword [rbp + 8], ecx
mov dword [rbp + 0xc], eax
add rbp, 0x10
add rsi, 0x10
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], eax
test r12d, r12d
jg 0x18003b8b0
mov dword [rsp + 0x34], r13d
mov r13, qword [rsp + 0x60]
mov dword [rsp + 0x30], r14d
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x2c], r15d
mov r15, qword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov edi, dword [rsp + 0x20]
mov r12, qword [rsp + 0x68]
lea rcx, [rsp + 0x28]
shl edi, 4
mov rax, qword [rcx]
mov qword [rbx + 4], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0xc], rax
mov eax, edi
mov rdi, qword [rsp + 0xa0]
jmp 0x18003b969
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180062100
add rsp, 0x70
pop rsi
pop rbp
pop rbx
ret
Function at 0x18003b980
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov eax, dword [rdx]
mov r9, rcx
lea rcx, [rsp]
mov dword [rcx], eax
mov eax, dword [rdx + 4]
xor ebx, ebx
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
xor r11d, r11d
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
xor r8d, r8d
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor edx, edx
mov dword [rcx + 0x1c], eax
xor r10d, r10d
cmp r10, 0x28
jg 0x18003ba3e
cmp rdx, 4
jge 0x18003ba27
cmp r8, 4
jge 0x18003ba27
movzx eax, byte [rsp + rdx*4]
lea rcx, [r8 + r10]
inc rdx
mov byte [r9 + rcx*4 + 0x14], al
movzx eax, byte [rsp + rdx*4 - 3]
lea rcx, [r8 + r10]
mov byte [r9 + rcx*4 + 0x15], al
movzx eax, byte [rsp + rdx*4 - 2]
inc r11d
mov byte [r9 + rcx*4 + 0x16], al
movzx eax, byte [rsp + rdx*4 - 1]
inc r8
cmp rdx, 4
mov byte [r9 + rcx*4 + 0x17], al
jl 0x18003b9e3
cmp r8, 4
jne 0x18003ba38
inc ebx
add r10, r8
xor r11d, r11d
xor r8d, r8d
cmp rdx, 4
jl 0x18003b9d7
movsxd r10, ebx
movsxd r8, r11d
cmp r10, 0xa
jg 0x18003bb45
mov qword [rsp + 0x50], rdi
lea rbx, [0x180103a10]
lea rdi, [0x180103b30]
movzx eax, byte [rsp + 0xd]
movzx ecx, byte [rsp]
lea rdx, [rsp + 1]
xor cl, byte [rax + rdi]
movzx eax, byte [rsp + 0xe]
mov r11d, 3
movzx eax, byte [rax + rdi]
xor cl, byte [rbx]
xor byte [rsp + 1], al
movzx eax, byte [rsp + 0xf]
mov byte [rsp], cl
movzx eax, byte [rax + rdi]
xor byte [rsp + 2], al
movzx eax, byte [rsp + 0xc]
movzx eax, byte [rax + rdi]
xor byte [rsp + 3], al
inc rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
add rdx, 4
xor byte [rdx - 1], al
movzx eax, byte [rdx - 4]
xor byte [rdx], al
movzx eax, byte [rdx - 3]
xor byte [rdx + 1], al
movzx eax, byte [rdx - 2]
xor byte [rdx + 2], al
sub r11, 1
jne 0x18003bab0
xor edx, edx
cmp r10, 0xa
jg 0x18003bb40
cmp rdx, 4
jge 0x18003bb24
cmp r8, 4
jge 0x18003bb24
movzx eax, byte [rsp + rdx*4]
lea rcx, [r8 + r10*4]
inc rdx
mov byte [r9 + rcx*4 + 0x14], al
movzx eax, byte [rsp + rdx*4 - 3]
lea rcx, [r8 + r10*4]
mov byte [r9 + rcx*4 + 0x15], al
movzx eax, byte [rsp + rdx*4 - 2]
inc r8
cmp rdx, 4
mov byte [r9 + rcx*4 + 0x16], al
movzx eax, byte [rsp + rdx*4 - 1]
mov byte [r9 + rcx*4 + 0x17], al
jl 0x18003bae3
cmp r8, 4
jne 0x18003bb30
inc r10
xor r8d, r8d
cmp rdx, 4
jl 0x18003bad7
cmp r10, 0xa
jle 0x18003ba61
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.180062100
add rsp, 0x30
pop rbx
ret
Function at 0x18003bb60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x10], rax
lea r9, [rcx + 0x24]
lea r10, [rcx + 0x28]
mov ebx, 9
lea rdi, [0x180000000]
nop dword [rax]
xor r11d, r11d
nop word [rax + rax]
movzx eax, byte [r10 - 1]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 - 2]
movzx r8d, byte [rdx + rdi + 0x100a10]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 - 3]
xor r8b, byte [rcx + rdi + 0x100e10]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 - 4]
xor r8b, byte [rcx + rdi + 0x101210]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 3]
xor r8b, byte [rcx + rdi + 0x101610]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 2]
mov byte [rsp + r11], r8b
movzx r8d, byte [rdx + rdi + 0x100a10]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x100e10]
movzx eax, byte [r10 + 1]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10]
xor r8b, byte [rcx + rdi + 0x101210]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 7]
xor r8b, byte [rcx + rdi + 0x101610]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 6]
mov byte [rsp + r11 + 4], r8b
movzx r8d, byte [rdx + rdi + 0x100a10]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x100e10]
movzx eax, byte [r10 + 5]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 4]
xor r8b, byte [rcx + rdi + 0x101210]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 0xb]
xor r8b, byte [rcx + rdi + 0x101610]
lea rdx, [r11 + rax*4]
movzx eax, byte [r10 + 0xa]
mov byte [rsp + r11 + 8], r8b
movzx r8d, byte [rdx + rdi + 0x100a10]
lea rcx, [r11 + rax*4]
xor r8b, byte [rcx + rdi + 0x100e10]
movzx eax, byte [r10 + 9]
lea rcx, [r11 + rax*4]
movzx eax, byte [r10 + 8]
xor r8b, byte [rcx + rdi + 0x101210]
lea rcx, [r11 + rax*4]
inc r11
xor r8b, byte [rcx + rdi + 0x101610]
cmp r11, 4
mov byte [rsp + r11 + 0xb], r8b
jl 0x18003bba0
lea rcx, [rsp]
add r9, 0x10
add r10, 0x10
sub rbx, 1
mov rax, qword [rcx]
mov qword [r9 - 0x10], rax
mov rax, qword [rcx + 8]
mov qword [r9 - 8], rax
jne 0x18003bb90
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.180062100
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18003c530
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x58]
mov rbx, rcx
mov dword [rcx + 0x3c], 2
mov ecx, dword [0x1800fbf64]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x18003c565
mov rdi, qword [rax + 8]
mov r8, qword gs:[0x20]
xor ecx, ecx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], ecx
mov rcx, rdi
mov qword [rax + 0x10], r8
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x18003c5a3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x28]
cmp rcx, rdx
jbe 0x18003c5c2
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x38]
add rax, rcx
cmp rax, rdx
jbe 0x18003c5b0
movsxd rax, ecx
mov rcx, qword [rbx + 0x30]
sub rcx, rax
movsxd rax, edx
add rcx, rax
mov qword [rsi], rcx
mov eax, dword [rbx + 0x38]
mov rsi, qword [rsp + 0x38]
sub eax, edx
add eax, dword [rbx + 0x28]
mov ecx, eax
add rcx, rdx
mov qword [rbx + 0x18], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18003c610
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x58]
mov rdi, rcx
mov qword [rcx + 0x40], rdx
mov dword [rcx + 0x3c], 3
mov dword [rcx + 0x48], r8d
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x18003c645
mov rbx, qword [rax + 8]
mov rdx, qword gs:[0x20]
xor ecx, ecx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], ecx
mov rcx, rbx
mov qword [rax + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x18003c683
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov eax, dword [rdi + 0x48]
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 0xfffffffb
add rsp, 0x20
pop rdi
ret
Function at 0x18003c720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x20020]
jmp 0x18003c720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x180104068]
xor r15d, r15d
mov r13, r9
mov r14, r8
mov r12d, r15d
call fcn.18003feb0
mov qword [rbx + 0x58], rax
cmp qword [rbx + 0x20], rbp
jbe 0x18003c7e3
cmp dword [rbx + 0x3c], 1
je 0x18003c785
mov rdx, qword [rbx + 0x50]
lea rcx, [0x180104068]
xor r9d, r9d
xor r8d, r8d
call fcn.180040200
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov ecx, dword [0x1800fbf64]
mov rdi, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rdi, rdi
jne 0x18003c7a6
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x18003c7e3
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov eax, dword [rbx + 0x3c]
cmp eax, 2
jne 0x18003c809
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x38]
mov qword [rbx + 0x28], rdx
mov rax, qword [rcx]
lea r8, [rbx + 0x30]
call qword [rax]
mov r12d, eax
jmp 0x18003c78d
cmp eax, 3
jne 0x18003c828
movsxd rdx, dword [rbx + 0x48]
add rdx, qword [rbx + 0x20]
cmp rdx, rbp
ja 0x18003c828
mov qword [rbx + 0x20], rdx
