joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011ae8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
cmp qword [rcx + 0x40], 0
mov rbx, rcx
mov qword [rcx + 8], rdx
jne 0x180011b7b
lea rcx, [0x18003a808]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x180011bde
lea rdx, str.CoInitialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x180011bde
mov rcx, qword [rbx + 0x40]
lea rdx, str.CoCreateInstance
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x180011bde
mov rcx, qword [rbx + 0x40]
lea rdx, str.CoUninitialize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x180011bde
mov edi, 0x11c
lea rcx, [rbp - 0x30]
xor edx, edx
mov r8d, edi
call qword [sym.imp.msvcrt.dll_memset]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x180011bb5
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180011bde
cmp dword [rbp - 0x20], 2
jne 0x180011bde
cmp dword [rbp - 0x2c], 6
jne 0x180011bde
xor ecx, ecx
call qword [rbx + 0x50]
test eax, eax
jns 0x180011bf5
lea rdx, str.CoInitializeEx_failed:__x_n
mov ecx, 0x42
mov r8d, eax
call fcn.180030818
xor al, al
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
xor edx, edx
lea rdi, [rbx + 0x10]
lea r9, [0x1800386f8]
lea r8d, [rdx + 1]
lea rcx, [0x180038908]
mov qword [rsp + 0x20], rdi
call qword [rbx + 0x58]
test eax, eax
jns 0x180011c27
lea rdx, str.Failed_to_create_an_instance_of_ITaskService:__x_n
mov ecx, 0x4b
jmp 0x180011bd6
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi]
lea rdx, [rbp - 0x50]
movups xmm1, xmmword [rsp + 0x30]
movsd xmm0, qword [rsp + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x50]
movsd qword [rbp - 0x40], xmm0
movsd qword [rsp + 0x60], xmm0
movsd qword [rbp - 0x80], xmm0
movsd qword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x70]
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x70], xmm1
call qword [rax + 0x50]
lea rcx, [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x180011ca9
mov r8d, ebx
lea rdx, str.ITaskService::Connect_failed:__x_n
mov ecx, 0x57
jmp 0x180011bd9
mov al, 1
jmp 0x180011be0
Function at 0x180012990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
movdqa xmm0, xmmword [str.WriteProcessorPw0_0_f]
mov rdi, rcx
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0xec
mov dword [rsp + 0x20], 0x6e72656b
movdqa xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
mov dword [rsp + 0x40], 0x68635372
mov dword [rsp + 0x44], 0x656d65
call sub.msvcrt.dll_memset
and qword [rdi + 0x10], 0
and dword [rdi + 0x20], 0
and qword [rdi + 0x18], 0
lea r11, [rsp + 0x30]
lea rax, [rbp + 0x50]
lea rcx, [rsp + 0x20]
sub r11d, eax
mov word [rdi + 0x24], 1
mov dword [rbp + 0x50], r11d
movsxd rax, r11d
xor dword [rbp + rax + 0x5c], 0x183d1722
movsxd rax, dword [rbp + 0x50]
xor dword [rbp + rax + 0x60], 0x55632a00
movsxd rax, dword [rbp + 0x50]
lea rbx, [rbp + rax + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [rdi + 8], 0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov qword [rdi], rax
mov rax, rdi
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18001498c
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rcx
call fcn.180012bf8
xor ebx, ebx
mov rsi, rax
test rax, rax
je 0x180014a0f
cmp rax, 0xffffffffffffffff
je 0x180014a0d
test rbp, rbp
je 0x180014a0d
mov r8d, dword [rdi + 0x20]
test r8d, r8d
je 0x1800149f3
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180014a0d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
setne bl
mov al, bl
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800153e4
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, qword [0x180044098]
xor ebx, ebx
lea eax, [rbx + 1]
lock cmpxchg dword [r9 + 0x30], ebx
test eax, eax
jne 0x180015404
xor al, al
jmp 0x18001542e
lea r8, [0x180015434]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
je 0x180015400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180015e80
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x70
mov eax, dword [rcx]
mov rbx, rcx
lea rdx, [r11 - 0x38]
mov dword [rsp + 0x40], eax
and qword [r11 - 0x30], 0
and qword [r11 - 0x28], 0
and qword [r11 - 0x20], 0
and qword [r11 - 0x18], 0
lea rcx, [0x180015fa8]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdi, qword [rsp + 0x48]
test rdi, rdi
jne 0x180015edf
mov rdi, qword [rsp + 0x50]
test rdi, rdi
jne 0x180015edf
mov rax, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
test rax, rax
cmovne rdi, rax
lea rdx, str.hwnd__x_n
mov r8, rdi
mov ecx, 0x46a
call fcn.180030818
and qword [rsp + 0x30], 0
xor r9d, r9d
lea edx, [r9 + 0x10]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0x1388
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov r8d, dword [rbx]
test rax, rax
je 0x180015f3f
lea rdx, str.SendMessageTimeoutW___d_n
mov ecx, 0x46d
call fcn.180030818
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180015f50
lea rdx, str._SendMessageTimeoutW___d_n
mov ecx, 0x471
call fcn.180030818
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180015f94
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r8d, dword [rbx]
test eax, eax
je 0x180015f83
lea rdx, str.TerminateProcess___d_n
mov ecx, 0x477
jmp 0x180015f8f
lea rdx, str._TerminateProcess___d_n
mov ecx, 0x479
call fcn.180030818
and dword [rbx], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x180016044
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
xor edx, edx
mov rdi, rcx
lea rcx, [rbp - 0x49]
lea r8d, [rdx + 0x18]
call qword [sym.imp.msvcrt.dll_memset]
mov ebx, 0x68
lea rcx, [rbp - 0x29]
mov r8d, ebx
xor edx, edx
call qword [sym.imp.msvcrt.dll_memset]
lea rax, [rbp + 0x77]
lea rdx, [0x18003bf10]
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x29], ebx
mov word [rbp + 0x17], si
mov dword [rbp + 0x13], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 0x800
test eax, eax
jne 0x180016123
mov rcx, qword [rdi + 8]
lea edx, [rbx - 0x60]
mov r8d, r12d
mov dword [rbp + 0x6f], r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x77]
mov rbx, rax
test rax, rax
je 0x18001611d
lea rax, [rbp + 0x6f]
lea rdx, [0x18003bf08]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180016144
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 8]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1800161a6
xor eax, eax
jmp 0x18001622b
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 0x49]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180016198
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180016123
lea rdx, str.CreateProcess__to_Reg__n
mov ecx, 0x588
jmp 0x180016223
lea rcx, str._ProgramFiles_Internet_Exploreriexplore.exe
mov r8d, r12d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r11, [rbp - 0x49]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180016217
lea rdx, str.____CreateProcess_n
mov ecx, 0x597
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18001613d
lea rdx, str.CreateProcess__to_Path__n
mov ecx, 0x59b
call fcn.180030818
mov eax, dword [rbp - 0x39]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x18001626c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
cmp qword [rcx + 0x20], 0xffffffffffffffff
lea rax, vtable.TNPTransport.0
mov edi, edx
mov rbx, rcx
mov dword [rsp + 0x58], esi
mov qword [rcx], rax
lea ebp, [rsi + 1]
je 0x18001636d
xor eax, eax
cmp dword [rcx + 0x30], esi
jne 0x18001630d
lock cmpxchg dword [rcx + 0x60], ebp
mov ecx, dword [rcx + 0x5c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1800162f5
mov dword [rsp + 0x30], esi
lea r8, [rsp + 0x58]
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
test eax, eax
jne 0x1800162ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x1800162f5
mov rcx, rbx
call fcn.180016918
xor eax, eax
lock cmpxchg dword [rbx + 0x58], esi
test eax, eax
jle 0x18001632a
cmp qword [rbx + 0x20], 0xffffffffffffffff
je 0x18001632a
mov rcx, qword [rbx + 0x68]
jmp 0x18001631f
lock cmpxchg dword [rcx + 0x60], ebp
jne 0x18001632a
cmp qword [rcx + 0x20], 0xffffffffffffffff
je 0x18001632a
mov rcx, qword [rcx + 0x68]
mov edx, 0x927c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbx + 0x5c]
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x18001635c
mov rcx, qword [rbx + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x18001636d
mov qword [rbx + 0x38], rsi
jmp 0x18001636d
lea rdx, str._HeapFree__NULL_n
mov ecx, 0xc5
call fcn.180030818
lea rax, vtable.TAbstractTransport.0
mov qword [rbx], rax
test bpl, dil
je 0x180016385
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180016678
Capabilities:
Get thread local storage value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x40], 0
cmp dword [rcx + 0x30], 0
mov rdi, r8
mov ebx, edx
jne 0x1800166a4
mov edx, 1
mov eax, edx
lock cmpxchg dword [rcx + 0x60], edx
jne 0x1800166a4
xor eax, eax
jmp 0x1800166db
mov ecx, dword [rcx + 0x5c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1800166a0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800166a0
cmp dword [rsp + 0x40], ebx
cmovb ebx, dword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800166e8
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
and dword [rsp + 0x60], 0
cmp dword [rcx + 0x30], 0
mov r15d, 0x200
mov r13d, r15d
mov r12, rdx
mov rbx, rcx
jne 0x18001672d
mov ecx, 1
mov eax, ecx
lock cmpxchg dword [rbx + 0x60], ecx
jne 0x18001672d
xor eax, eax
jmp 0x1800167cf
mov ecx, dword [rbx + 0x5c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x180016726
mov rcx, qword [rbx + 0x20]
mov r8, r15
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180016726
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, r15d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [rsp + 0x60]
jmp 0x1800167c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1800167fc
mov rcx, qword [rbx + 0x20]
add r13d, r15d
mov r8, rdi
mov r9d, r13d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdi, rax
test rax, rax
je 0x1800167e6
and qword [rsp + 0x20], 0
mov edx, ebp
lea r9, [rsp + 0x60]
add rdx, rax
mov r8d, r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
add ebp, dword [rsp + 0x60]
test eax, eax
je 0x180016778
mov qword [r12], rdi
mov eax, ebp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x106
lea rdx, str._HeapFree__NULL_n
call fcn.180030818
jmp 0x180016726
test rdi, rdi
je 0x180016815
mov rcx, qword [rbx + 0x20]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180016726
mov ecx, 0x10c
jmp 0x1800167eb
Function at 0x18001681c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x40
cmp dword [rcx + 0x30], 0
mov eax, dword [rcx + 0x44]
mov rbx, rcx
mov dword [rsp + 0x50], eax
mov r12d, 1
jne 0x180016854
mov eax, r12d
lock cmpxchg dword [rcx + 0x60], r12d
jne 0x180016854
xor al, al
jmp 0x180016906
lock add dword [rcx + 0x58], r12d
mov edx, dword [rcx + 0x40]
mov rcx, qword [rcx + 0x38]
jmp 0x180016887
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x1800168d4
mov edx, dword [rbx + 0x48]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1800168d4
mov edx, dword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
bts edx, 0x1f
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180016862
lea rdx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x1800168f3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
lock xadd dword [rbx + 0x58], eax
dec eax
jne 0x18001684d
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x18001684d
mov ecx, dword [rbx + 0x5c]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1800168cb
mov al, r12b
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r12
ret

Function at 0x180016918
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov rbx, rcx
je 0x18001694f
mov ecx, dword [rcx + 0x5c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18001694f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lock dec dword [rbx + 0x58]
jne 0x18001694f
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
add rsp, 0x20
pop rbx
ret
Function at 0x180016ccc
Capabilities:
Create thread
Resume thread

Disassembly:
sub rsp, 0x38
cmp qword [rcx + 0x20], 0xffffffffffffffff
jne 0x180016cdb
xor al, al
jmp 0x180016d0d
and qword [rsp + 0x28], 0
mov r9, rcx
lea r8, [0x180016c70]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
je 0x180016cd7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
add rsp, 0x38
ret

Function at 0x180016d74
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdx, qword [rcx]
mov rdi, rcx
mov ecx, dword [rbx + 0x5c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180016d9e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x70]
cmp dword [rbx + 0x30], 2
jne 0x180016daf
mov rdx, rdi
mov rcx, rbx
call fcn.180036cbc
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180016dd8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x30], 0
mov rdi, rcx
