joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801884a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rdx, rdx
jle 0x180188671
mov r11, rsp
push rbp
push rsi
push r14
sub rsp, 0x140
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [r11 + 0x10], rbx
xor r14d, r14d
mov qword [r11 + 0x18], rdi
mov rbp, rdx
mov qword [r11 + 0x20], r15
mov rsi, rcx
movabs r15, 0x802000002601
mov byte [rsp + 0x21], r14b
nop dword [rax]
mov r8d, r14d
lea rdx, [0x18003eed4]
lea rcx, [rsp + 0x30]
call fcn.1800fe670
xor ebx, ebx
mov rdi, rsi
nop dword [rax]
cmp ebx, 8
jne 0x180188534
lea rcx, [rsp + 0x30]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180188520
movzx eax, word [0x18003ee3c]
mov word [rcx], ax
movsxd rax, ebx
cmp rbp, rax
jle 0x18018856f
movzx r8d, byte [rdi]
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180188550
lea rcx, [rsp + 0x30]
add rcx, rax
lea rdx, [0x18003ef48]
call fcn.1800fe670
jmp 0x180188587
lea rax, [rsp + 0x30]
dec rax
inc rax
cmp byte [rax], 0
jne 0x180188577
mov ecx, dword [0x18003ee8c]
mov dword [rax], ecx
inc ebx
inc rdi
cmp ebx, 0x10
jl 0x180188510
movzx eax, word [0x18003eebc]
xor r9d, r9d
lea r10d, [r9 + 0x10]
cmp rbp, r9
jle 0x180188602
movsx r8, byte [rsi]
mov rdx, r8
cmp r8d, 0x2f
ja 0x1801885bb
bt r15, rdx
jb 0x1801885c8
mov byte [rsp + 0x20], r8b
cmp edx, 0xff
jne 0x1801885cd
mov byte [rsp + 0x20], 0x2e
lea rdx, [rsp + 0x30]
dec rdx
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x1801885d5
lea r11, [rsp + 0x20]
xor r8d, r8d
nop word [rax + rax]
movzx ecx, byte [r11 + r8]
mov byte [rdx + r8], cl
inc r8
test cl, cl
jne 0x1801885f0
jmp 0x18018861d
lea rcx, [rsp + 0x30]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180188610
mov word [rcx], ax
inc r9
inc rsi
sub r10, 1
jne 0x1801885a3
sub rbp, 0x10
add r14d, 0x10
test rbp, rbp
jg 0x1801884f0
mov r15, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x140
pop r14
pop rsi
pop rbp
ret

Function at 0x1801888a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x74], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1801888c7
cmp dword [rcx + 0x78], 0
je 0x1801888c7
call qword [rcx + 0x48]
cmp dword [rbx + 0x74], 0
jne 0x1801888dc
mov rax, qword [rbx]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0x78]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1801889c0

Function at 0x180188960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x78], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180188981
call qword [rcx + 0x50]
cmp dword [rbx + 0x74], 0
jne 0x180188999
mov rax, qword [rbx]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0x80]
mov r8, rdi
xor edx, edx
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1801889c0
Function at 0x18018c940
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r8
mov r15, rdx
mov r13, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x18018c97f
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
mov qword [rsp + 0x20], rcx
xor edx, edx
movabs r10, 0x100000001b3
mov qword [rsp + 0x28], rdx
cmp rdx, r9
jae 0x18018c9bf
movzx eax, byte [r8 + rdx]
xor rcx, rax
mov qword [rsp + 0x20], rcx
imul rcx, r10
mov qword [rsp + 0x20], rcx
inc rdx
jmp 0x18018c99a
mov r12, qword [r13 + 0x30]
and r12, rcx
mov qword [rsp + 0x48], r12
mov rbx, qword [r13 + 8]
shl r12, 4
mov rax, qword [r13 + 0x18]
add rax, r12
mov qword [rsp + 0x38], rax
cmp qword [rax], rbx
je 0x18018c9f0
mov rbx, qword [rax + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rbx
cmp rbx, qword [rax]
je 0x18018ca9f
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
cmp qword [rbx + 0x28], 0x10
jb 0x18018ca14
mov rdx, qword [rbx + 0x10]
jmp 0x18018ca18
lea rdx, [rbx + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x18018ca24
mov rcx, qword [rdi]
jmp 0x18018ca27
mov rcx, rdi
mov rsi, qword [rbx + 0x20]
mov r14, qword [rdi + 0x10]
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
test r8, r8
je 0x18018ca47
call fcn.1802c7aa0
test eax, eax
jne 0x18018ca95
cmp r14, rsi
jb 0x18018ca95
