joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180117c60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [r8 + 0x20]
mov rbx, r8
mov rdi, rcx
test rax, rax
jne 0x180117cf7
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x30], rsi
xor esi, esi
test ecx, ecx
jns 0x180117c8f
mov rax, rsi
jmp 0x180117c95
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x38
lea r8d, [rdx - 0x28]
call fcn.180243b70
test rax, rax
je 0x180117ce8
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov rsi, qword [rsp + 0x30]
mov dword [rax + 0x28], 0xffffffff
mov dword [rax + 8], 5
lea rcx, [0x180043240]
mov qword [rax], rcx
mov qword [rax + 0x30], rbx
mov qword [rbx + 0x20], rax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsi
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x468], 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180117eb0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r12d, dword [rsp + 0x80]
mov ebp, dword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov edi, r8d
mov r14, rdx
mov rsi, rcx
cmp r9, qword [rcx + 0xe0]
jne 0x180117f23
test r13, r13
jne 0x180117f23
test r8d, r8d
jne 0x180117f23
mov rax, qword [rcx + 0x398]
test rax, rax
je 0x180117f09
cmp ebp, 1
jne 0x180117f09
cmp r12d, 4
je 0x180118075
mov rax, qword [rcx + 0x3a0]
test rax, rax
je 0x180117f23
cmp ebp, 4
jne 0x180117f23
cmp r12d, ebp
je 0x180118075
mov r8, r13
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r15
and r8, 0xfffffffffffff3ff
call fcn.180117880
xor r15d, r15d
mov rbx, rax
test rax, rax
je 0x18011805e
cmp ebp, 1
ja 0x180117f64
cmp r12d, 1
ja 0x180117f64
cmp edi, 9
je 0x180117f64
cmp edi, 8
jne 0x180118068
cmp ebp, 1
jne 0x180117f6e
cmp edi, 8
jne 0x180117f73
cmp edi, 9
jne 0x180117fd5
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x180117f82
mov rax, r15
jmp 0x180117f88
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x40
lea r8d, [rdx - 0x30]
call fcn.180243b70
test rax, rax
je 0x18011805e
lea rcx, [0x180043550]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov dword [rax + 0x28], 0xffffffff
mov qword [rax + 0x30], r15
mov qword [rax], rcx
mov dword [rax + 0x38], r15d
mov dword [rax + 0x3c], r15d
mov dword [rax + 8], 9
jmp 0x180118031
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x180117fe4
mov rax, r15
jmp 0x180117fea
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x40
lea r8d, [rdx - 0x30]
call fcn.180243b70
test rax, rax
je 0x18011805e
lea rcx, [0x1800434e0]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov dword [rax + 0x28], 0xffffffff
mov dword [rax + 8], 8
mov qword [rax], rcx
mov qword [rax + 0x30], r15
mov dword [rax + 0x38], r15d
mov dword [rax + 0x3c], r15d
and r13d, 0xc00
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebp
mov dword [rax + 0x3c], r12d
je 0x180118087
mov r9, rax
mov r8, r13
mov rdx, r14
mov rcx, rsi
call fcn.180117880
mov rbx, rax
test rax, rax
jne 0x180118068
mov byte [rsi + 0x468], 1
mov rbx, r15
mov r15, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rbx, rax
jmp 0x180118068
Function at 0x1801180a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
test r9, r9
jne 0x1801180cc
xor eax, eax
jmp 0x18011816d
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x40], r12
xor r12d, r12d
test ecx, ecx
jns 0x1801180e3
mov rax, r12
jmp 0x1801180e9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x48
lea r8d, [rdx - 0x38]
call fcn.180243b70
test rax, rax
je 0x18011815e
lea rcx, [0x180043390]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax], rcx
mov qword [rax + 0x20], r12
mov dword [rax + 0x28], 0xffffffff
mov dword [rax + 8], 3
mov qword [rax + 0x38], r12
mov qword [rax + 0x40], r12
mov rcx, rbx
mov r9, rax
mov r8, rdi
mov rdx, rbp
mov dword [rax + 0x30], esi
mov byte [rsp + 0x20], r12b
call fcn.180113400
test rax, rax
je 0x18011815e
mov qword [rbx + 8], rax
mov byte [rbx + 0x46d], 1
mov qword [rbx + 0x3c0], rax
jmp 0x180118168
