joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011ec20
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x458
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp byte [0x180400b70], 0
jne 0x18011ece2
xor edx, edx
mov byte [0x180400b70], 1
mov r8d, 0x400
lea rcx, [rsp + 0x40]
call fcn.1802c7550
mov r8d, 0x400
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x18001dca0]
lea rcx, [rsp + 0x40]
call fcn.1802c77c8
test rax, rax
je 0x18011ece2
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0xf013f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x18001dcc0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18011ece2
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18001dd60]
xor r9d, r9d
mov r8d, 0x100
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x458
ret

Function at 0x18011f560
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18011f58e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180121950
cmp byte [0x180400b58], 0
jne 0x18011f5d9
lea rcx, [0x18001e680]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18011f5c9
lea rdx, [0x18001e5d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180400b50], rax
mov byte [0x180400b58], 1
jmp 0x18011f5e0
mov rax, qword [0x180400b50]
mov byte [0x180400b58], 1
jmp 0x18011f5e0
mov rax, qword [0x180400b50]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18011f5ff
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1801219c4
lea rcx, [0x18001e680]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1801219e6
lea rdx, [0x18001e120]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801219e6
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x1801219e6
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18011fb90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
test rcx, rcx
jne 0x18011fbc4
xor eax, eax
jmp 0x18011fc4e
mov edx, 1
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
je 0x18011fc44
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
je 0x18011fc44
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18011fc44
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x18011fc44
lea rbx, [r14*2 + 4]
mov rcx, rbx
call fcn.1802b8484
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1802c7550
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call fcn.1802c7100
nop
jmp 0x18011fc4b
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x1801217e0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x180
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.180120c90
mov ebx, eax
test eax, eax
jne 0x180121907
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1801218e1
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1801217e0
mov ebx, eax
test eax, eax
jne 0x180121907
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x180121890
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1801218f6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov rdx, rsi
mov rcx, rdi
call fcn.18011f560
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18012191c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov eax, ebx
mov dword [rsp + 0x50], ebp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1802b85a0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x180121950
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18011f58e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180121950
cmp byte [0x180400b58], 0
jne 0x18011f5d9
lea rcx, [0x18001e680]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18011f5c9
lea rdx, [0x18001e5d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180400b50], rax
mov byte [0x180400b58], 1
jmp 0x18011f5e0
mov rax, qword [0x180400b50]
mov byte [0x180400b58], 1
jmp 0x18011f5e0
mov rax, qword [0x180400b50]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18011f5ff
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1801219c4
lea rcx, [0x18001e680]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1801219e6
lea rdx, [0x18001e120]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801219e6
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x1801219e6
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180122f00
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x180122f40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
mov r11, rcx
test r8, r8
jne 0x180122f5b
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x180122f65
inc eax
mov ecx, eax
add r8d, eax
add rdx, rcx
cmp eax, 1
jne 0x180122f61
mov rcx, qword [r11]
mov rdx, r10
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x1801241b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [0x180400b38]
movzx esi, cl
test al, al
je 0x180124206
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x180400b3c]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [0x180400b38]
test rbx, rbx
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
setne cl
jmp 0x180124208
xor cl, cl
cmp sil, cl
jne 0x180124215
xor al, al
add rsp, 0x20
pop rsi
ret
test al, al
je 0x180124229
mov ecx, dword [0x180400b3c]
movzx edx, sil
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov al, 1
add rsp, 0x20
pop rsi
ret

Function at 0x180127610
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012763a
cmp byte [0x180400b38], 0
je 0x18012763a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127670
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012769a
cmp byte [0x180400b38], 0
je 0x18012769a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801276a0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801276ca
cmp byte [0x180400b38], 0
je 0x1801276ca
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801276d0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801276fa
cmp byte [0x180400b38], 0
je 0x1801276fa
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret
Function at 0x180127700
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012772a
cmp byte [0x180400b38], 0
je 0x18012772a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127730
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012775a
cmp byte [0x180400b38], 0
je 0x18012775a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127760
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012778a
cmp byte [0x180400b38], 0
je 0x18012778a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127790
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801277bf
mov rax, qword [rcx + 8]
cmp byte [0x180400b38], 0
je 0x1801277bf
movzx edx, byte [rax]
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127830
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012785a
cmp byte [0x180400b38], 0
je 0x18012785a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127860
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012788a
cmp byte [0x180400b38], 0
je 0x18012788a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127890
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801278ba
cmp byte [0x180400b38], 0
je 0x1801278ba
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801278c0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x1801278ea