mov ecx, dword [rcx + 0x5c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x180016e66
mov r8, qword [rdi]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [r8 + 0x58]
mov r8d, eax
test eax, eax
je 0x180016e5d
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x180016e43
mov rcx, qword [rdi + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180016e54
and qword [rsp + 0x30], 0
jmp 0x180016e54
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x240
call fcn.180030818
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180016e74
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov eax, dword [rcx + 0x44]
and dword [rsp + 0x70], 0
cmp dword [rcx + 0x30], 0
mov dword [r11 + 0x20], eax
mov rbp, r8
mov esi, edx
mov rbx, rcx
mov r13d, 1
jne 0x180016eb8
mov eax, r13d
lock cmpxchg dword [rcx + 0x60], r13d
jne 0x180016eb8
xor al, al
jmp 0x180016fd8
lock add dword [rcx + 0x58], r13d
mov edx, dword [rcx + 0x40]
and qword [rsp + 0x30], 0
mov rcx, qword [rcx + 0x38]
and dword [rsp + 0x28], 0
bts edx, 0x1f
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or r12, 0xffffffffffffffff
jmp 0x180016f35
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x180016f61
mov edx, dword [rbx + 0x48]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x180016f61
and qword [rsp + 0x30], 0
mov edx, dword [rbx + 0x40]
and dword [rsp + 0x28], 0
mov rcx, qword [rbx + 0x38]
bts edx, 0x1f
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r12
je 0x180016eed
lea rdx, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rcx, rdi
test eax, eax
jne 0x180016f81
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
lock xadd dword [rbx + 0x58], eax
add eax, r12d
jne 0x180016eb1
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x180016eb1
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
test eax, eax
je 0x180016f5b
cmp dword [rsp + 0x70], esi
jae 0x180016fb8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r12d
lock xadd dword [rbx + 0x58], ecx
add ecx, r12d
jmp 0x180016fc9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
lock xadd dword [rbx + 0x58], eax
add eax, r12d
jne 0x180016fd5
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov al, r13b
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180017024
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rsi, rdx
mov rdx, r9
mov rbp, r9
mov rdi, r8
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x18001705e
xor al, al
jmp 0x180017075
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x18001705a
mov dword [rdi], eax
mov qword [rsi], rbx
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x180019508
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov r12, r8
mov rsi, rdx
mov r13, rcx
mov dword [rax + 0x18], ebp
cmp qword [r8 + 0x10], rbp
je 0x18001956a
mov rdi, qword [r8 + 8]
mov rbx, qword [rdi]
jmp 0x180019565
mov rcx, rbx
mov rbx, qword [rbx]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
dec qword [r12 + 0x10]
cmp rbx, rdi
jne 0x18001953f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180019587
xor al, al
jmp 0x18001968f
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test eax, eax
jne 0x18001959f
mov al, 1
jmp 0x18001968f
mov rcx, qword [r13 + 8]
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x180019580
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180019675
lea r15, [rbx + r13]
mov r14, r13
cmp r13, r15
jae 0x180019672
mov rbx, qword [r14]
mov rsi, qword [r12 + 8]
mov ecx, 0x20
mov rdi, qword [rsi + 8]
mov rax, rbx
mov qword [rsp + 0x38], rbx
shr rax, 0x20
mov qword [rsp + 0x30], rax
mov eax, r14d
sub eax, r13d
add eax, 8
mov dword [rsp + 0x98], eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rdi, rdi
mov qword [rax], rsi
mov rcx, rax
cmovne rcx, rdi
mov qword [rax + 8], rcx
mov qword [rsi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
add rax, 0x10
je 0x18001965b
mov ecx, dword [rsp + 0x98]
mov dword [rax], ebx
mov dword [rax + 4], ecx
mov rcx, qword [rsp + 0x30]
mov dword [rax + 8], ecx
mov eax, dword [rsp + 0x3c]
inc qword [r12 + 0x10]
lea r14, [r14 + rax + 8]
cmp r14, r15
jb 0x1800195ed
mov bpl, 1
mov rcx, qword [rsp + 0x80]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bpl
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret