joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180067498
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov edi, 0x400
xor ebx, ebx
mov ecx, edi
call fcn.1800686e8
mov r14, rax
test rax, rax
je 0x180067615
xor edx, edx
lea r8d, [rbx + 0x38]
lea rcx, [rbp - 0x71]
call fcn.1800abaa0
lea r9, [rbp - 0x79]
mov rcx, r14
lea r8, [rbp - 0x71]
call fcn.180066f60
test eax, eax
je 0x18006760d
mov eax, dword [rbp - 0x79]
mov ebx, 1
lea ecx, [rbx + 0x7f]
cmp eax, ecx
cmovb eax, ecx
lea esi, [rax + rax]
mov eax, esi
cmp esi, edi
jbe 0x180067523
mov esi, edi
mov eax, edi
mov ecx, eax
call fcn.1800686e8
mov rdi, rax
test rax, rax
je 0x18006760d
lea r9, [rbp - 0x79]
mov edx, esi
lea r8, [rbp - 0x71]
mov rcx, rax
call fcn.180067260
test eax, eax
je 0x180067605
mov r8d, dword [rbp - 0x79]
lea rcx, [rbp - 0x39]
and dword [rbp - 0x25], 0
mov rdx, rdi
and dword [rbp - 0x29], 0
mov dword [rbp - 0x39], 0x67452301
mov dword [rbp - 0x35], 0xefcdab89
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
call fcn.180069ff4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x27]
call fcn.18006a0b4
mov r9d, dword [rbp - 0x49]
lea rax, [0x1800fee50]
mov r8, qword [rbp - 0x41]
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x79], 0x10
call fcn.1800684e8
test eax, eax
jne 0x180067605
mov rax, qword [rbp + 0x27]
cmp rax, qword [rbp + 0x37]
jne 0x180067605
mov rax, qword [rbp + 0x2f]
cmp rax, qword [rbp + 0x3f]
jne 0x180067605
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x180067600
lea rdx, [rbp - 0x79]
call fcn.180069e04
test eax, eax
je 0x180067605
cmp qword [rbp - 0x79], 0
je 0x180067600
lea rcx, [rbp - 0x79]
call fcn.180067460
mov ebx, 2
test eax, eax
jne 0x180067605
mov ebx, 3
mov rcx, rdi
call fcn.1800aea38
mov rcx, r14
call fcn.1800aea38
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180067654
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb8
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rdi, qword [rbp + 0x7f]
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
mov r14, r9
lea rax, [rbp - 0x5d]
mov dword [rbp - 0x51], 0x67452301
xor ebx, ebx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x51]
mov qword [rbp - 0x41], rbx
mov esi, r8d
mov dword [rbp - 0x4d], 0xefcdab89
mov r15, rdx
mov dword [rbp - 0x49], 0x98badcfe
mov dword [rbp - 0x45], 0x10325476
call fcn.180069a74
test eax, eax
jne 0x1800676c7
jmp 0x1800676fb
test esi, esi
je 0x1800676da
mov r8d, esi
lea rcx, [rbp - 0x51]
mov rdx, r15
call fcn.180069ff4
lea rdx, [rbp - 0x51]
mov rcx, r14
call fcn.18006a0b4
test rdi, rdi
je 0x1800676f6
mov eax, dword [rbp - 0x61]
cmp dword [rbp - 0x5d], eax
sete bl
mov dword [rdi], ebx
mov eax, 1
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.18008f850
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x180067718
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov eax, dword [rcx + 8]
mov r14d, 1
and dword [rsp + 0x64], 0
mov rbx, rcx
and dword [rsp + 0x60], 0
mov rsi, rdx
mov qword [rcx + 0xcd4], rax
mov dword [rcx + 0xce0], r14d
mov dword [rcx + 0xce4], r14d
mov dword [rcx + 0xcdc], 4
mov eax, dword [rcx + 0xc]
and dword [rcx + 0xcfc], 0
mov qword [rcx + 0xcec], rax
mov dword [rcx + 0xcf4], 8
mov dword [rcx + 0xcf8], r14d
mov eax, dword [rcx + 0x20]
and dword [rcx + 0xd0c], 0
and dword [rcx + 0xd14], 0
mov qword [rcx + 0xd04], rax
