joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180160650
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rsi, rcx
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x18067c294]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x180160690
and rdi, 0xfffffffffffffffe
jmp 0x1801606a6
call fcn.18019ab60
xor ecx, ecx
call fcn.1801e8210
mov rdi, rax
mov byte [rax + 0xac], 1
mov rbp, qword [rsi - 0x20]
xor r15d, r15d
mov qword [rsi - 0x20], r15
mov r14, qword [rsi - 0x38]
mov rbx, qword [rdi + 0x98]
test rbx, rbx
je 0x1801606ce
mov rax, qword [rbx - 8]
mov qword [rdi + 0x98], rax
jmp 0x18016071d
lea rcx, [rdi + 0xb8]
cmp qword [rcx], r15
je 0x1801606fb
mov rbx, r15
xchg qword [rcx], rbx
mov rax, qword [case.0x1801e63e9.2]
test rax, rax
je 0x1801606ee
call rax
mov rax, qword [rbx - 8]
mov qword [rdi + 0x98], rax
jmp 0x18016071d
mov edx, 0x100
mov ecx, 1
call fcn.1801e6550
lea rbx, [rax + 0x40]
mov qword [rbx - 0x30], rdi
mov qword [rbx - 8], r15
inc qword [rdi + 0xb0]
mov qword [rbx - 0x38], r14
mov qword [rbx - 0x28], rdi
mov qword [rbx - 0x18], r15
mov dword [rbx - 0x10], r15d
mov qword [rbx - 0x20], rbp
mov dword [rbx - 0xc], 3
mov qword [rsp + 0x60], rbx
lea rax, vtable.tbb::task.0
mov qword [rbx], rax
mov byte [rbx - 0xb], 1
lea rax, vtable.tbb::interface9::internal::flag_task.0
mov qword [rbx], rax
mov byte [rbx + 8], 0
mov qword [rsi - 0x20], rbx
mov qword [rbx - 0x18], 2
mov ecx, dword [0x18067c294]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18016077c
and rax, 0xfffffffffffffffe
jmp 0x18016078f
call fcn.18019ab60
xor ecx, ecx
call fcn.1801e8210
mov byte [rax + 0xac], 1
mov r9, qword [rbx - 0x38]
mov r8, rbx
mov edx, 0x40
mov rcx, rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.1801e6bd0
Function at 0x1801607c0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r14, rdx
mov rsi, rcx
mov eax, dword [rcx]
cmp dword [rcx + 4], eax
jge 0x1801609be
mov dword [rsp + 0x40], 1
mov qword [rbp - 0x40], 0x10002
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov qword [rsp + 0x60], r15
mov qword [rbp - 0x20], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x18067c294]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x18016086a
and rdi, 0xfffffffffffffffe
jmp 0x180160880
call fcn.18019ab60
xor ecx, ecx
call fcn.1801e8210
mov rdi, rax
mov byte [rax + 0xac], 1
mov r9, qword [rsp + 0x20]
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, rdi
call fcn.1801e6bd0
mov rbx, rax
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x1801608c7
mov rax, qword [rdi + 0xa0]
cmp qword [rdi + 0x40], rax
jne 0x1801608ba
mov rax, qword [rsp + 0x20]
mov dword [rax], r15d
jmp 0x1801608c7
mov rdx, rdi
mov rcx, qword [rsp + 0x20]
call fcn.18019a580
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
test ecx, ecx
mov rcx, qword [rsp + 0x20]
jne 0x180160907
mov eax, dword [rcx + 0x80]
bt rax, 0x11
jb 0x180160907
mov rax, qword [rdi + 0xa0]
mov rax, qword [rax - 0x38]
mov rax, qword [rax + 0x70]
mov qword [rcx + 0x70], rax
or qword [rcx + 0x80], 0x20000
mov rcx, qword [rsp + 0x20]
mov rax, qword [0x18066e508]
test rax, rax
jne 0x180160918
mov rax, r15
jmp 0x18016091f
call rax
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x20], rax
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x18016099f