ja 0x18018ca95
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rax + 8], rdx
dec qword [r13 + 0x10]
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x50], rcx
call fcn.1800ad110
mov rcx, rdi
call fcn.18011da90
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x18018cb3f
mov rax, qword [rsp + 0x38]
jmp 0x18018c9f5
mov rdi, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x18018cae1
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r13 + 0x18]
add rdx, r12
mov rax, qword [rdx]
cmp rax, qword [r13 + 8]
jne 0x18018caff
mov qword [rdx], rdi
mov rax, qword [r13 + 0x18]
mov qword [rax + r12 + 8], rdi
jmp 0x18018cb2b
cmp rax, rbx
jne 0x18018cb09
mov qword [rdx], rdi
jmp 0x18018cb2b
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x18018cb2b
mov rdx, qword [r13 + 0x18]
mov rax, qword [rdx + r12 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12 + 8], rcx
mov rcx, r13
call fcn.180196300
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180196970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rsi
mov rdi, r8
mov rsi, rdx
mov r10, rcx
add r8, 0x10
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x1801969a8
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x1801969e4
movabs r11, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r11
inc rcx
cmp rcx, r9
jb 0x1801969d0
mov r8, qword [r10 + 0x30]
and r8, rdx
shl r8, 4
mov rcx, qword [r10 + 0x18]
add rcx, r8
cmp qword [rcx + 8], rdi
jne 0x180196a21
cmp qword [rcx], rdi
jne 0x180196a17
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rax, qword [r10 + 8]
mov rcx, qword [r10 + 0x18]
mov qword [rcx + r8 + 8], rax
jmp 0x180196a2c
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x180196a2c
cmp qword [rcx], rdi
jne 0x180196a31
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x40], rcx
call fcn.1800ad110
mov rcx, rdi
call fcn.18011da90
mov qword [rsi], rbx
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180196a80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [r8 + 0x18]
mov r14, r8
mov rdi, qword [r8 + 0x10]
mov r12, rdx
mov rbp, rcx
cmp r15, 0x10
jb 0x180196ab1
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test rdi, rdi
je 0x180196ae4
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, rdi
jb 0x180196ad0
mov rcx, qword [rbp + 0x30]
and rcx, rdx
mov qword [rsp + 0x58], rsi
mov rdx, qword [rbp + 0x18]
mov rax, rcx
mov rbp, qword [rbp + 8]
add rax, rax
mov rbx, qword [rdx + rax*8]
lea rax, [rcx + rcx]
mov r13, qword [rdx + rax*8]
lea rax, [rax + 1]
lea rax, [rdx + rax*8]
mov qword [rsp + 0x50], rax
cmp r13, rbp
jne 0x180196b21
mov rax, rbp
jmp 0x180196b27
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x180196bc5
cmp r15, 0x10
jb 0x180196b3b
mov rdx, qword [r14]
jmp 0x180196b3e
mov rdx, r14
cmp qword [rbx + 0x28], 0x10
jb 0x180196b4b
mov rcx, qword [rbx + 0x10]
jmp 0x180196b4f
lea rcx, [rbx + 0x10]
mov rsi, qword [rbx + 0x20]
mov r8, rdi
cmp rsi, rdi
cmovb r8, rsi
test r8, r8
je 0x180196b6b
call fcn.1802c7aa0
test eax, eax
jne 0x180196b72
cmp rsi, rdi
jb 0x180196b72
jbe 0x180196b7c
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x180196b17
cmp qword [rbx + 0x28], 0x10
jb 0x180196b89
mov rdx, qword [rbx + 0x10]
jmp 0x180196b8d
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x180196b96
mov r14, qword [r14]
mov rsi, qword [rbx + 0x20]
cmp rdi, rsi
mov r8, rsi
cmovb r8, rdi
test r8, r8
je 0x180196bb5
mov rcx, r14
call fcn.1802c7aa0
test eax, eax
jne 0x180196bbc
cmp rdi, rsi
jb 0x180196bbc
jbe 0x180196bbf
mov rbx, rbp
mov qword [r12], rbx
jmp 0x180196bc9
mov qword [r12], rbp
mov rsi, qword [rsp + 0x58]
mov rax, r12
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801ab8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, r9
movzx eax, r8b
mov r13, rdx
mov r12, qword [rcx]
mov rbx, qword [r12 + 8]
mov dil, 1
nop dword [rax]
cmp byte [rbx + 0x19], 0
jne 0x1801ab9c4
mov r12, rbx
test al, al
je 0x1801ab951
lea rax, [rbx + 0x20]
cmp qword [rsi + 0x18], 0x10
jb 0x1801ab901
