joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016ecc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180016ee2
mov al, 1
jmp 0x180016f42
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180016ef3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180016f40
mov ecx, dword [rcx + 0x18]
nop
call fcn.180014d10
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180016f40
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180016f40
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180016f40
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180016f42
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x18001a2b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18001a2d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18001a2d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800014e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x18003aa88]
lea r8, str.EXEFILE
movzx edx, dx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x180001542
mov rcx, qword [0x18003aa88]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov dword [rdi], eax
mov rcx, qword [0x18003aa88]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180001560
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800015e2
dec edx
je 0x18000159f
cmp edx, 2
jne 0x180001600
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180001600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18003aa90], eax
cmp eax, 0xffffffff
jne 0x1800015b8
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea r8, str.DISKCRYPTOR_MUTEX
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x18003aa88], rbx
mov qword [0x180039a00], rax
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x180039a00]
test rcx, rcx
je 0x1800015f4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180001840
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x860], rax
xor eax, eax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x800
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
call fcn.180015950
xor esi, esi
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
lea r9d, [rsi + 0xc]
mov edx, 0x2d1400
mov rcx, rbx
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1800018cf
lea eax, [rsi + 1]
jmp 0x18000191a
mov edx, dword [rsp + 0x6c]
mov byte [rdi], sil
mov rax, rdi
test edx, edx
je 0x1800018ed
lea rcx, [rsp + 0x60]
mov r8, rdi
call fcn.180001670
add rax, rdi
mov edx, dword [rsp + 0x70]
test edx, edx
je 0x180001911
cmp rax, rdi
je 0x180001904
mov byte [rax], 0x20
mov edx, dword [rsp + 0x70]
inc rax
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.180001670
cmp byte [rdi], sil
sete sil
mov eax, esi
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.180015920
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180001c10
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
xor eax, eax
lea rcx, str..dcrypt
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x180001c58
mov ecx, dword [0x18003aa90]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
add rsp, 0x48
ret
mov eax, 1
add rsp, 0x48
ret

Function at 0x180001cd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12d, ecx
mov ecx, dword [0x18003aa90]
mov rdi, r9
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x180001d4f
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rcx, str..dcrypt
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180001d40
mov eax, 0x591
jmp 0x180001d92
mov ecx, dword [0x18003aa90]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], 0
mov r9d, esi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x80]
mov r8, rbp
mov dword [rsp + 0x28], eax
mov edx, r12d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x180001d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180001d92
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x180001dc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x300
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rsi, rcx
mov ecx, dword [0x18003aa90]
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, 0x7d
mov rcx, rsi
mov rbp, rax
call fcn.1800160c4
xor r12d, r12d
mov r8, rdi
mov rdx, rsi
lea rbx, [rdi + 0x210]
mov word [rax + 2], r12w
sub r8, rsi
nop word [rax + rax]
movzx eax, word [rdx]
add rdx, 2
mov word [r8 + rdx + 0x20e], ax
test ax, ax
jne 0x180001e30
mov edx, 0x7b
mov rcx, rsi
call fcn.1800160c4
lea r8, str.__Volume_s
lea rcx, [rsp + 0x258]
mov r9, rax
mov edx, 0x41
call fcn.180015fe0
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x50]
mov r9d, 0x298
mov edx, 0x220040
mov rcx, rbp
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180001f57
cmp dword [rsp + 0x2de], r12d
jne 0x180001f57
lea rax, [rsp + 0x258]
mov rdx, rdi
lea rcx, [rsp + 0x258]
sub rdx, rax
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx + 6], ax
test ax, ax