lea rax, vtable.tbb::task.0
mov qword [rbx], rax
mov byte [rbx - 0xb], 1
lea rax, vtable.._AV__start_for_V__blocked_range_H_tbb__VProxyLoopBody__A0xcf67f9a5____CBVauto_partitioner_2__internal_interface9_tbb__.0
mov qword [rbx], rax
movups xmm0, xmmword [rsi]
movups xmmword [rbx + 8], xmm0
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x18], xmm0
movsd xmm1, qword [r14 + 0x10]
movsd qword [rbx + 0x28], xmm1
mov ecx, dword [0x18067c294]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 1
je 0x180160975
and rax, 0xfffffffffffffffe
jmp 0x180160982
mov r8b, 1
mov ecx, 0xffffffff
call fcn.18019ac20
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0xd4]
mov dword [rbx + 0x38], r15d
mov byte [rbx + 0x3c], 5
inc ecx
add rcx, rcx
mov qword [rbx + 0x30], rcx
jmp 0x1801609a2
mov rbx, r15
mov rcx, qword [rbx - 0x28]
mov rax, qword [rcx]
lea r8, [rbx - 8]
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rsp + 0x40]
call fcn.18019a270
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.18042cdf0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180161f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
mov rbx, r9
mov dword [r9], eax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r14d, 0x40000000
mov ecx, dword [rsi + 0x1c]
mov r8d, edi
sub r8d, eax
mov edx, eax
cmp r8d, r14d
cmova r8d, r14d
add rdx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov edx, eax
test eax, eax
jle 0x180161fdc
mov eax, dword [rbx]
add eax, edx
mov dword [rbx], eax
cmp eax, edi
jb 0x180161fb1
test edx, edx
jns 0x180162005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov edx, 0xffffffff
mov rcx, rsi
mov r8, rax
call fcn.180161cd0
mov eax, 0xffffffff
jmp 0x180162010
jne 0x18016200e
mov dword [rsi + 0x50], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18019a270
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov eax, dword [rcx]
cmp eax, 2
jne 0x18019a443
mov rdi, qword [rcx + 0x90]
mov ecx, dword [0x18067c294]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov edx, 1
test rdi, rdi
je 0x18019a2c2
cmp qword [rdi + 0x30], 0
jne 0x18019a2bd
cmp byte [rdi + 0x78], 0
je 0x18019a2c2
mov rcx, rdx
jmp 0x18019a2c4
xor ecx, ecx
or rcx, rdi
cmp rax, rcx
jne 0x18019a3aa
mov rax, qword [rbx + 0x90]
mov r8, qword [rax + 0x148]
mov qword [rax + 0x150], rdx
mfence
mov rax, qword [rbx + 0x90]
mov rax, qword [rax + 0x180]
test rax, rax
je 0x18019a34c
mov rdi, qword [rbx + 0x90]
add rdi, 0x140
mov rcx, rdi
call fcn.180199c30
nop
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov rax, qword [rbx + 0x90]
mov qword [rax + 0x150], 0
test rdi, rdi
je 0x18019a443
mov byte [rdi], 0
jmp 0x18019a443
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov rax, qword [rbx + 0x90]
mov qword [rax + 0x150], 0
cmp r8, qword [0x18067c298]
je 0x18019a443
mov rdi, qword [rbx + 0x90]
add rdi, 0x140
mov rcx, rdi
call fcn.180199c30
nop
test rdi, rdi
je 0x18019a443
mov byte [rdi], 0
jmp 0x18019a443
mov eax, 4
xchg dword [rbx], eax
cmp eax, 3
jne 0x18019a3cf
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
jmp 0x18019a443
mov rax, qword [rbx + 0x90]
lock xadd qword [rax + 0x180], rdx
mov rcx, qword [rbx + 0x90]
add rcx, 0x150
call fcn.18019a830
nop
mov rcx, qword [rbx + 0x90]
add rcx, 0x140
call fcn.180199c30
nop
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov rax, qword [rbx + 0x90]