mov byte [rbx + 0x468], 1
mov rax, r12
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1801184e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
test r8, r8
jne 0x18011850f
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r12
xor r12d, r12d
test ecx, ecx
jns 0x18011852b
mov rax, r12
jmp 0x180118531
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x48
lea r8d, [rdx - 0x38]
call fcn.180243b70
mov rdi, rax
test rax, rax
je 0x1801185d8
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov dword [rax + 0x28], 0xffffffff
mov qword [rax + 0x38], r12
mov qword [rax + 0x40], r12
lea rax, [0x180043390]
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
mov dword [rdi + 8], 4
mov dword [rdi + 0x30], 2
mov qword [rdi], rax
call fcn.180117c60
test rax, rax
je 0x1801185d8
mov r9, rax
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
mov byte [rsp + 0x20], r12b
call fcn.180113400
test rax, rax
je 0x1801185d8
mov r9, rdi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
mov byte [rsp + 0x20], 1
call fcn.180113400
test rax, rax
je 0x1801185d8
mov qword [rbx + 8], rax
mov byte [rbx + 0x46d], 1
jmp 0x1801185e2
mov byte [rbx + 0x468], 1
mov rax, r12
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x180118610
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebp, ebp
mov rbx, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
mov edi, ebp
mov dword [rsp + 0x58], ebp
test r9, r9
jne 0x18011865a
cmp byte [rsp + 0x60], dil
jne 0x180118693
lea r9, [0x180042e78]
mov r8d, 0xc00
jmp 0x18011873e
lea r8, [rsp + 0x58]
or r9d, 0xffffffff
mov rdx, rbx
call fcn.18017c060
test eax, eax
jns 0x180118681
lea r9, [0x180042ea8]
mov r8d, 0xbf2
jmp 0x180118738
mov edi, dword [rsp + 0x58]
lea eax, [rdi - 1]
cmp eax, 0xffff
ja 0x18011872b
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x1801186a2
mov rax, rbp
jmp 0x1801186a8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x40
lea r8d, [rdx - 0x30]
call fcn.180243b70
mov r11, rax
test rax, rax
je 0x180118806
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rbp
mov dword [rax + 0x28], 0xffffffff
lea rax, [0x180043470]
mov dword [r11 + 8], 7
mov dword [r11 + 0x3c], 0x10
mov qword [r11 + 0x30], rbp
mov qword [r11], rax
mov dword [r11 + 0x38], edi
test r12, r12
je 0x180118761
cmp dword [r12 + 8], 0xa
jne 0x180118761
mov rax, qword [rsi + 0x70]
cmp qword [r12 + 0x38], rax
jne 0x180118761
mov qword [r11 + 0x30], r12
mov rax, qword [rsp + 0x68]
mov qword [rax], r11
cmp edi, 0x10000
jbe 0x18011880b
mov r8d, 0xbf3
lea r9, [0x180042ee0]
mov rdx, r13
mov rcx, rsi
call fcn.18010c480
mov eax, 0x80070057
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, qword [rsi + 0x70]
mov qword [r11 + 0x30], rax
mov r8, qword [rsi + 0x70]
cmp r12, r8
je 0x180118717
test rbx, rbx
jne 0x180118786
lea r9, [0x180042f10]
mov r8d, 0xc01
jmp 0x180118738
test r8, r8
je 0x1801187be
mov rax, r8
nop
test rax, rax
je 0x1801187a1
cmp dword [rax + 8], 0xa
jne 0x1801187a1
mov rax, qword [rax + 0x38]
jmp 0x180118790
cmp dword [rax + 8], 5
sete al
test al, al
je 0x1801187be
lea r9, [0x180042f40]
mov r8d, 0xc2f
jmp 0x180118738
mov rdx, r12
mov rax, qword [rdx + 0x30]
imul edi, dword [rdx + 0x38]
test rax, rax
je 0x1801187e4
cmp dword [rax + 8], 0xa
jne 0x1801187e4
cmp qword [rax + 0x30], 0x20000200
jne 0x1801187e4
mov rcx, qword [rax + 0x38]
jmp 0x1801187e7
mov rcx, rax
cmp rcx, r8
je 0x1801187f1
mov rdx, rax
jmp 0x1801187c1
mov qword [r11 + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rdx + 0x30], r11
mov qword [rax], r12
jmp 0x18011871f
mov ebp, 0x8007000e
mov eax, ebp
jmp 0x180118748
Function at 0x180118820
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
je 0x1801188ff
cmp qword [rcx + 0x70], 0
je 0x1801188ff
cmp dword [rcx + 0x80], 3
jne 0x1801188ff
mov ecx, dword [0x18025e63c]
mov qword [rsp + 0x40], rbp
xor ebp, ebp
test ecx, ecx
jns 0x18011886f
mov rax, rbp
jmp 0x180118875