mov dword [rcx + 0xd10], r14d
lea ecx, [r14 + 0x47]
mov dword [rsp + 0x50], 0x67452301
mov dword [rsp + 0x54], 0xefcdab89
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x5c], 0x10325476
call fcn.1800686e8
mov rdi, rax
test rax, rax
jne 0x1800677f9
lea r8, [0x1800f7d08]
xor edx, edx
mov r9, r8
xor ecx, ecx
call fcn.1800689dc
jmp 0x180067877
movups xmm0, xmmword [rbx + 0xcd4]
lea r9, [0x180067640]
mov r8d, 3
mov rdx, rdi
mov rcx, rbx
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0xce4]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rbx + 0xcf4]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rbx + 0xd04]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [rbx + 0xd14]
movsd qword [rax + 0x40], xmm0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.180069498
mov rcx, rdi
mov ebx, eax
call fcn.1800aea38
test ebx, ebx
jne 0x18006787b
xor eax, eax
jmp 0x18006788b
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.18006a0b4
mov eax, r14d
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret
Function at 0x1800678b0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
and qword [rbp - 0x29], 0
lea rbx, [rcx + 0xcd4]
xor esi, esi
mov dword [rbp - 0x49], 0x6a09e667
mov r15, rdx
mov rdi, rcx
mov dword [rbp - 0x45], 0xbb67ae85
mov dword [rbp - 0x41], 0x3c6ef372
lea edx, [rsi + 1]
mov dword [rbp - 0x3d], 0xa54ff53a
mov dword [rbp - 0x39], 0x510e527f
mov dword [rbp - 0x35], 0x9b05688c
mov dword [rbp - 0x31], 0x1f83d9ab
mov dword [rbp - 0x2d], 0x5be0cd19
cmp byte [rcx + 0xa4], sil
jne 0x180067959
cmp byte [rcx + 0xa6], sil
je 0x180067959
mov eax, dword [rcx + 0xa8]
test eax, eax
je 0x180067959
and dword [rbx + 0x10], esi
mov esi, edx
mov qword [rbx], rax
mov dword [rbx + 8], 0x90
mov dword [rbx + 0xc], edx
mov eax, esi
add esi, edx
lea rcx, [rax + rax*2]
mov eax, dword [rdi + 8]
and dword [rbx + rcx*8 + 0x10], 0
mov qword [rbx + rcx*8], rax
mov dword [rbx + rcx*8 + 8], 4
mov dword [rbx + rcx*8 + 0xc], edx
lea rcx, [rsi + rsi*2]
mov eax, dword [rdi + 0xc]
add esi, edx
and dword [rbx + rcx*8 + 0x10], 0
mov qword [rbx + rcx*8], rax
mov dword [rbx + rcx*8 + 8], 8
mov dword [rbx + rcx*8 + 0xc], edx
lea rcx, [rsi + rsi*2]
mov eax, dword [rdi + 0xac]
add esi, edx
mov qword [rbx + rcx*8], rax
mov eax, dword [rdi + 0xb0]
and dword [rbx + rcx*8 + 0x10], 0
mov dword [rbx + rcx*8 + 8], eax
mov dword [rbx + rcx*8 + 0xc], edx
lea rcx, [rsi + rsi*2]
mov eax, dword [rdi + 0xb4]
add esi, edx
and dword [rbx + rcx*8 + 8], 0
and dword [rbx + rcx*8 + 0x10], 0
mov qword [rbx + rcx*8], rax
lea eax, [rsi + rsi*2]
mov dword [rbx + rcx*8 + 0xc], edx
shl eax, 3
mov ecx, eax
mov r12d, eax
call fcn.1800686e8
mov r14, rax
test rax, rax
jne 0x180067a05
lea r8, [0x1800f7d08]
xor edx, edx
mov r9, r8
xor ecx, ecx
call fcn.1800689dc
jmp 0x180067a41
mov r8, r12
mov rdx, rbx
mov rcx, r14
call fcn.1800ab630
lea rax, [rbp - 0x59]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, r14
lea rax, [rbp - 0x49]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180069670
mov rcx, r14
mov ebx, eax
call fcn.1800aea38
test ebx, ebx
jne 0x180067a45
xor eax, eax
jmp 0x180067a56
mov rdx, r15
lea rcx, [rbp - 0x49]
call fcn.18006ad58
mov eax, 1
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180068b54
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rsi, r8
xor r9d, r9d