mov byte [rax + 0x140], 0
mov rcx, qword [rbx + 0x90]
mov rax, 0xffffffffffffffff
lock xadd qword [rcx + 0x180], rax
mov rdi, qword [rbx + 0x88]
test rdi, rdi
je 0x18019a468
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
nop
test rdi, rdi
je 0x18019a468
mov rcx, rdi
call qword [case.0x18019a04c.0]
nop
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18019a480
mov rax, qword [0x18066e518]
test rax, rax
je 0x18019a480
call rax
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18019a680
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x78], 0
mov rdi, rcx
jne 0x18019a7aa
mov ebx, 1
xor eax, eax
lock cmpxchg qword [rcx + 0x78], rbx
jne 0x18019a7aa
mov ecx, dword [0x18067c294]
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18019a6c7
and rax, 0xfffffffffffffffe
jmp 0x18019a6d9
call fcn.18019ab60
xor ecx, ecx
call fcn.1801e8210
mov byte [rax + 0xac], bl
mov rbp, qword [rax + 0x88]
test byte [rdi + 0x98], bl
je 0x18019a798
lea rcx, [0x18067c9f1]
call fcn.180199c30
cmp qword [rdi + 0x78], rbx
je 0x18019a717
mov rbp, qword [rsp + 0x38]
mov al, 1
mov byte [0x18067c9f1], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x40], rsi
lock xadd qword [0x18067c298], rbx
mov eax, dword [rbp + 0x24]
test eax, eax
je 0x18019a74f
lea rbx, [rbp + 0xf8]
mov esi, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x18019a745
mov r8, rdi
call fcn.18019a890
add rbx, 8
sub rsi, 1
jne 0x18019a735
mov rbx, qword [rbp + 0xe8]
lea rsi, [rbp + 0xe0]
cmp rbx, rsi
je 0x18019a78c
xor ebp, ebp
nop dword [rax]
nop dword [rax + rax]
test rbx, rbx
lea rcx, [rbx - 0x10]
mov r8, rdi
cmove rcx, rbp
call fcn.18019a890
mov rbx, qword [rbx + 8]
cmp rbx, rsi
jne 0x18019a770
mov rsi, qword [rsp + 0x40]
mov byte [0x18067c9f1], 0
mov rbp, qword [rsp + 0x38]
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x18019aa90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x18067c294]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rbx, rbx
je 0x18019aacb
cmp qword [rbx + 0x30], 0
jne 0x18019aab7
cmp byte [rbx + 0x78], 0
je 0x18019aacb
mov ecx, 1
or rcx, rbx
cmp rax, rcx
sete al
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
or rcx, rbx
cmp rax, rcx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x18019aae0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x18019ab02
cmp qword [rcx + 0x30], 0
jne 0x18019aafb
cmp byte [rcx + 0x78], 0
je 0x18019ab02
mov edx, 1
jmp 0x18019ab04
xor edx, edx
mov ecx, dword [0x18067c294]
or rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [0x18067c280]
test rax, rax
je 0x18019ab58
mov qword [rsp + 0x28], rbx
lea rcx, [0x18019ad50]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rbx + 0x188]
movdqa xmmword [rsp + 0x20], xmm0
call rax
test eax, eax
je 0x18019ab58
mov qword [rbx + 0x188], 0
add rsp, 0x30
pop rbx
ret
Function at 0x18019ac20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edi, r8b
mov ebx, ecx
call fcn.18019ab60
mov ecx, dword [0x18067c294]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18019ad15
mov rbx, rax
and rbx, 0xfffffffffffffffe
test al, 1
jne 0x18019acfc
call fcn.18019a950
mov ecx, eax
call fcn.1801eaa90
xor edx, edx
mov qword [rbx + 0x30], rax
mov r9d, 1
mov qword [rbx + 0x20], rdx
mov r8, rax
mov word [rbx + 0x50], r9w
lea rcx, [rax + 0x180]
mov qword [rbx + 0x28], rcx
lea rcx, [rax - 0x80]
mov qword [rbx + 0x48], rcx
test rcx, rcx
je 0x18019aca3
cmp byte [rcx + 0x10], r9b
jne 0x18019aca3
test rcx, rcx
je 0x18019aca3
mov byte [rcx + 0x10], dl
add rax, 0x88
mov qword [rbx + 0x68], rax
lea rax, [r8 + 0x108]
mov qword [rbx + 0x70], rax
mov rax, qword [rax]
mov qword [rbx + 0x168], rax
mov rax, qword [rbx + 0x28]
mov qword [rax], rbx
mov rax, qword [rbx + 0xa0]
mov rcx, qword [rbx + 0x30]
mov rax, qword [rax - 0x38]
mov qword [rcx + 0x138], rax
cmp qword [rbx + 0x30], rdx
jne 0x18019acea
cmp byte [rbx + 0x78], dl
je 0x18019aced
mov rdx, r9
mov ecx, dword [0x18067c294]
or rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test dil, dil
jne 0x18019ad07
inc dword [rbx + 0xa8]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ebx, 0xffffffff
jne 0x18019ad21
call fcn.18019a950
mov ebx, eax
mov ecx, ebx
call fcn.1801eaa90
mov rcx, rax
call fcn.1801e8210
mov rbx, qword [rsp + 0x30]
mov byte [rax + 0xac], dil
add rsp, 0x20
pop rdi
ret
Function at 0x1801a2df0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1801a2e24
lea rcx, str._have_cleartype_quality
call fcn.1801fcc40
xor eax, eax
add rsp, 0x148
ret
cmp dword [rsp + 0x24], 5
ja 0x1801a2e34
jne 0x1801a2e1a
cmp dword [rsp + 0x28], 1
jb 0x1801a2e1a
mov eax, 1
add rsp, 0x148
ret
Function at 0x1801b2590
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r10d, dword [0x18067c038]
mov ebp, r9d
mov rax, qword gs:[0x58]
mov ebx, r8d
mov r14d, dword [rsp + 0x60]
mov edi, edx
mov r9d, dword [rsp + 0x58]
mov r8, rcx
mov r15d, dword [rsp + 0x50]
mov esi, dword [rsp + 0x48]
mov r12d, 0x30
add r12, qword [rax + r10*8]
xor r11d, r11d
mov r10d, r11d
lea rax, [r12 + 0x14]
nop
cmp dword [rax - 0xc], edi
jne 0x1801b2620
cmp dword [rax - 8], ebx
jne 0x1801b2620
cmp dword [rax], esi
jne 0x1801b2620
cmp dword [rax + 8], r9d
jne 0x1801b2620
cmp dword [rax - 4], ebp
jne 0x1801b2620
cmp dword [rax + 4], r15d
jne 0x1801b2620
cmp dword [rax + 0xc], r14d
jne 0x1801b2620
cmp qword [rax + 0x14], 0
jne 0x1801b26cb
inc r11d
inc r10
add rax, 0x30
cmp r10, 8
jl 0x1801b25f0
test rcx, rcx
je 0x1801b26ac
mov rax, qword [r8 + 0x10]
mov ecx, dword [rax]
cmp ecx, 0x3f
je 0x1801b26a3
cmp ecx, edi
je 0x1801b2649
cmp ecx, 0x40
jne 0x1801b2697
mov ecx, dword [rax + 4]
cmp ecx, ebx
je 0x1801b2658
cmp ecx, 0x50000
jne 0x1801b2697
mov ecx, dword [rax + 0xc]
cmp ecx, esi
je 0x1801b2667
cmp ecx, 0x50000
jne 0x1801b2697
mov ecx, dword [rax + 0x14]
cmp ecx, r9d
je 0x1801b2677
cmp ecx, 0x50000
jne 0x1801b2697
mov ecx, dword [rax + 8]
and ecx, ebp
cmp ecx, dword [rax + 8]
jne 0x1801b2697
mov ecx, dword [rax + 0x10]
and ecx, r15d
cmp ecx, dword [rax + 0x10]
jne 0x1801b2697
mov ecx, dword [rax + 0x18]
and ecx, r14d
cmp ecx, dword [rax + 0x18]
je 0x1801b26e8
mov ecx, dword [rax + 0x28]
add rax, 0x28
cmp ecx, 0x3f
jne 0x1801b2640
mov r8, qword [r8 + 8]
test r8, r8
jne 0x1801b2635
xor eax, eax
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov rdx, qword [rsp + 0x68]
movsxd rax, r11d
lea rcx, [rax + rax*2]
add rcx, rcx
mov rax, qword [r12 + rcx*8]
mov qword [rdx], rax
mov rax, qword [r12 + rcx*8 + 0x28]
jmp 0x1801b26fa
mov rdx, qword [rsp + 0x68]
mov r11d, 7
mov qword [rdx], r8
mov rax, qword [rax + 0x20]
mov r8, qword [rsp + 0x70]
mov qword [r8], rax
test r11d, r11d
je 0x1801b2773
movsxd rcx, r11d
lea rax, [rcx + rcx*2]
shl rax, 4
add rax, r12
nop word [rax + rax]
lea rax, [rax - 0x30]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rax + 0x40], xmm1
movups xmmword [rax + 0x50], xmm0
sub rcx, 1
jne 0x1801b2720
mov rax, qword [rdx]
mov qword [r12], rax
mov rax, qword [r8]
mov qword [r12 + 0x28], rax
mov dword [r12 + 8], edi
mov dword [r12 + 0xc], ebx
mov dword [r12 + 0x10], ebp
mov dword [r12 + 0x14], esi
mov dword [r12 + 0x18], r15d
mov dword [r12 + 0x1c], r9d
mov dword [r12 + 0x20], r14d
mov eax, 1
jmp 0x1801b26ae
Function at 0x1801b36c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov ecx, 0x818
mov qword [rsp + 0x30], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebp, ebp
test rax, rax
jne 0x1801b36e5
mov esi, ebp
jmp 0x1801b36f9
mov r8, rax
lea rdx, [0x180591fe0]
xor ecx, ecx
call fcn.1801b2d50
mov rsi, rax
mov rcx, rsi
mov qword [rsp + 0x38], rdi
call fcn.18025f580
call fcn.18026adf0
lea rax, [fcn.18007f290]
mov qword [rsi + 0x20], rax
lea rcx, [fcn.18007f290]
lea rax, [0x18020e080]
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x28], rax
lea rcx, str.PIXMAN_DISABLE
lea rax, [0x18020e2f0]
mov qword [rsi + 0x30], rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
je 0x1801b37a8
nop dword [rax]
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rdi, rax
test rax, rax
je 0x1801b376a
sub edi, ebx
jmp 0x1801b377c
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x1801b3771
mov edi, eax
cmp edi, 4
jne 0x1801b3798
mov r8d, edi
lea rcx, str.fast
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1801b37bd
movsxd rax, edi
add rbx, rax
movzx eax, byte [rbx]
inc rbx
test al, al
jne 0x1801b3750
mov ecx, 0x818
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x1801b37d2
mov rsi, rbp
jmp 0x1801b37e7
lea rdx, str.fast
lea rcx, str.pixman:_Disabled__s_implementation_n
call fcn.18013ddc0
jmp 0x1801b37f2
mov r8, rax
lea rdx, [0x180593770]
mov rcx, rsi
call fcn.1801b2d50
mov rsi, rax
lea rax, [0x180235fe0]
mov qword [rsi + 0x20], rax
lea rcx, str.PIXMAN_DISABLE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
je 0x1801b3868
nop word [rax + rax]
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rdi, rax
test rax, rax
je 0x1801b382a
sub edi, ebx
jmp 0x1801b383c
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x1801b3831
mov edi, eax
cmp edi, 4
jne 0x1801b3858
mov r8d, edi
lea rcx, str.sse2
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1801b38c6
movsxd rax, edi
add rbx, rax
movzx eax, byte [rbx]
inc rbx
test al, al
jne 0x1801b3810
mov rcx, rsi
call fcn.180229290
mov rsi, rax
mov ecx, 0x818
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test rax, rax
je 0x1801b38a2
mov r8, rax
lea rdx, [0x1805936f0]
mov rcx, rsi
call fcn.1801b2d50
mov rbp, rax
lea rax, [0x180229520]
mov qword [rbp + 0x28], rax
lea rax, [0x1802296a0]
mov qword [rbp + 0x30], rax
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea rdx, str.sse2
lea rcx, str.pixman:_Disabled__s_implementation_n
call fcn.18013ddc0
jmp 0x1801b3873
Function at 0x1801c8ba0
Capabilities:
Hash data using djb2

Disassembly:
mov rdx, rcx
mov ecx, 0x1505
test rdx, rdx
jne 0x1801c8bb0
xor eax, eax
ret
movzx eax, byte [rdx]
test al, al
je 0x1801c8bd7
nop word [rax + rax]
imul rcx, rcx, 0x21
