joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015750
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x140023d60]
mov edx, 8
mov r8d, 0x250
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140024a50]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x140024a60], rdi
and dword [rdi + 0x11c], 0
or eax, 0xffffffff
mov edx, ebx
mov rcx, rdi
mov dword [rdi + 0x118], 0xffffff
mov dword [rdi + 0xe8], 2
mov dword [rdi + 0xec], 0x3f
mov dword [rdi + 0x120], eax
mov dword [rdi + 0x124], eax
call fcn.14001ead8
mov rbx, qword [rsp + 0x30]
lea rax, [0x140015704]
lea r11, [0x1400156a0]
mov qword [rdi + 0xb8], rax
lea rax, [fcn.140014364]
mov qword [rdi + 0xb0], r11
mov qword [rdi + 0x20], rax
lea rax, [0x140014540]
mov qword [rdi + 0x60], rax
lea rax, [0x140014694]
mov qword [rdi + 0xc8], rax
lea rax, [0x1400146f0]
mov qword [rdi + 0xc0], rax
lea rax, [0x140015124]
mov qword [rdi + 0x68], rax
lea rax, [0x140014f58]
mov qword [rdi + 0x48], rax
lea rax, [0x140014f84]
mov qword [rdi + 0x50], rax
lea rax, [0x140014fb4]
mov qword [rdi + 0x58], rax
lea rax, [0x1400154bc]
mov qword [rdi + 0x88], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140017140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
push r15
mov r10d, dword [rsp + 0x68]
movsxd rbp, dword [rcx + 0x160]
mov ebx, r8d
mov r14, rdx
mov r11, rcx
test r10d, r10d
je 0x14001720a
mov eax, dword [rsp + 0x50]
mov ecx, ebx
mov r12d, ebx
shl eax, 2
imul ecx, dword [rsp + 0x58]
movsxd r15, eax
mov eax, ebp
imul eax, r9d
mov r9d, dword [rsp + 0x48]
neg r12d
movsxd rdi, eax
mov qword [rsp + 0x28], rdi
mov eax, dword [r11 + 0x158]
movsxd r8, ecx
add r8, r15
add r8, r14
imul eax, r9d
movsxd rdx, eax
add rdx, qword [r11 + 0x150]
add rdx, rdi
cmp dword [rsp + 0x60], 0
jle 0x1400171ee
mov edi, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
add r8, 4
xor byte [rdx], al
add rdx, rbp
dec rdi
jne 0x1400171ca
mov rdi, qword [rsp + 0x28]
dec r10d
inc r9d
cmp dword [r11 + 0x174], 0
jne 0x140017203
add ecx, r12d
jmp 0x140017205
add ecx, ebx
test r10d, r10d
jne 0x14001719e
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r14
pop r12
pop rdi
ret
Function at 0x14001880c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
push r15
mov r11d, dword [rsp + 0x68]
movsxd rbp, dword [rcx + 0x160]
mov r14, rdx
mov ebx, r8d
mov rdx, rcx
test r11d, r11d
je 0x1400188d8
mov eax, dword [rsp + 0x50]
mov ecx, ebx
mov r12d, ebx
lea r10d, [rax + rax*2]
mov eax, ebp
imul ecx, dword [rsp + 0x58]
movsxd r15, r10d
mov r10d, dword [rsp + 0x48]
imul eax, r9d
movsxd rdi, eax
neg r12d
mov qword [rsp + 0x28], rdi
mov eax, dword [rdx + 0x158]
movsxd r9, ecx
add r9, r15
add r9, r14
imul eax, r10d
movsxd r8, eax
add r8, qword [rdx + 0x150]
add r8, rdi
cmp dword [rsp + 0x60], 0
jle 0x1400188bd
mov edi, dword [rsp + 0x60]
mov al, byte [r9 + 2]
xor byte [r8 + 2], al
mov al, byte [r9 + 1]
xor byte [r8 + 1], al
mov al, byte [r9]
add r9, 3
xor byte [r8], al
add r8, rbp
dec rdi
jne 0x140018896
mov rdi, qword [rsp + 0x28]
dec r11d
inc r10d
cmp dword [rdx + 0x174], 0
jne 0x1400188d1
add ecx, r12d
jmp 0x1400188d3
add ecx, ebx
test r11d, r11d
jne 0x14001886b
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r14
pop r12
pop rdi
ret
Function at 0x140f6e78c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f6e796
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f6e7bf
pop rbp
sub rbp, 0x33
sub rbp, 0xf6e78c
sub rsp, 0x20
jmp 0x140f6e7de