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x48
lea r8d, [rdx - 0x38]
call fcn.180243b70
mov r9, rax
test rax, rax
je 0x1801188e0
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rbp
mov dword [rax + 0x28], 0xffffffff
mov dword [r9 + 8], 0xa
mov qword [r9 + 0x38], rbp
mov qword [r9 + 0x40], rbp
lea rax, [0x1800431d0]
mov r8, rdi
mov qword [r9], rax
mov qword [r9 + 0x30], rbp
mov rax, qword [rbx + 0x70]
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + 0x20], bpl
mov qword [r9 + 0x38], rax
call fcn.180113400
test rax, rax
jne 0x1801188ea
mov byte [rbx + 0x468], 1
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x18011b580
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
mov rbp, rdx
test rcx, rcx
je 0x18011b5a7
call fcn.18011b580
test eax, eax
js 0x18011b694
mov rax, qword [rbx + 0x40]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18011b688
nop word [rax + rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rdi, qword [rcx + 0x70]
test rdi, rdi
je 0x18011b671
mov rbx, qword [rdi + 0x118]
test rbx, rbx
je 0x18011b65b
cmp qword [rbx + 8], rbp
jne 0x18011b652
mov ecx, dword [0x18025e63c]
mov rsi, qword [rbx]
test ecx, ecx
jns 0x18011b607
xor eax, eax
jmp 0x18011b60d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 8]
mov edx, 0x18
lea r8d, [rdx - 8]
call fcn.180243b70
mov r11, rax
test rax, rax
jne 0x18011b62e
mov eax, 0x8007000e
jmp 0x18011b64e
mov qword [rax], rsi
mov rax, qword [rsp + 0x50]
mov qword [r11 + 8], rax
mov rax, qword [rdi + 0x118]
mov qword [r11 + 0x10], rax
mov qword [rdi + 0x118], r11
xor eax, eax
test eax, eax
js 0x18011b65d
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x18011b5f0
xor eax, eax
test eax, eax
js 0x18011b68a
mov rdi, qword [rdi + 0x80]
test rdi, rdi
jne 0x18011b5e4
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x18011b5d0
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop rbp
pop rbx
ret

Function at 0x18011dbe0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov qword [rsp + 0x30], rsi
mov rsi, rcx
mov ebx, ebp
cmp dword [rcx + 4], ebx
jbe 0x18011dc38
mov qword [rsp + 0x38], rdi
mov rdi, rbp
nop word [rax + rax]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + rdi + 0x18]
test rcx, rcx
je 0x18011dc28
mov edx, 1
call fcn.1800ff4e0
inc ebx
add rdi, 0x28
cmp ebx, dword [rsi + 4]
jb 0x18011dc10
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsp + 0x30]
test rbx, rbx
je 0x18011dc68
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x18011dc59
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov rcx, qword [rbp]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
Function at 0x18011dc80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
sub rsp, 0x38
mov ecx, dword [0x18025e63c]
xor ebx, ebx
test ecx, ecx
jns 0x18011dc9c
mov rax, rbx
jmp 0x18011dca2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x18011ddd9
mov dword [rax], ebx
mov dword [rax + 4], ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rbx
mov dword [rax + 0x18], ebx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], rdi
mov qword [rbp + 8], rcx
mov esi, ebx
cmp dword [rax + 4], ebx
jbe 0x18011dd54
mov rdi, rbx
nop
mov rax, qword [rax + 0x10]
mov r8, rbx
mov qword [rsp + 0x58], rbx
mov rcx, qword [rdi + rax + 0x18]
test rcx, rcx
je 0x18011dd13
call fcn.18011dc80
mov r8, rax
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], r8
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rdi + rdx + 0x10]
mov r9, qword [rdi + rdx + 8]
mov r8d, dword [rdi + rdx + 4]
mov edx, dword [rdi + rdx]
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call fcn.18011ddf0
test eax, eax
jne 0x18011dd68
mov rax, qword [rsp + 0x50]
inc esi
add rdi, 0x28
cmp esi, dword [rax + 4]
jb 0x18011dcf0
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rax, rbp
add rsp, 0x38
pop rbp
pop rbx
ret
mov rcx, rbp
call fcn.18011dbe0
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011dd7f