movzx eax, al
lea rdx, [rdx + 1]
add rcx, rax
movzx eax, byte [rdx]
mov ecx, ecx
test al, al
jne 0x1801c8bc0
mov eax, ecx
ret
Function at 0x1801dcc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r11d, eax
mov r9d, eax
and r11d, 7
je 0x1801dcc44
cmp eax, r11d
jge 0x1801dcc35
call fcn.1801dc2b0
mov eax, dword [rbx + 0x10]
mov ecx, r11d
shr dword [rbx + 0x14], cl
sub eax, r11d
mov dword [rbx + 0x10], eax
mov r9d, eax
xor r8d, r8d
test eax, eax
jle 0x1801dcc80
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + 0x14]
inc r8d
mov byte [rdx], al
inc rdx
lea eax, [r9 - 8]
shr ecx, 8
mov dword [rbx + 0x14], ecx
mov r9d, eax
test eax, eax
jg 0x1801dcc60
mov dword [rbx + 0x10], eax
jns 0x1801dccad
mov edx, dword [0x18067c038]
mov rax, qword gs:[0x58]
mov ecx, reloc.WS2_32.dll_recv
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1801dccdf
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x1801dccc9
xor dl, dl
jmp 0x1801dccd2
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1801dccc0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1801dcc82
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1801dcd54
mov edx, dword [0x18067c038]
mov rax, qword gs:[0x58]
mov ecx, reloc.WS2_32.dll_recv
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1801dcd6e
mov rcx, rbx
call fcn.1801dc400
test eax, eax
je 0x1801dcd47
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1801e6a50
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rbx, rcx
xor sil, sil
mov rcx, qword [rcx + 0x148]
mov edi, 1
xor r14d, r14d
mov qword [rbx + 0x150], rdi
mfence
mov rax, qword [rbx + 0x180]
test rax, rax
jne 0x1801e6a9e
cmp rcx, qword [0x18067c298]
je 0x1801e6aad
lea r14, [rbx + 0x140]
mov rcx, r14
call fcn.180199c30
mov rdx, qword [rbx + 0x138]
lea r8, [rbx + 0x130]
cmp rdx, r8
je 0x1801e6ade
lea rcx, [rdx - 0x10]
movzx esi, sil
mov rdx, qword [rdx + 8]
mov eax, 3
xchg dword [rcx], eax
cmp eax, 4
cmove esi, edi
cmp rdx, r8
jne 0x1801e6ac0
test r14, r14
je 0x1801e6ae7
mov byte [r14], 0
mov qword [rbx + 0x150], 0
test sil, sil
je 0x1801e6b03
lea rcx, [rbx + 0x180]
call fcn.18019a830
mov rcx, qword [rbx + 0xa0]
mov byte [rcx - 0xc], 4
mov rax, qword [rbx + 0x98]
mov qword [rcx - 8], rax
mov qword [rbx + 0x98], rcx
mov rax, qword [rbx + 0x98]
test rax, rax
je 0x1801e6b54
nop dword [rax]
mov rcx, qword [rax - 8]
mov qword [rbx + 0x98], rcx
lea rcx, [rax - 0x40]
call qword [case.0x1801f7166.0]
mov rax, qword [rbx + 0x98]
inc rdi
test rax, rax
jne 0x1801e6b30
cmp qword [rbx + 0xb8], 0xffffffffffffffff
je 0x1801e6b75
mov rax, 0xffffffffffffffff
xchg qword [rbx + 0xb8], rax
mov qword [rbx + 0x98], rax
jmp 0x1801e6b20
mov ecx, dword [0x18067c294]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [rbx + 0x188]
test rax, rax
je 0x1801e6b98
mov rcx, qword [rbx + 0x190]
call rax
mov rax, rdi
neg rax
lock xadd qword [rbx + 0xb0], rax
cmp rax, rdi
jne 0x1801e6bb5
mov rcx, rbx
call qword [case.0x1801f7166.0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x1801e74b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x18067c294]
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 1
je 0x1801e74d6
and rax, 0xfffffffffffffffe
jmp 0x1801e74e3
mov r8b, 1
mov ecx, 0xffffffff
call fcn.18019ac20
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1801e7110