mov rax, 0xf6e78c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffd6eb25eb
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f6e7fd
invalid
jmp 0x140f6e814
movabs dword [0xebebebd762600262], eax
movabs dword [0xeaa3ebebeae32a6a], eax
add ah, byte [rbx - 0x1413d4d4]
jmp 0x140f6e819
xlatb
jmp 0x140f6e807
Function at 0x180004680
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x201
mov eax, 2
mov r12, 0xffffffffffffffff
mov esi, 0x200
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180041b14
mov r8, qword [rbp + 8]
mov edx, esi
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
lea ecx, [rax + 2]
cmp ecx, esi
jb 0x180004720
nop dword [rax]
mov rcx, rdi
add esi, 0x200
call fcn.180042a5c
lea ecx, [rsi + 1]
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180041b14
mov r8, qword [rbp + 8]
mov edx, esi
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
add eax, 2
cmp eax, esi
jae 0x1800046e0
mov rcx, rdi
call fcn.180042a5c
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
lea eax, [rbx + 2]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret

Function at 0x180004750
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rsi, r8
mov rbx, rdx
mov r13, rcx
test rdx, rdx
je 0x18000483b
mov ecx, 0x201
mov eax, 2
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x50], rbp
mov edi, 0x200
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180041b14
mov rcx, qword [r13 + 8]
test rsi, rsi
mov rbp, rax
mov qword [rsp + 0x28], rcx
lea rax, [0x1800641fc]
cmove rsi, rax
lea rcx, str.basic
mov rdx, rbx
mov r9, rbp
mov r8, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
inc eax
cmp eax, edi
jb 0x180004831
nop dword [rax]
mov rcx, rbp
add edi, 0x200
call fcn.180042a5c
lea ecx, [rdi + 1]
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180041b14
lea rcx, str.basic
mov r8, rsi
mov rbp, rax
mov rax, qword [r13 + 8]
mov rdx, rbx
mov qword [rsp + 0x28], rax
mov r9, rbp
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
inc eax
cmp eax, edi
jae 0x1800047e0
mov rax, rbp
mov rbp, qword [rsp + 0x50]
jmp 0x18000489b
test r8, r8
jne 0x180004853
lea ecx, [r8 + 2]
call fcn.180041b14
mov rbx, rax
xor eax, eax
mov word [rbx], ax
jmp 0x180004898
xor eax, eax
or r12, 0xffffffffffffffff
mov rdi, r8
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, 2
not rcx
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180041b14
mov rcx, r12
mov rdi, rsi
mov rbx, rax
xor eax, eax
mov r8, rsi
repne scasw ax, word [rdi]
not rcx
mov rdx, rcx
mov rcx, rbx
call fcn.180042e20
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x18001c7a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor edi, edi
mov r15, r9
mov r12, r8
mov r14, rdx
mov rbx, rcx
cmp r8, 0xffffffffffffffff
jne 0x18001c7de
mov dword [rcx + 0x10], edi
mov dword [rcx], 1
mov qword [rcx + 8], rdi
mov rax, rcx
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
xor edx, edx
mov rcx, r8
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x80], edi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test rsi, rsi
jns 0x18001c80e
mov dword [rbx + 0x10], edi
mov dword [rbx], 2
mov qword [rbx + 8], rdi
jmp 0x18001c8c2
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x88], r13
lea r13, [rsi + 1]
mov rcx, r13
call qword [0x1800a2518]
mov rbp, rax
test rax, rax
jne 0x18001c83f
mov dword [rbx + 0x10], edi
mov dword [rbx], 3
mov qword [rbx + 8], rdi
jmp 0x18001c8b5
lea r9, [rsp + 0x80]
mov r8d, esi