mov dword [rbx + 0x48], r15d
jmp 0x18003c78d
mov edi, r15d
mov rsi, r15
test r12d, r12d
jne 0x18003c856
cmp eax, 1
jne 0x18003c83e
lea r12d, [rax + 0xa]
jmp 0x18003c856
movsxd rax, dword [rbx + 0x20]
mov edi, dword [rbx + 0x48]
mov rsi, qword [rbx + 0x40]
sub edi, ebp
sub rsi, rax
add edi, eax
movsxd rax, ebp
add rsi, rax
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x18003c888
mov ecx, dword [0x1800fbf64]
xor edx, edx
mov dword [rax], r15d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x180103c60]
test r11, r11
je 0x18003c888
call r11
lea r11, [rsp + 0x50]
mov qword [rbx + 0x58], r15
mov qword [r14], rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r13], edi
mov eax, r12d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18003db60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov rsi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
or ecx, 0xffffffff
call fcn.18003b270
mov word [rbx + 0x214], ax
shr eax, 0x10
mov word [rbx + 0x216], ax
xor eax, eax
mov word [rbx + 0x21a], ax
mov word [rbx + 0x218], ax
mov byte [rbx + 0x21e], al
mov byte [rbx + 0x21d], al
mov byte [rbx + 0x21c], al
movzx ecx, byte [rsi]
test cl, cl
je 0x18003dc19
lea rdi, [0x180100610]
add byte [rbx + 0x21c], cl
xor byte [rbx + 0x21d], cl
movzx eax, byte [rbx + 0x21e]
add al, cl
movzx edx, cl
movzx ecx, cl
rol al, 1
inc rsi
mov byte [rbx + 0x21e], al
movzx eax, cx
xor ax, word [rdi + rdx*4]
xor word [rbx + 0x218], ax
movzx eax, word [rdi + rdx*4 + 2]
add ax, cx
add word [rbx + 0x21a], ax
mov cl, byte [rsi]
test cl, cl
jne 0x18003dbd0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18003feb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x180103c4d], 0
mov rsi, rdx
jne 0x18003fecb
call fcn.18003fe10
mov ecx, dword [0x1800fbf64]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18003fef3
inc dword [rax + 4]
mov rax, qword [rax + 8]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x12c
mov rax, qword [0x180103c68]
test rax, rax
je 0x18003ff2e
mov edx, 1
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
jne 0x18003ff51
xor edx, edx
xor ecx, ecx
call qword [0x180103c68]
mov rbx, rax
jmp 0x18003ff39
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rbx, rax
test rbx, rbx
jne 0x18003ff51
inc edi
cmp edi, ebp
cmova edi, ebp
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x18003ff02
mov ecx, dword [0x1800fbf64]
mov rdx, rsi
mov dword [rsi], 0x54626966
mov dword [rsi + 4], 1
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800400a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
lea rdx, [rsp + 0x48]
lea rcx, [0x180104068]
mov rbx, r8
call fcn.18003feb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x18003c6a0]
mov qword [rsp + 0x38], rax
mov rax, qword [0x180103c58]
test rax, rax
je 0x18004012c
lea rcx, [rsp + 0x30]
mov edx, 0x4000
lea r9, [0x18003ffb0]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov r8d, 1
call rax
mov rbx, rax
test rax, rax
jne 0x18004014b
lea rax, [rsp + 0x30]
mov edx, 0x4000
lea r9, [0x18003ffb0]
mov rcx, rdx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [0x180103c58]
mov rbx, rax
jmp 0x180040146
lea r8, [rsp + 0x30]
lea rdx, [0x18003ffb0]
mov ecx, 0x4000
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rbx, rax
test rbx, rbx
je 0x1800401b7
mov ecx, dword [0x1800fbf64]
mov qword [rsp + 0x80], rdi
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
jne 0x18004016b
mov rdi, qword [rax + 8]
mov rdx, qword gs:[0x20]
mov rcx, rdi
mov qword [rax + 0x18], 0
mov qword [rax + 0x10], rdx
mov dword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1800401b7
mov edx, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
call r8
mov ecx, dword [0x1800fbf64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [rax + 4], 0xffffffff
jne 0x1800401ec
mov ecx, dword [0x1800fbf64]
xor edx, edx
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [0x180103c60]
test r11, r11
je 0x1800401ec
call r11
mov rax, rbx
add rsp, 0x70
pop rbx
ret