xor r8d, r8d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180068bbd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180068bbd
cmp ebx, dword [rsp + 0x48]
je 0x180068bb6
xor edx, edx
lea r9, [0x1800f7d08]
xor ecx, ecx
lea r8d, [rdx + 1]
call fcn.180068b40
jmp 0x180068bd4
mov eax, 1
jmp 0x180068bd6
lea r9, [0x1800f7d08]
xor edx, edx
lea r8, [0x1800f7d08]
xor ecx, ecx
call fcn.1800689dc
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180068be8
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180068c0d
lea r8, [0x1800f7d08]
xor edx, edx
mov r9, r8
xor ecx, ecx
call fcn.1800689dc
xor eax, eax
jmp 0x180068c12
mov eax, 1
add rsp, 0x28
ret
Function at 0x18006ad58
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, qword [rcx + 0x20]
mov rsi, rdx
mov edi, dword [rcx + 0x20]
mov rbx, rcx
shl r14, 3
and edi, 0x3f
mov byte [rdi + rcx + 0x28], 0x80
jmp 0x18006ad9e
and edi, 0x3f
jne 0x18006ad99
mov rcx, rbx
call fcn.18006ac5c
mov byte [rdi + rbx + 0x28], 0
inc edi
cmp edi, 0x38
jne 0x18006ad8c
lea ebp, [rdi - 0x30]
mov edx, ebp
mov rcx, r14
shl r14, 8
shr rcx, 0x38
mov byte [rdi + rbx + 0x28], cl
inc edi
sub rdx, 1
jne 0x18006adaa
mov rcx, rbx
call fcn.18006ac5c
mov rcx, rbx
mov al, byte [rcx + 3]
mov byte [rsi], al
lea rsi, [rsi + 4]
mov al, byte [rcx + 2]
mov byte [rsi - 3], al
mov eax, dword [rcx]
shr eax, 8
mov byte [rsi - 2], al
mov al, byte [rcx]
lea rcx, [rcx + 4]
mov byte [rsi - 1], al
sub rbp, 1
jne 0x18006adcc
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
and qword [rbx + 0x20], rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x18006b118
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x70
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor esi, esi
mov ebp, edx
and dword [rsp + 0x40], esi
mov r14, rcx
test rcx, rcx
je 0x18006b240
test edx, edx
je 0x18006b240
mov r12d, 0x2800
mov ecx, r12d
call fcn.1800686e8
mov rbx, rax
test rax, rax
je 0x18006b240
xor edi, edi
mov r9d, edi
lea r8, str..PhysicalDrive_d
mov rdx, r12
mov rcx, rbx
call fcn.180069ca4
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180069dac
test eax, eax
je 0x18006b229
and dword [rsp + 0x58], 0
mov r8, r12
and dword [rsp + 0x50], 0
xor edx, edx
and dword [rsp + 0x54], 0
mov rcx, rbx
call fcn.1800abaa0
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov r9d, 0xc
mov dword [rsp + 0x28], r12d
mov edx, 0x2d1400
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18006b21a
cmp dword [rbx + 0x18], 0
jbe 0x18006b21a
mov r9d, dword [rbx + 0x18]
lea rcx, str.DISKID:
add r9, rbx
mov r8d, ebp
mov rdx, r14
call fcn.18006af3c
mov esi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x18006b234
inc edi
cmp edi, 0x10
jl 0x18006b16f
mov rcx, rbx
call fcn.1800aea38
mov eax, esi
jmp 0x18006b243
or eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006b328
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor ebx, ebx
mov r14, rcx
mov esi, ebx
test rcx, rcx
je 0x18006b4f2
test edx, edx
je 0x18006b4f2
mov ecx, 0x200
call fcn.1800686e8
mov rdi, rax
test rax, rax
je 0x18006b4f2
lea rax, [rbp - 0x18]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006b4e6
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x48]
mov qword [rsp + 0x38], rbx
mov r8, rdi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
mov r15d, ebx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18006b49f