mov rdx, qword [rsi]
jmp 0x1801ab904
mov rdx, rsi
cmp qword [rax + 0x18], 0x10
jb 0x1801ab910
mov rcx, qword [rax]
jmp 0x1801ab913
mov rcx, rax
mov r14, qword [rsi + 0x10]
mov r15, qword [rax + 0x10]
mov r8, r14
cmp r15, r14
cmovb r8, r15
test r8, r8
je 0x1801ab935
call fcn.1802c7aa0
mov edi, eax
test eax, eax
jne 0x1801ab948
cmp r15, r14
jae 0x1801ab93f
or edi, 0xffffffff
jmp 0x1801ab948
xor edi, edi
cmp r15, r14
seta dil
shr edi, 0x1f
xor dil, 1
jmp 0x1801ab9a9
cmp qword [rbx + 0x38], 0x10
jb 0x1801ab95e
mov rdx, qword [rbx + 0x20]
jmp 0x1801ab962
lea rdx, [rbx + 0x20]
cmp qword [rsi + 0x18], 0x10
jb 0x1801ab96e
mov rcx, qword [rsi]
jmp 0x1801ab971
mov rcx, rsi
mov rdi, qword [rbx + 0x30]
mov r14, qword [rsi + 0x10]
mov r8, rdi
cmp r14, rdi
cmovb r8, r14
test r8, r8
je 0x1801ab991
call fcn.1802c7aa0
test eax, eax
jne 0x1801ab9a3
cmp r14, rdi
jae 0x1801ab99b
or eax, 0xffffffff
jmp 0x1801ab9a3
xor eax, eax
cmp r14, rdi
seta al
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x1801ab9b3
mov rbx, qword [rbx]
jmp 0x1801ab9b7
mov rbx, qword [rbx + 0x10]
movzx eax, byte [rsp + 0x90]
jmp 0x1801ab8e0
mov rbx, r12
mov qword [rsp + 0x30], rbx
mov r14, qword [rsp + 0x80]
test dil, dil
je 0x1801aba76
mov rax, qword [r14]
cmp r12, qword [rax]
jne 0x1801aba1d
movzx eax, byte [rsp + 0xa0]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rsi
mov r9, r12
mov r8b, 1
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1801ab5d0
mov rcx, qword [rax]
mov qword [r13], rcx
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x1801abac8
cmp byte [r12 + 0x19], 0
je 0x1801aba2c
mov rbx, qword [r12 + 0x10]
jmp 0x1801aba71
mov rax, qword [r12]
cmp byte [rax + 0x19], 0
jne 0x1801aba50
mov rbx, rax
nop dword [rax]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1801aba71
mov rbx, rax
jmp 0x1801aba40
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1801aba69
cmp rbx, qword [rax]
jne 0x1801aba69
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x1801aba50
cmp byte [rbx + 0x19], 0
cmove rbx, rax
mov qword [rsp + 0x30], rbx
lea rcx, [rbx + 0x20]
mov rdx, rsi
call fcn.1800aca70
test eax, eax
jns 0x1801ababc
movzx eax, byte [rsp + 0xa0]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rsi
mov r9, r12
movzx r8d, dil
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1801ab5d0
mov rcx, qword [rax]
mov qword [r13], rcx
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x1801abac8
mov qword [r13], rbx
mov byte [r13 + 8], 0
mov rax, r13
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801c0850
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801c087a
cmp byte [0x180400b38], 0
je 0x1801c087a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801c0880
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801c08aa
cmp byte [0x180400b38], 0
je 0x1801c08aa
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801c18b0
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1080
call fcn.1802b8650
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x28]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180079808]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x1801c192d
mov r8d, eax
lea rdx, [0x1800574f8]
lea rcx, [rsp + 0x50]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rsp + 0x50]
call fcn.1802c76f0
int3
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1801c1460
nop
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.1800aac10
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
call fcn.1801c1550
mov rax, rbx
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x1080
pop rbx
ret
Function at 0x1801cb490
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x1801cb4fa
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x1801cb4d4
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x1801cb525
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x1801cb57c
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x1801cb54a
jmp 0x1801cb530
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r11 + 0x10]