mov rax, rbx
jmp 0x18011dd85
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x18011ddc6
mov rcx, rdi
call fcn.18011dbe0
mov ecx, dword [0x18025e63c]
test ecx, ecx
js 0x18011ddb8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x38
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x38
pop rbp
pop rbx
ret
Function at 0x18011ddf0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, dword [rcx]
mov r12, r9
mov r13d, r8d
mov r14d, edx
mov rbx, rcx
cmp eax, dword [rcx + 4]
jne 0x18011dec7
test eax, eax
je 0x18011de29
lea edi, [rax + rax]
jmp 0x18011de2e
mov edi, 0x10
mov esi, edi
movabs rax, 0x666666666666666
cmp rsi, rax
ja 0x18011df52
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011de51
xor eax, eax
jmp 0x18011de57
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
lea r8, [rsi + rsi*4]
xor edx, edx
shl r8, 3
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x18011df52
mov ecx, dword [rbx]
mov rdx, qword [rbx + 0x10]
mov qword [rsp + 0x40], rbp
lea r8, [rcx + rcx*4]
mov rcx, rax
shl r8, 3
call sub.msvcrt.dll_memcpy
mov rbp, qword [rbx + 0x10]
test rbp, rbp
je 0x18011debc
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011dea8
xor eax, eax
jmp 0x18011deae
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x40]
mov dword [rbx], edi
mov qword [rbx + 0x10], rsi
mov eax, dword [rbx + 4]
lea rcx, [rax + rax*4]
mov rax, qword [rbx + 0x10]
mov dword [rax + rcx*8], r14d
mov eax, dword [rbx + 4]
lea rcx, [rax + rax*4]
mov rax, qword [rbx + 0x10]
mov dword [rax + rcx*8 + 4], r13d
mov eax, dword [rbx + 4]
lea rcx, [rax + rax*4]
mov rax, qword [rbx + 0x10]
mov qword [rax + rcx*8 + 8], r12
mov eax, dword [rbx + 4]
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + rax*4]
mov rax, qword [rsp + 0x60]
mov qword [rcx + rdx*8 + 0x10], rax
mov eax, dword [rbx + 4]
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + rax*4]
mov rax, qword [rsp + 0x68]
mov qword [rcx + rdx*8 + 0x18], rax
mov eax, dword [rbx + 4]
lea rcx, [rax + rax*4]
mov rax, qword [rbx + 0x10]
mov dword [rax + rcx*8 + 0x20], 0
inc dword [rbx + 4]
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov eax, 0x8007000e
jmp 0x18011df38
Function at 0x18011df60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call fcn.18011e050
mov eax, dword [rdi + 0x10]
lea rdx, [rdi + 0x30]
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rbp + 0x14], eax
mov eax, dword [rdi]
mov dword [rbp], eax
mov eax, dword [rdi + 4]
mov dword [rbp + 4], eax
mov eax, dword [rdi + 0x18]
mov dword [rbp + 0x18], eax
mov eax, dword [rdi + 0x1c]
mov dword [rbp + 0x1c], eax
mov eax, dword [rdi + 0x24]
mov dword [rbp + 0x24], eax
movzx eax, byte [rdi + 0x28]
mov byte [rbp + 0x28], al
call fcn.18011ff80
mov ebx, eax
test eax, eax
js 0x18011e02d
cmp qword [rdi + 8], 0
je 0x18011e02d
mov qword [rsp + 0x30], rsi
mov esi, dword [rdi + 0x10]
cmp rsi, 0xffffffffffffffff
jbe 0x18011dfd6
xor eax, eax
jmp 0x18011dff8
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011dfe4
xor eax, eax
jmp 0x18011dfea
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, qword [rsp + 0x30]
mov qword [rbp + 8], rax
test rax, rax
jne 0x18011e01b
mov eax, 0x8007000e
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8d, dword [rbp + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18011e050
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x30
call fcn.180120170
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x18011e091
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011e07d
xor eax, eax
jmp 0x18011e083
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbx + 0x48]
mov qword [rbx + 8], 0
test rdi, rdi
je 0x18011e0c4
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011e0b0
xor eax, eax
jmp 0x18011e0b6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx + 0x48], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18011e0e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