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x80]
mov rcx, rbp
cmp r11, rsi
je 0x18001c880
call qword [0x1800a2520]
mov dword [rbx + 0x10], edi
mov dword [rbx], 2
mov qword [rbx + 8], rdi
jmp 0x18001c8b5
mov rdx, rsi
call fcn.18001b300
cmp eax, 1
jne 0x18001c893
mov byte [rsi + rbp], dil
jmp 0x18001c896
mov r13, rsi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov r9, rbp
mov r8, r14
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x20], r13
call fcn.18001c650
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x88]
mov rax, rbx
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x18001ddb0
Capabilities:
Create thread
Resume thread

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x180074808]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rcx, [0x1800a4798]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x1800a4740]
cmp r11d, 2
je 0x18001de0a
lea rcx, [0x1800a4798]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180041e80
add rsp, 0xe8
ret
lock inc dword [0x1800a3b48]
mov r9d, dword [0x1800a3b48]
lea r8, str.Pool_d
lea rcx, [0x1800a4538]
mov edx, pe_nt_image_headers64
call fcn.180041ea0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1800a4738], rax
test rax, rax
je 0x18001dde3
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rsi
xor esi, esi
cmp dword [0x1800a4530], esi
mov qword [rsp + 0xe0], rdi
jle 0x18001df68
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str.PID:_d_IID:_d_TDX:_d
lea rcx, [rsp + 0x90]
mov r9d, eax
mov eax, dword [0x1800a3b48]
mov edx, 0x1e
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call fcn.180041ea0
lea r11, [rsp + 0x30]
lea r9, [0x1800a44f0]
lea r8, [0x18001d9a0]
mov qword [rsp + 0x28], r11
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call fcn.180044078
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001dfb8
mov edi, dword [rsp + 0x30]
test rax, rax
je 0x18001dfb8
xor r8d, r8d
lea r9, [rsp + 0x90]
xor ecx, ecx
lea edx, [r8 + 1]
mov byte [rsp + 0x60], 1
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x38]
lea rcx, [0x1800a4510]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
call fcn.18001f860
lea rdx, [rsp + 0x80]
lea rcx, [0x1800a4510]
mov r8, rax
call fcn.18001f290
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
inc esi
cmp esi, dword [0x1800a4530]
jl 0x18001de74
mov byte [0x1800a47c0], 1
lea rcx, [0x1800a4798]
mov dword [0x1800a4740], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov rsi, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180041e80
add rsp, 0xe8
ret
lea rcx, [0x1800a4798]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
jmp 0x18001df88
Function at 0x18001e180
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1800a4740]
cmp eax, 1
je 0x18001e2b3
mov eax, dword [0x1800a4740]
cmp eax, 2
je 0x18001e2b3
lea rcx, [0x1800a4770]
mov qword [rsp + 0x30], rbx
mov dword [0x1800a4740], 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x1800a4518]
mov rbx, qword [r11]
xor edi, edi
cmp rbx, r11
je 0x18001e26b
nop dword [rax + rax]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x18001e1ff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], rdi
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 0x41], dil
jne 0x18001e25e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x41], dil
jne 0x18001e23e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], dil
jne 0x18001e25e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], dil