mov r14, 0xffffffff80000002
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
test rcx, rcx
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
mov rdx, rdi
cmove rcx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006b461
lea rcx, [rbp + 0x40]
mov dword [rbp + 0x50], 1
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 4]
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x50]
xor r8d, r8d
mov dword [rbp + 0x48], 0x200
lea rdx, str.ServiceName
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006b457
mov rcx, rdi
mov dword [rdi], 0x5c2e5c5c
call fcn.18006b264
cmp rax, rsi
cmova rsi, rax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x48]
mov qword [rsp + 0x38], rbx
inc r15d
mov qword [rsp + 0x30], rbx
mov edx, r15d
mov qword [rsp + 0x28], rbx
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18006b3dc
mov r14, qword [rbp + 0x38]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x18006b4e6
mov r9, rsi
lea r8, str._012I64X
mov edx, 0x200
mov rcx, rdi
call fcn.180069ca4
test eax, eax
jne 0x18006b4ce
or ebx, 0xffffffff
jmp 0x18006b4e6
mov r8d, dword [rbp + 0x40]
lea rcx, str.MAC:
mov r9, rdi
mov rdx, r14
call fcn.18006af3c
mov ebx, eax
mov rcx, rdi
call fcn.1800aea38
mov eax, ebx
jmp 0x18006b4f5
or eax, 0xffffffff
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18006c158
Capabilities:
Allocate thread local storage
Check mutex on windows

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x100
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor r14d, r14d
mov qword [0x180131c80], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20], eax
lea r9, str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
lea r8, str._s__u
lea edx, [r14 + 0x41]
lea rcx, [rsp + 0x60]
call fcn.18002d2f0
mov word [rsp + 0xe0], r14w
mov ebx, r14d
lea r8, [rsp + 0x60]
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18006c31e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18006c203
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
call fcn.18006bffc
test rax, rax
je 0x18006c219
mov qword [0x180131c80], rax
jmp 0x18006c300
mov rdi, r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18006c23b
xor edx, edx
mov r8d, 0x5d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x58], rdi
test rdi, rdi
je 0x18006c297
mov qword [rdi], r14
or dword [rdi + 8], 0xffffffff
lea rbx, [rdi + 0x10]
mov dword [rbx], r14d
lea rcx, [rbx + 8]
xor edx, edx
mov r8d, 0x5a0
call fcn.1800abaa0
mov qword [rbx + 0x5b0], rbx
mov qword [rbx + 0x5a8], rbx
mov qword [rbx + 0x5b8], rbx
mov dword [rdi + 0x5d0], r14d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rdi + 8], eax
cmp eax, 0xffffffff
je 0x18006c34f
mov qword [rdi], rsi
jmp 0x18006c29a
mov rdi, r14
mov qword [0x180131c80], rdi
test rdi, rdi
je 0x18006c369
mov ebx, 1
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18006c382
xor edx, edx
lea r8d, [rbx + 0x13]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18006c382
mov dword [rax], 0x20120919
mov dword [rax + 4], 0x58781234
mov dword [rax + 8], 0x14
mov qword [rax + 0xc], rdi
mov qword [0x180132510], rax
mov rax, qword [0x180131c80]
inc dword [rax + 0x5d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x18006c31e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18006c31e