jne 0x180001ee0
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x40]
lea rax, [rdi + 0x418]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x50]
mov r9d, 0x298
mov rcx, rbp
mov edx, 0x22001c
mov dword [rsp + 0x28], 0x22c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180001f57
lea rdx, [rdi + 0x43c]
cmp word [rdx], r12w
jne 0x180001f52
sub rdx, rbx
movzx ecx, word [rbx]
add rbx, 2
mov word [rdx + rbx - 2], cx
test cx, cx
jne 0x180001f41
mov eax, r12d
jmp 0x180001f5c
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180015920
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x180001f90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x300
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, rcx
xor edx, edx
lea rcx, str.ArcNamemulti_0_disk_0_rdisk_0_partition_1_
nop word [rax + rax]
movzx eax, word [rdx + rcx]
add rdx, 2
mov word [rsp + rdx + 0x256], ax
test ax, ax
jne 0x180001fc0
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220040
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180002054
mov eax, dword [rsp + 0x2de]
test eax, eax
jne 0x180002059
lea rcx, [rsp + 0x258]
lea rdx, [rsp + 0x258]
sub rbx, rcx
movzx ecx, word [rdx]
add rdx, 2
mov word [rbx + rdx - 2], cx
test cx, cx
jne 0x180002041
jmp 0x180002059
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180015920
add rsp, 0x300
pop rbx
ret
Function at 0x180002150
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0x298
mov ebp, r8d
mov rsi, rdx
call sym.dcapi.dll_secure_alloc
mov rdi, rax
test rax, rax
jne 0x180002187
lea eax, [rdi + 9]
jmp 0x18000221c
mov rcx, rax
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx + 0x206], ax
test ax, ax
jne 0x180002190
mov dword [rdi + 0x28a], ebp
test rsi, rsi
je 0x1800021c0
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x104
call fcn.180016100
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
mov r9d, 0x298
mov rcx, rax
lea rax, [rsp + 0x68]
mov r8, rdi
mov qword [rsp + 0x30], rax
mov edx, 0x22000c
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, 1
test eax, eax
je 0x180002212
mov ebx, dword [rdi + 0x28e]
mov rcx, rdi
call sym.dcapi.dll_secure_free
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180002240
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, 0x298
mov ebp, r8d
mov rsi, rdx
call sym.dcapi.dll_secure_alloc
mov rbx, rax
test rax, rax
jne 0x180002277
lea eax, [rbx + 9]
jmp 0x1800022f7
test rdi, rdi
je 0x18000228d
mov rcx, rax
mov rdx, rdi
mov r8d, 0x104
call fcn.180016100
mov dword [rbx + 0x28a], ebp
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
mov r9d, 0x298
mov rcx, rax
lea rax, [rsp + 0x68]
mov r8, rbx
mov qword [rsp + 0x30], rax
mov edx, 0x220010
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1800022df
lea edi, [rax + 1]
jmp 0x1800022ed
mov ecx, dword [rbx + 0x292]
mov edi, dword [rbx + 0x28e]
mov dword [rsi], ecx
mov rcx, rbx
call sym.dcapi.dll_secure_free
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180002320
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x740
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbx, rcx
mov ecx, dword [0x18003aa90]
mov edi, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rcx, [rsp + 0x258]
mov rsi, rax
sub rcx, rbx
nop word [rax + rax]
movzx edx, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], dx
test dx, dx
jne 0x180002370
lea rax, [rsp + 0x40]
xor ebx, ebx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2f0]
mov r9d, 0x298
mov edx, 0x22001c
mov rcx, rsi
mov dword [rsp + 0x28], 0x22c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18000247b
test byte [rsp + 0x300], 0x14
jne 0x18000247b
cmp dword [rsp + 0x30c], ebx
jne 0x18000247b
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov r9d, 0x298
mov edx, 0x220014
mov rcx, rsi
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x2da], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x18000242d
lea eax, [rbx + 1]
jmp 0x180002480
mov ebx, dword [rsp + 0x2de]
test ebx, ebx
jne 0x180002477
test dil, 8
jne 0x180002448
test byte [rsp + 0x304], 8
je 0x180002477
lea r9, [rsp + 0x314]
lea r8, [0x18002a6b0]
lea rcx, [rsp + 0x520]
mov edx, 0x104
call fcn.180015fe0
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
mov eax, ebx
jmp 0x180002480
mov eax, 8
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.180015920
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800024b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, 0x298
call sym.dcapi.dll_secure_alloc
mov rbx, rax
test rax, rax
jne 0x1800024dd
lea eax, [rbx + 9]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, rax
mov rdx, rdi
mov r8d, 0x104
call fcn.180016100
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
mov r9d, 0x298
mov rcx, rax
lea rax, [rsp + 0x58]
mov r8, rbx
mov qword [rsp + 0x30], rax