je 0x18001e230
jmp 0x18001e25e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x41], dil
jne 0x18001e25b
cmp rbx, qword [rax + 0x10]
jne 0x18001e25b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x41], dil
je 0x18001e248
mov rbx, rax
cmp rbx, qword [0x1800a4518]
jne 0x18001e1e0
lea rcx, [0x1800a4770]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1800a4738]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1800a44f0]
mov qword [0x1800a4738], rdi
call fcn.18001e0a0
lock dec dword [0x1800a3b48]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov dword [0x1800a4740], 2
add rsp, 0x28
ret
Function at 0x18001e3e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x50
lea r12, [rcx + 0x280]
mov rbx, rcx
mov edi, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rbx + 0x28]
lea rsi, [rbx + 0x20]
mov rax, qword [rdx + 8]
cmp byte [rax + 0x41], 0
jne 0x18001e437
nop dword [rax]
cmp dword [rax + 0x18], edi
jae 0x18001e42b
mov rax, qword [rax + 0x10]
jmp 0x18001e431
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x18001e420
mov rcx, qword [rsi + 8]
mov qword [rbp + 0x20], rdx
cmp rdx, rcx
je 0x18001e44f
cmp edi, dword [rdx + 0x18]
jb 0x18001e44f
lea rax, [rbp + 0x20]
jmp 0x18001e457
mov qword [rbp + 0x30], rcx
lea rax, [rbp + 0x30]
mov rax, qword [rax]
cmp rax, qword [rbx + 0x28]
jne 0x18001e47b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str._ResetWait__No_matching_thread_found.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18001e55e
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x41], 0
jne 0x18001e49f
cmp dword [rax + 0x18], edi
jae 0x18001e493
mov rax, qword [rax + 0x10]
jmp 0x18001e499
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x18001e488
cmp rbx, rcx
je 0x18001e4a9
cmp edi, dword [rbx + 0x18]
jae 0x18001e4e0
xor edx, edx
mov rcx, rsi
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rdx
lea rdx, [rbp - 0x30]
call fcn.18001f860
lea rdx, [rbp + 0x20]
mov r8, rbx
mov r9, rax
mov rcx, rsi
call fcn.18001f3b0
mov rbx, qword [rbp + 0x20]
mov byte [rbx + 0x20], 1
mov rbx, qword [rsi + 8]
mov rax, qword [rbx + 8]
cmp byte [rax + 0x41], 0
jne 0x18001e509
cmp dword [rax + 0x18], edi
jae 0x18001e4fd
mov rax, qword [rax + 0x10]
jmp 0x18001e503
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x18001e4f2
cmp rbx, qword [rsi + 8]
je 0x18001e514
cmp edi, dword [rbx + 0x18]
jae 0x18001e54b
xor edx, edx
mov rcx, rsi
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rdx
lea rdx, [rbp - 0x30]
call fcn.18001f860
lea rdx, [rbp + 0x20]
mov r8, rbx
mov r9, rax
mov rcx, rsi
call fcn.18001f3b0
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r12
pop rdi
pop rbp
ret
Function at 0x18001e580
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbp, rcx
add rcx, 0x280
mov edi, edx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rbp + 0x28]
mov rax, qword [rdx + 8]
cmp byte [rax + 0x41], 0
jne 0x18001e5c7
nop dword [rax]
cmp dword [rax + 0x18], edi
jae 0x18001e5bb
mov rax, qword [rax + 0x10]
jmp 0x18001e5c1
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x18001e5b0
mov rcx, qword [rbp + 0x28]
mov qword [rsp + 0x70], rdx
cmp rdx, rcx
je 0x18001e5e1
cmp edi, dword [rdx + 0x18]
jb 0x18001e5e1
lea rax, [rsp + 0x70]
jmp 0x18001e5f1
mov qword [rsp + 0x80], rcx
lea rax, [rsp + 0x80]
mov rax, qword [rax]
cmp rax, qword [rbp + 0x28]
jne 0x18001e625
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.No_matching_thread_found.