cmp byte [0x180400b38], 0
je 0x1801278ea
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x1801278f0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012791a
cmp byte [0x180400b38], 0
je 0x18012791a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret
Function at 0x180127920
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x18012794a
cmp byte [0x180400b38], 0
je 0x18012794a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180127df0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rcx], 0
mov rdi, rcx
je 0x180127e32
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rdi + 4]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
xor eax, eax
test rdi, rdi
setne al
add rsp, 0x20
pop rdi
ret
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x18012bf40
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
add rcx, 8
call fcn.1802a12a0
nop
lea rcx, [rsi + 8]
call fcn.1802a16e0
mov rdi, rax
xor r15d, r15d
test rdi, rdi
je 0x18012c118
mov rcx, rdi
call fcn.1800f1480
mov rbx, rax
test rax, rax
je 0x18012c104
xor edx, edx
mov r8d, 0x218
lea rcx, [rsp + 0x60]
call fcn.1802c7550
mov rcx, rsi
lea rdx, [rsp + 0x70]
sub rdx, rsi
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x18012bfd0
lea rcx, [rsp + 0x70]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18012bfe7
mov r8d, 0x103
sub r8, rax
mov rdx, qword [rbx]
lea rcx, [rsp + 0x70]
call fcn.1802d8100
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 2
je 0x18012c04b
sub eax, 1
je 0x18012c041
sub eax, 1
je 0x18012c037
cmp eax, 1
je 0x18012c02d
mov dword [rsp + 0x60], 5
jmp 0x18012c053
mov dword [rsp + 0x60], 1
jmp 0x18012c053
mov dword [rsp + 0x60], 3
jmp 0x18012c053
mov dword [rsp + 0x60], 2
jmp 0x18012c053
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], 0
cmp byte [rsp + 0x70], 0
jne 0x18012c07c
mov r8, r15
jmp 0x18012c08f
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18012c085
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1800ace90
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1802b6610
mov rcx, rax
call fcn.1800b2ad0
mov dword [rsp + 0x64], eax
lea rcx, [rsp + 0x40]
call fcn.1800ad110
mov dword [rsp + 0x68], 1
mov eax, dword [rbx + 8]
mov dword [rsp + 0x6c], eax
mov rcx, qword [0x180400ba0]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov edx, send
call qword [rax + 0x48]
mov qword [rsp + 0x38], rbx
mov rcx, rbx
call fcn.1802b20f0
mov edx, reloc.WSOCK32.dll_recv
mov rcx, rbx
call fcn.1802b8d50
mov rdx, rdi
lea rcx, [rsi + 8]
call fcn.1802a1790
mov rdi, rax
jmp 0x18012bf93
jmp 0x18012c11f
xor edx, edx
lea rcx, [rsi + 8]
call fcn.1802a1450
lea rcx, [rsi + 8]
call fcn.1802a1870
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x18012e8b0
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xe8], rbx
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
cmp byte [0x180400b38], 0
je 0x18012e8fe
mov edx, 1
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [rbx + 0x98]
call fcn.1800afec0
mov qword [rsp + 0x50], rax
lea rcx, [rbx + 0x90]
call fcn.1800afec0
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
xor edi, edi
mov qword [rsp + 0x38], rdi
xor eax, eax
movzx r9d, al
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1800b8ce0
nop
mov qword [rsp + 0x20], rdi
xor r9d, r9d
or r8d, 0xffffffff
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1800b1940
test al, al
je 0x18012ea53
nop
lea rcx, [rsp + 0x70]
call fcn.180130470
nop
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18012eda0
test al, al
jne 0x18012e9b9
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x78]
call fcn.1800ad110
lea rcx, [rbx + 0x98]
call fcn.1800afec0
cmp qword [rsp + 0x20], rax
je 0x18012ea53
jmp 0x18012e950
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18012f570
nop
jmp 0x18012e9d0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
cmp rax, 0x10
jb 0x18012ea35
inc rax
mov rcx, qword [rsp + 0x78]
cmp rax, 0x1000
jb 0x18012ea30
test cl, 0x1f
je 0x18012ea03
call fcn.1802d51b4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18012ea12
call fcn.1802d51b4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18012ea21
call fcn.1802d51b4
int3
cmp rcx, 0x27
jbe 0x18012ea2d
call fcn.1802d51b4
int3
mov rcx, rax
call fcn.18011da90
mov qword [rsp + 0x90], socket
mov qword [rsp + 0x88], rdi
mov byte [rsp + 0x78], 0
jmp 0x18012e970
mov rcx, rbx
call fcn.18012eab0
nop
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x18012ea8a
mov r8, qword [rsp + 0x38]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x28]
call fcn.1800b0cd0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1802b85a0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x18012ef20
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rsi, rcx
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x18], recv
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], r14b
mov rdx, qword [rdx]
cmp byte [rdx + 0x40], r14b
je 0x18012f03a
lea rcx, [rbp - 0x50]
cmp byte [rdx + 0x43], r14b
je 0x18012efe1
add rdx, 0x48
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x18012ef9b
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x18012efc3
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.1800ae240
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
test bl, bl
jne 0x18012f02e
mov rdx, qword [rdi]
add rdx, 0x48
jmp 0x18012f03a
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x18012eff1
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x18012f019
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.1800ae240
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
test bl, bl
je 0x18012f037
mov rax, qword [rdi]
mov byte [rax + 0x41], 1
jmp 0x18012f043
mov rdx, qword [rdi]
lea rcx, [rbp - 0x30]
call fcn.1800ab1c0
lea rax, [rbp - 0x50]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1800aad90
nop
mov rbx, qword [rdi]
movzx r8d, byte [rbx + 0x29]
mov rdx, rax
mov rcx, rsi
call fcn.18012eba0
mov rcx, rax
call fcn.1802b4790
mov dword [rbx + 0x30], eax
mov rdx, qword [rdi]
mov rcx, qword [rsi]
call fcn.18012ae20
nop
lea rcx, [rbp - 0x30]
call fcn.1800ad110
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18013bda0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rbp, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test eax, eax
jne 0x18013be03
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x18], recv
mov qword [rdi + 0x10], rax
mov byte [rdi], al
mov dword [rsp + 0x20], 1
jmp 0x18013bea5
lea ebx, [rax + 1]
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.1800bc860
nop
mov r8d, ebx
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.1800aabe0
mov dword [rsp + 0x20], 1
test rbx, rbx
je 0x18013bea5
mov rax, qword [rsp + 0x40]
sub rax, rbx
cmp rax, 0x1000
jb 0x18013be8b
test bl, 0x1f
je 0x18013be5e
call fcn.1802d51b4
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x18013be6d
call fcn.1802d51b4
int3
sub rbx, rax
cmp rbx, 8
jae 0x18013be7c
call fcn.1802d51b4
int3
cmp rbx, 0x27
jbe 0x18013be88
call fcn.1802d51b4
int3
mov rbx, rax
mov rcx, rbx
call fcn.18011da90
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret