joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp edx, 2
je 0x40262d
ja 0x4024e3
test edx, edx
je 0x402569
mov eax, dword [0x004078e8]
test eax, eax
je 0x40254c
mov dword [0x004078e8], 1
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
cmp edx, 3
jne 0x4024d4
mov eax, dword [0x004078e8]
test eax, eax
je 0x4024d4
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x40253d
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x40255e
test r12, r12
je 0x40255e
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402519
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4024d4
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x4024ca
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402519
jmp 0x40253d
mov eax, dword [0x004078e8]
test eax, eax
je 0x4025cb
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x4025be
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x40261e
test r12, r12
je 0x40261e
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40259a
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x004078e8]
cmp eax, 1
jne 0x4024d4
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x4025f7
mov rcx, rbx
mov rbx, qword [rbx + 0x10]
call sym.free
test rbx, rbx
jne 0x4025e6
lea rcx, [0x00407900]
mov qword [0x004078e0], 0
mov dword [0x004078e8], 0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x4024d4
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40259a
jmp 0x4025be
call sym._fpreset
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x402650
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x402668
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x402669
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x402680
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4026c1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x4026b8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x4026c3
add rax, 0x28
cmp rax, r9
jne 0x4026a4
xor eax, eax
ret
Function at 0x4026d0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x402757
mov rdx, qword [0x00404340]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x40274b
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x40274b
cmp word [rax + 0x18], 0x20b
jne 0x40274b
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402757
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x402736
add r12, 0x28
cmp r12, rsi
je 0x402757
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x40272d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x402770
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r8, qword [0x00404340]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x402790
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x402791
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402790
movzx eax, word [rdx + 0x14]
sub rcx, r8
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4027d6
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4027cd
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402790
add rax, 0x28
cmp rax, r9
jne 0x4027b9
xor eax, eax
ret

Function at 0x4027e0
Capabilities:
Parse pe header

Disassembly:
mov rdx, qword [0x00404340]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x4027ff
movsxd rcx, dword [rdx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
je 0x402800
ret
cmp word [rdx + 0x18], 0x20b
jne 0x4027ff
movzx eax, word [rdx + 6]
ret

Function at 0x402810
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x00404340]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x402830
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x402831
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402830
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x40286e
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
test byte [rax + 0x27], 0x20
je 0x402865
test rcx, rcx
je 0x402830
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x402856
xor eax, eax
ret

Function at 0x402880
Capabilities:
Parse pe header

Disassembly:
mov rdx, qword [0x00404340]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x40289f
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x4028a0
ret
cmp word [rcx + 0x18], 0x20b
cmove rax, rdx
ret
Function at 0x4028b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00404340]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x4028d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x4028d1
ret
cmp word [r8 + 0x18], 0x20b
jne 0x4028d0
sub rcx, rdx
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x4028d0
lea eax, [r8 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x402912
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x40291e
add rdx, 0x28
cmp r9, rdx
jne 0x4028fe
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x402930
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x00404340]
xor eax, eax
cmp word [r11], 0x5a4d
jne 0x402951
movsxd r9, dword [r11 + 0x3c]
add r9, r11
cmp dword [r9], 0x4550
je 0x402952
ret
cmp word [r9 + 0x18], 0x20b
jne 0x402951
mov edx, dword [r9 + 0x90]
test edx, edx
je 0x402951
movzx r8d, word [r9 + 0x14]
lea r8, [r9 + r8 + 0x18]
movzx r9d, word [r9 + 6]
test r9d, r9d
je 0x402951
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r10, [r8 + rax*8 + 0x28]
mov r9d, dword [r8 + 0xc]
mov rax, r9
cmp rdx, r9
jb 0x40299c
add eax, dword [r8 + 8]
cmp rdx, rax
jb 0x4029a8
add r8, 0x28
cmp r10, r8
jne 0x402987
xor eax, eax
ret
lea rax, [r11 + rdx]
jmp 0x4029b5
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x4029c5
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4029a5
test ecx, ecx
jg 0x4029ae
mov eax, dword [rax + 0xc]
add rax, r11
ret
Function at 0x140002c34
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140002d24
lea rcx, [rsp + 0x28]
call fcn.14000166c
mov rbp, rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002c98
or ebx, 0xffffffff
jmp 0x140002ce3
mov dword [rsp + 0x50], 0x130
xor ebx, ebx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140002cda
mov rdx, rbp
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140002cd6
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x140002cb0
mov ebx, dword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x28]
call fcn.1400016d4
nop
mov rcx, rsi
call fcn.1400016d4
mov eax, ebx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140002df0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180005b50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1800a7040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor esi, esi
call fcn.1800059e0
nop
mov dword [rsp + 0x60], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180005bda
nop word [rax + rax]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x8c]
call fcn.18005daa0
mov rcx, rbx
test eax, eax
je 0x180005c4a
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005bb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0xffffffff
mov ecx, 0x48
call fcn.18003cc40
mov rbx, rax
mov dword [rax + 0xc], esi
mov qword [rax + 0x30], rsi
mov dword [rax + 8], edi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], rsi
mov qword [rax + 0x38], rsi
mov qword [rax + 0x40], rsi
lea rax, vtable.RemoteTpDirectInsertion.0
mov qword [rbx], rax
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call fcn.1800150b0
nop
test rbx, rbx
je 0x180005c43
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0x18]
nop
mov eax, 1
jmp 0x180005c58
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x68]
jmp 0x180005be8
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.18003cc20
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180015eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov rbx, qword [rsp + 0x60]
mov r12, r9
mov rcx, qword [rsp + 0x50]
mov r13, r8
mov rbp, qword [rsp + 0x58]
mov r15, rdx
mov qword [rsi], r8
mov qword [rbx], rcx
mov rax, qword [rsi]
cmp rax, r9
je 0x180016045
cmp rcx, rbp
je 0x180016045
mov r9d, 1
movzx edx, word [r15]
xor dil, dil
movzx ecx, word [rax]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp r9w, dx
jae 0x180015f4c
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x18001606c
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180015f63
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x180015f63
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180015f76
movzx r8d, al
mov r10d, r14d
mov r11d, r14d
jmp 0x180015fc3
mov r8d, eax
cmp eax, 0x800
jae 0x180015f90
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x180015fc3
cmp eax, 0x10000
jae 0x180015faa
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x180015fc3
shr r8d, 0x12
mov r10d, 3
movzx r11d, dil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, rbp
sub rdx, qword [rbx]
mov ecx, r9d
cmp rdx, rcx
jl 0x180016045
add qword [rsi], 2
test dil, dil
jne 0x180015fe4
cmp r10d, 3
jae 0x180015ff0
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jle 0x18001601e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop
sub ecx, 6
mov edx, eax
shr edx, cl
dec r9d
and dl, 0x3f
or dl, 0x80
mov byte [r8], dl
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jg 0x180016000
shr eax, 0xa
mov r9d, 1
test dil, dil
mov ecx, r9d
cmovne ecx, eax
mov word [r15], cx
mov rax, qword [rsi]
cmp rax, r12
je 0x180016045
cmp qword [rbx], rbp
jne 0x180015f0d
cmp r13, qword [rsi]
sete r14b
mov eax, r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x18001604f
Function at 0x18001815c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x18001818a
xor eax, eax
jmp 0x180018270
cmp qword [rcx + 0x68], 0
je 0x18001819b
call fcn.1800065d0
jmp 0x180018270
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800181b2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800181b4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800181e6
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.18007fad0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x18001826a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x18001821d
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x180018246
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.180063510
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x18001826a
cmp rsi, rbx
ja 0x180018224
test rsi, rsi
je 0x18001826a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.180063510
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180032338
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18001ec66
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18001ec49
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x18001ec34

Function at 0x18003c2ac
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.1800646c8
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x18003c2fe
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x18003c2fe
sub ecx, 1
je 0x18003c2f7
cmp ecx, 1
je 0x18003c2f0
xor eax, eax
jmp 0x18003c303
mov eax, 3
jmp 0x18003c303
mov eax, 1
jmp 0x18003c303
mov eax, 2
add rsp, 0x28
ret

Function at 0x180048900
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
cmp eax, 0xffffffff
je 0x18004891f
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov r9d, 0xc
lea r8, str.TLS_capacity_depleted
lea rcx, str.libslog_src_thread_specific.cpp
lea edx, [r9 + 0x1d]
call fcn.180042070
int3
Function at 0x18004f800
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
je 0x18004f820
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x18004f83a
call fcn.18004fd20
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
jne 0x18004f834
xor eax, eax
jmp 0x18004f83a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rax + 0x18]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18004e730
mov qword [rbx], rax
add rsp, 0x20
pop rbx
ret

Function at 0x18004fc90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
je 0x18004fcf3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18004fcf3
mov rdx, qword [rax + 0x28]
mov rcx, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], 0
jne 0x18004fcd8
cmp qword [rax + 0x20], rbx
jae 0x18004fccc
mov rax, qword [rax + 0x10]
jmp 0x18004fcd2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18004fcc0
cmp byte [rcx + 0x19], 0
jne 0x18004fcf3
cmp rbx, qword [rcx + 0x20]
jb 0x18004fcf3
cmp rcx, rdx
je 0x18004fcf3
lea rax, [rcx + 0x28]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x18004fd20
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.18004e6d0
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdx, [0x18004fc70]
lea rcx, [0x1800ac838]
call fcn.18004f860
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
je 0x18004fd5b
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x20
pop rbx
ret
Function at 0x1800501d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800502f0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
jne 0x18005030e
xor esi, esi
jmp 0x180050317
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x1800503fb
cmp qword [rsi + 0x30], 0
jne 0x180050337
cmp qword [rsi + 0x18], 0
je 0x1800503d4
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x180050394
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x180050377
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x180050340
cmp qword [rsi + 0x30], 0
je 0x18005032c
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1800503bc
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1800503bc
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.18004f300
cmp qword [rsi + 0x30], 0
jne 0x1800503a0
jmp 0x180050325
lea rdx, [0x18004fc70]
lea rcx, [0x1800ac838]
call fcn.18004f860
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
je 0x1800503fb
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x18005042e
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x18005042e
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800502f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800502f0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
jne 0x18005030e
xor esi, esi
jmp 0x180050317
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x1800503fb
cmp qword [rsi + 0x30], 0
jne 0x180050337
cmp qword [rsi + 0x18], 0
je 0x1800503d4
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x180050394
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x180050377
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x180050340
cmp qword [rsi + 0x30], 0
je 0x18005032c
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1800503bc
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1800503bc
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.18004f300
cmp qword [rsi + 0x30], 0
jne 0x1800503a0
jmp 0x180050325
lea rdx, [0x18004fc70]
lea rcx, [0x1800ac838]
call fcn.18004f860
mov ecx, dword [0x1800a70f8]
cmp ecx, 0xffffffff
je 0x1800503fb
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x18005042e
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x18005042e
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800624b0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18006251f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18006251f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18006251f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18006251f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18006251f
cmp dword [rcx + 0x84], 0xe
jbe 0x18006251f
cmp dword [rcx + 0xf8], 0
je 0x18006251f
mov ecx, ebx
call fcn.1800625d0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800623ac
nop
cmp dword [rbp + 0x20], 0
je 0x18006256d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180062578
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800624b0