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r12
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x78], rbx
mov rbx, rcx
cmp byte [rax + 0x41], 0
jne 0x18001e64e
cmp dword [rax + 0x18], edi
jae 0x18001e642
mov rax, qword [rax + 0x10]
jmp 0x18001e648
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x18001e637
cmp rbx, rcx
je 0x18001e658
cmp edi, dword [rbx + 0x18]
jae 0x18001e699
xor edx, edx
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x20]
call fcn.18001f860
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x20]
mov r9, rax
mov r8, rbx
call fcn.18001f3b0
mov rbx, qword [rsp + 0x70]
mov byte [rbx + 0x20], 1
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp + 0x280]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r12
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1800209d0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x180074808]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rcx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.18004a690
xor edx, edx
lea r8, str.Global3E03F8F9_DB26_4111_AADB_8F7EFF68F7BD
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x180020abf
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x180020ab6
lea rcx, [rsp + 0x30]
mov r8, rax
mov edx, 0x104
call fcn.180044724
xor r11d, r11d
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], r11d
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x180020aad
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x30]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x180020aad
mov eax, 1
jmp 0x180020ac1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180041e80
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18002e8c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test ebx, ebx
je 0x18002ea53
dec ebx
je 0x18002e92d
cmp ebx, 2
jne 0x18002eaa6
mov ecx, dword [0x180076860]
cmp ecx, 0xffffffff
je 0x18002eaa6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002eaa6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [0x180076860]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x1800a3b4c], 0
mov qword [0x1800a3b40], rdi
je 0x18002e94a
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18006448b]
mov ecx, 2
call fcn.180046198
lea rdx, [0x1800a3d70]
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [0x1800a3d70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [0x1800a3f80]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x1800a4190]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [0x1800a3d60], rdi
call fcn.180033a70
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x180076860], eax
cmp eax, 0xffffffff
je 0x18002e93d
cmp qword [reloc.WS2_32.dll_getsockopt], 8
lea rbx, [0x1800a1c80]
mov rcx, rbx
cmovae rcx, qword [0x1800a1c80]
call fcn.18000aa70
lea rcx, [0x1800a3d70]
call fcn.180004a70
xor ecx, ecx
call fcn.18000aa70
call fcn.180038d50
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae rbx, qword [0x1800a1c80]
mov rcx, rbx
call fcn.1800017d0
lea rcx, [0x1800a3f80]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
call fcn.180001700
test eax, eax
jne 0x18002eaa6
cmp dword [0x1800a3b4c], eax
jne 0x18002ea3e
call fcn.180034130
call fcn.18001ddb0
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x180076860]
mov dword [0x1800a3b4c], 1
cmp ecx, 0xffffffff
je 0x18002ea9c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002ea90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [0x180076860]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x180076860]
call qword [sym.imp.KERNEL32.dll_TlsFree]
call fcn.18001e180
call fcn.180039cb0
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18002ebf0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rsi
sub rsp, 0x80
xor ebx, ebx
cmp dword [0x1800a4908], 0x20
mov esi, ebx
jae 0x18002ed49
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rdi
lea rdi, [rcx + rdx]
mov eax, 0x80000000
cmp rdi, rax
jae 0x18002ec2b
lea edi, [rbx + 1]
jmp 0x18002ec32
sub rdi, 0x7fff0000
lea rbp, [rcx + r8]
cmp rbp, 0xffffffff80000000
jae 0x18002ec48
add rbp, 0x7ff80000
jmp 0x18002ec4f
mov rbp, 0xfffffffffff80000
xor edx, edx
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x50], ebx
lea r8d, [rdx + 0x2c]
call fcn.18004a690
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp rdi, rbp
jae 0x18002ed17
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18002ecf7
cmp dword [rsp + 0x40], 0x10000
jne 0x18002ece5
mov rax, qword [rsp + 0x38]
cmp rax, 0x78
jb 0x18002ecea
mov edx, dword [rsp + 0x78]
mov ecx, edx
cmp rax, rdx
jb 0x18002ecea
lea eax, [rdx - 1]
xor edx, edx
mov r8d, 0x3000
add rax, rdi
div rcx
mov edx, 0x78
lea r9d, [rdx - 0x58]
imul rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18002ecfc
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
add rdi, rax
cmp rdi, rbp
jb 0x18002ec80
test rsi, rsi
je 0x18002ed17
lea rcx, [0x1800a4808]
mov rax, rcx
cmp qword [rax], 0
je 0x18002ed3b
inc ebx
add rax, 8
cmp ebx, 0x20
jb 0x18002ed06
mov rbp, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rax, rsi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rsi
ret
mov eax, ebx
mov qword [rcx + rax*8], rsi
inc dword [0x1800a4908]
jmp 0x18002ed17
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rsi
ret