mov edx, 0x220004
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, 1
test eax, eax
je 0x180002540
mov edi, dword [rbx + 0x28e]
mov rcx, rbx
call sym.dcapi.dll_secure_free
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x180002560
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0x298
mov rsi, r8
mov rbp, rdx
call sym.dcapi.dll_secure_alloc
mov rdi, rax
test rax, rax
jne 0x180002597
lea eax, [rdi + 9]
jmp 0x18000262d
mov rcx, rax
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx + 0x206], ax
test ax, ax
jne 0x1800025a0
mov rcx, rdi
mov rdx, rbp
mov r8d, 0x104
call fcn.180016100
movzx r11d, word [rsi]
mov word [rdi + 0x296], r11w
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
mov r9d, 0x298
mov rcx, rax
lea rax, [rsp + 0x68]
mov r8, rdi
mov qword [rsp + 0x30], rax
mov edx, 0x220028
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, 1
test eax, eax
je 0x180002623
mov ebx, dword [rdi + 0x28e]
mov rcx, rdi
call sym.dcapi.dll_secure_free
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180002650
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0x298
mov rsi, r8
mov rbp, rdx
call sym.dcapi.dll_secure_alloc
mov rdi, rax
test rax, rax
jne 0x180002687
lea eax, [rdi + 9]
jmp 0x18000271d
mov rcx, rax
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx + 0x206], ax
test ax, ax
jne 0x180002690
mov rcx, rdi
mov rdx, rbp
mov r8d, 0x104
call fcn.180016100
movzx r11d, word [rsi]
mov word [rdi + 0x296], r11w
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
mov r9d, 0x298
mov rcx, rax
lea rax, [rsp + 0x68]
mov r8, rdi
mov qword [rsp + 0x30], rax
mov edx, 0x220030
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, 1
test eax, eax
je 0x180002713
mov ebx, dword [rdi + 0x28e]
mov rcx, rdi
call sym.dcapi.dll_secure_free
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180002740
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0x298
mov rsi, rdx
call sym.dcapi.dll_secure_alloc
mov rdi, rax
test rax, rax
jne 0x18000277a
lea eax, [rdi + 9]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rax
sub rcx, rbx
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx + 0x206], ax
test ax, ax
jne 0x180002780
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x104
call fcn.180016100
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
mov r9d, 0x298
mov rcx, rax
lea rax, [rsp + 0x60]
mov r8, rdi
mov qword [rsp + 0x30], rax
mov edx, 0x22002c
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, 1
test eax, eax
je 0x1800027f7
mov ebx, dword [rdi + 0x28e]
mov rcx, rdi
call sym.dcapi.dll_secure_free
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180002820
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0x298
mov rsi, r8
mov rbp, rdx
call sym.dcapi.dll_secure_alloc
mov rdi, rax
test rax, rax
jne 0x180002857
lea eax, [rdi + 9]
jmp 0x1800028f6
mov rcx, rax
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx + 0x206], ax
test ax, ax
jne 0x180002860
mov rcx, rdi
mov rdx, rbp
mov r8d, 0x104
call fcn.180016100
lea rcx, [rdi + 0x104]
mov rdx, rsi
mov r8d, 0x104
call fcn.180016100
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
mov r9d, 0x298
mov rcx, rax
lea rax, [rsp + 0x68]
mov r8, rdi
mov qword [rsp + 0x30], rax
mov edx, 0x220024
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, 1
test eax, eax
je 0x1800028ec
mov ebx, dword [rdi + 0x28e]
mov rcx, rdi
call sym.dcapi.dll_secure_free
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180002920
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea r8, [rsp + 0x258]
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x180002950
mov ecx, dword [0x18003aa90]
mov byte [rsp + 0x2e7], dl
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220034
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180015920
add rsp, 0x308
ret
Function at 0x1800029f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x258]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180002a20
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220038
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180015920
add rsp, 0x308
ret

Function at 0x180002ab0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea r8, [rsp + 0x258]
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x180002ae0
mov ecx, dword [0x18003aa90]
mov byte [rsp + 0x2e7], dl
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x22006c
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180015920
add rsp, 0x308
ret

Function at 0x180002b80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x258]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180002bb0
mov ecx, dword [0x18003aa90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x22003c
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180015920
add rsp, 0x308
ret