cmp dword [rcx], 3
mov r13, r9
mov r14d, r8d
mov r12d, edx
mov rdi, rcx
jne 0x18011e22b
cmp r12d, dword [rcx + 0x10]
jb 0x18011e1c8
nop dword [rax]
mov ebx, dword [rdi + 0x10]
test ebx, ebx
je 0x18011e12b
add ebx, ebx
jmp 0x18011e130
mov ebx, 0x80
mov esi, ebx
cmp rsi, 0xffffffffffffffff
ja 0x18011e24c
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011e14a
xor eax, eax
jmp 0x18011e150
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x18011e24c
mov r8d, dword [rdi + 0x14]
mov rdx, qword [rdi + 8]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov ecx, dword [rdi + 0x14]
mov r8d, ebx
sub r8d, ecx
add rcx, rsi
xor edx, edx
call fcn.18024adb8
mov rbp, qword [rdi + 8]
test rbp, rbp
je 0x18011e1b8
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011e1a4
xor eax, eax
jmp 0x18011e1aa
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi + 8], rsi
mov dword [rdi + 0x10], ebx
cmp r12d, ebx
jae 0x18011e120
xor al, al
test byte [rdi + 4], 2
jne 0x18011e203
bt r13, 0x18
movzx eax, al
mov ecx, 8
cmovb eax, ecx
bt r13, 0x12
jae 0x18011e1e9
or al, 0x10
bt r13, 0x14
jae 0x18011e1f2
or al, 0x20
bt r13, 0x13
jae 0x18011e1fb
or al, 0x40
test r14b, 4
je 0x18011e203
or al, 0x80
test r14b, 8
je 0x18011e20b
or al, 4
test r14b, 2
sete dl
inc dl
or dl, al
mov rax, qword [rdi + 8]
mov byte [r12 + rax], dl
lea eax, [r12 + 1]
cmp eax, dword [rdi + 0x14]
jbe 0x18011e22b
mov dword [rdi + 0x14], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov eax, 0x8007000e
jmp 0x18011e22d

Function at 0x18011e260
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rax, r8
mov ebx, edx
mov rsi, rcx
test r8, r8
jne 0x18011e2ea
lea rcx, [0x180027110]
mov eax, edi
mov r8, rcx
nop word [rax + rax]
cmp dword [r8], edx
jae 0x18011e2a2
inc eax
add r8, 4
cmp eax, 0x1c
jb 0x18011e290
jmp 0x18011e2a5
mov ebx, dword [rcx + rax*4]
mov ecx, dword [0x18025e63c]
test ecx, ecx
jns 0x18011e2b4
mov rax, rdi
jmp 0x18011e2ba
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
mov r8d, ebx
xor edx, edx
shl r8, 3
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x18011e2e6
mov eax, 0x8007000e
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsi + 0x48], rax
test rax, rax
lea rcx, [rsi + 0x30]
mov r9, rax
cmovne edi, ebx
mov edx, ebx
mov byte [rsp + 0x20], 0
mov r8d, edi
call fcn.180120230
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18011ec00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cmp dword [rcx + 0x14], 0
mov rsi, rcx
je 0x18011ed14
mov r9d, dword [rcx + 0x18]
mov rax, qword [rcx + 8]
mov r11d, dword [rcx + 0x1c]
mov r8, r9
shr r11d, 6
shr r9d, 6
shr r8, 6
mov qword [rsp + 0x10], rbx
sub r11d, r9d
add r11d, 1
lea rbx, [rax + r8*8]
mov rax, qword [rdx + 8]
lea r10, [rax + r8*8]
je 0x18011ece4
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
lea rbp, [0x18025f2c0]
nop dword [rax]
mov r9, qword [rbx]
mov r8, qword [r10]
dec r11d
mov rcx, r8
add rbx, 8
xor rcx, r9
and rcx, r9
je 0x18011ecca
mov edi, 4
nop dword [rax]
mov rax, rcx
shr rcx, 4
and eax, 0xf
movzx eax, byte [rax + rbp]
add dword [rdx + 0x14], eax
mov rax, rcx
shr rcx, 4
and eax, 0xf
movzx eax, byte [rax + rbp]
add dword [rdx + 0x14], eax
mov rax, rcx
shr rcx, 4
and eax, 0xf
movzx eax, byte [rax + rbp]
add dword [rdx + 0x14], eax
mov rax, rcx
shr rcx, 4
and eax, 0xf
movzx eax, byte [rax + rbp]
add dword [rdx + 0x14], eax
sub rdi, 1
jne 0x18011ec80
or r8, r9
add r10, 8
mov qword [r10 - 8], r8
test r11d, r11d
jne 0x18011ec60
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov ecx, dword [rdx + 0x18]
mov rbx, qword [rsp + 0x10]
cmp ecx, 0xffffffff
jne 0x18011ecff
mov eax, dword [rsi + 0x18]
mov dword [rdx + 0x18], eax
mov eax, dword [rsi + 0x1c]
mov dword [rdx + 0x1c], eax
pop rsi
ret
mov eax, dword [rsi + 0x18]
cmp eax, ecx
jae 0x18011ed09
mov dword [rdx + 0x18], eax
mov eax, dword [rsi + 0x1c]
cmp eax, dword [rdx + 0x1c]
jbe 0x18011ed14
mov dword [rdx + 0x1c], eax
pop rsi
ret