lea rax, [0x180131c80]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
mov dword [rsp + 0x30], 2
lea rdx, [0x18011c1e8]
lea rcx, [rsp + 0x30]
call fcn.1800ac878
nop
mov dword [rsp + 0x34], 1
lea rdx, [0x18011c1e8]
lea rcx, [rsp + 0x34]
call fcn.1800ac878
mov dword [rsp + 0x38], 3
lea rdx, [0x18011c1e8]
lea rcx, [rsp + 0x38]
call fcn.1800ac878
int3
Function at 0x18006c3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180131c80]
test rax, rax
je 0x18006c451
mov ecx, dword [rax + 8]
cmp ecx, 0xffffffff
jne 0x18006c3cf
and qword [rsp + 0x28], 0
jmp 0x18006c3e6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x18006c453
mov rax, qword [0x180131c80]
mov rcx, qword [rax]
test rcx, rcx
je 0x18006c451
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18006c451
lea rcx, [0x180131c80]
call fcn.18006c490
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x18006c459
mov rax, qword [0x180131c80]
mov ecx, dword [rax + 8]
cmp ecx, 0xffffffff
je 0x18006c472
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18006c472
jmp 0x18006c437
mov rax, qword [0x180131c80]
mov rcx, qword [rax]
test rcx, rcx
je 0x18006c44c
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rbx
jmp 0x18006c453
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov dword [rsp + 0x20], 1
lea rdx, [0x18011c1e8]
lea rcx, [rsp + 0x20]
call fcn.1800ac878
mov dword [rsp + 0x24], 4
lea rdx, [0x18011c1e8]
lea rcx, [rsp + 0x24]
call fcn.1800ac878
int3

Function at 0x18006c490
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdx, qword [r14]
mov esi, eax
add rdx, 0x10
mov rbx, qword [rdx + 0x5a8]
mov qword [rdx + 0x5b8], rbx
cmp rbx, rdx
je 0x18006c59d
mov rax, qword [rbx + 0x5a8]
mov qword [rdx + 0x5b8], rax
test rbx, rbx
je 0x18006c59d
cmp esi, dword [rbx]
jne 0x18006c4f0
mov rdi, rbx
jmp 0x18006c56e
mov r8d, dword [rbx]
mov edx, 1
lea ecx, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
jne 0x18006c565
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x18006c556
mov rcx, qword [rbx + 0x5b0]
mov rax, qword [rbx + 0x5a8]
mov qword [rcx + 0x5a8], rax
mov rcx, qword [rbx + 0x5a8]
mov rax, qword [rbx + 0x5b0]
mov qword [rcx + 0x5b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18006c56e
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18006c56e
lea rcx, [0x1800ff340]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18006c56e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r14]
add rcx, 0x10
mov rbx, qword [rcx + 0x5b8]
cmp rbx, rcx
je 0x18006c598
mov rax, qword [rbx + 0x5a8]
mov qword [rcx + 0x5b8], rax
test rbx, rbx
jne 0x18006c4e7
test rdi, rdi
jne 0x18006c5b3
mov rcx, qword [r14]
add rcx, 0x10
call fcn.18006c6bc
mov rdi, rax
test rax, rax
je 0x18006c5b3
mov dword [rax], esi
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x18006f560
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x18006f587
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x18006f570
movzx eax, r9b
ret
Function at 0x18007eaa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.180001b40
mov r8, qword [rsp]
cmp eax, 0
jne 0x180001fdd
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x180001e18
lea rax, [0x1800031c0]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x180001e5c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
mov eax, 0x28
call fcn.180090180
sub rsp, rax
add rsp, 0x28
jmp 0x180001dd0