call fcn.18011da90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1801cb618
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1801cb5bb
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x1801cb5d9
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x1801cb605
cmp rax, rbx
jne 0x1801cb5e3
mov qword [rdx], rdi
jmp 0x1801cb605
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1801cb605
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.1801d5ac0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1801cbdc0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801cbdea
cmp byte [0x180400b38], 0
je 0x1801cbdea
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801cbdf0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801cbe1a
cmp byte [0x180400b38], 0
je 0x1801cbe1a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret
Function at 0x1801cbe20
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801cbe4a
cmp byte [0x180400b38], 0
je 0x1801cbe4a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801cbe50
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801cbe7a
cmp byte [0x180400b38], 0
je 0x1801cbe7a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801cbe80
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801cbeaa
cmp byte [0x180400b38], 0
je 0x1801cbeaa
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801cbeb0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801cbeda
cmp byte [0x180400b38], 0
je 0x1801cbeda
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801cbee0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801cbf0a
cmp byte [0x180400b38], 0
je 0x1801cbf0a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret
Function at 0x1801d4960
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.1801d5a10
mov rcx, rbx
test eax, eax
mov rax, qword [rbx]
je 0x1801d49a2
lea r8, [0x18005ad70]
mov edx, 4
call qword [rax + reloc.WSOCK32.dll_recv]
mov rdx, rbx
lea rcx, [0x1801d47f0]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1801d49b2
lea r8, [0x18005adb8]
mov edx, 3
call qword [rax + reloc.WSOCK32.dll_recv]
nop
add rsp, 0x30
pop rbx
ret
Function at 0x1801dfab0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
xor ebx, ebx
mov dword [rax - 0x48], ebx
cmp dword [rcx + 0x3b8], ebx
jne 0x1801dfae7
xor eax, eax
jmp 0x1801dfc38
cmp byte [rcx + 0x120], 0
je 0x1801dfbfa
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
add rcx, 0x120
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1801dfbfa
cmp qword [rdi + 0x2a0], 0
je 0x1801dfbe0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
lea r13, [rdi + 0x230]
mov qword [rsp + 0x58], r13
mov byte [rsp + 0x50], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or edx, 0xffffffff
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [rsp + 0x50], 1
lea ecx, [r12 + 1]
call fcn.1802b8484
mov rcx, qword [rdi + 0x118]
mov qword [rdi + 0x118], rax
mov esi, 1
test rcx, rcx
je 0x1801dfba0
mov edx, esi
call fcn.1802b8d50
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x90]
mov r8d, r12d
mov rdx, qword [rdi + 0x118]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
cmovne ebx, esi
mov dword [rsp + 0x40], ebx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x50], 0
jmp 0x1801dfbeb
mov esi, 1
mov ebx, esi
mov dword [rsp + 0x40], ebx
mov dword [rdi + 0x224], esi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x118]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov eax, dword [rdi + 0x224]
mov dword [rsp + 0x20], eax
lea r9, [rdi + 0x120]
lea r8, [0x18005fbf0]
mov edx, 3
mov rcx, rdi
call fcn.1801e19a0
nop
jmp 0x1801dfc36
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801e4bd0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801e4bfa
cmp byte [0x180400b38], 0
je 0x1801e4bfa
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801e4c00
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801e4c2a
cmp byte [0x180400b38], 0
je 0x1801e4c2a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret