joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001e80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov rbp, qword [0x1804d0840]
cmp rcx, rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
mov rsi, rcx
mov r12, rdx
je 0x180001ee0
lea rcx, [rsp + 0x30]
call fcn.180001710
lea rcx, [rsp + 0x20]
mov r8, qword [rax]
mov rax, qword [rax + 8]
mov qword [rcx], r8
mov qword [rcx + 8], rax
mov rdi, qword [rsp + 0x20]
test rdi, rdi
jne 0x180001f4e
mov eax, 2
jmp 0x180001fde
test rbp, rbp
je 0x180001f2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rbp]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rbp, rbp
je 0x180001f2f
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rdi, qword [rsp + 0x20]
jmp 0x180001f4e
test r12, r12
je 0x180001ed6
mov rax, qword [r12]
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [r12 + 8]
mov qword [rcx + 8], rax
mov rdi, qword [rsp + 0x20]
xor ebx, ebx
test rsi, rsi
je 0x180001fdc
test rdi, rdi
je 0x180001fc7
cmp qword [rsi + 8], rbx
je 0x180001fc7
test r12, r12
je 0x180001fc7
lea rcx, [rsi + 0x10]
mov qword [rsp + 0x48], r13
call fcn.180001910
test eax, eax
jne 0x180001fb5
lea rcx, [rdi + 0x48]
call fcn.180001910
mov r11, qword [rdi + 0x178]
test r11, r11
je 0x180001f9f
cmp qword [r11 + 8], rsi
je 0x180001fac
mov r11, qword [r11 + 0x10]
test r11, r11
jne 0x180001f90
mov rdx, rsi
mov rcx, rdi
call fcn.180001010
mov ebx, eax
lea rcx, [rdi + 0x48]
call fcn.180001a80
lea rcx, [rsi + 0x10]
call fcn.180001a80
test ebx, ebx
mov r13, qword [rsp + 0x48]
jne 0x180001fdc
mov ecx, dword [rsi]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, reloc.WS2_32.dll_inet_addr
test eax, eax
cmove ebx, ecx
mov eax, ebx
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1800029d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov rsi, qword [0x1804d0848]
test rsi, rsi
mov ebp, ecx
jne 0x1800029fd
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
je 0x180002a61
test ebp, ebp
je 0x180002a51
mov rax, qword [rsi]
test rax, rax
je 0x180002a51
mov rcx, qword [rsi + 8]
call rax
mov rdx, qword [rsi + 0x10]
mov rcx, qword [0x1804d0848]
call fcn.180001e80
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x180002a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov rbp, qword [0x1804d0848]
mov qword [rsp + 0x40], rsi
mov rsi, rcx
test rbp, rbp
je 0x180002ae2
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rbp]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 0x10], rbp
mov rcx, qword [0x1804d0848]
mov rdx, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
jmp fcn.180001e80
Function at 0x1800037e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
cmp dword [0x1804d0838], 0
je 0x1800038c2
mov qword [rsp + 0x50], rsi
mov rsi, qword [0x1804d0840]
test rsi, rsi
je 0x180003879
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
je 0x180003879
cmp dword [rsi + 0x44], 1
jne 0x180003879
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rdx], rcx
lea rcx, [rsp + 0x20]
mov qword [rdx + 8], rax
call fcn.1800034e0
mov rax, qword [0x1804d0840]
xor edx, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.1800033e0
mov rcx, qword [0x1804d0828]
mov rsi, qword [rsp + 0x50]
test rcx, rcx
je 0x1800038b0
lea rdx, str.QueueUserAPCEx_Fini
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800038a3
call rax
mov rcx, qword [0x1804d0828]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x1804d0830]
test rcx, rcx
je 0x1800038c2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add rsp, 0x38
ret
jmp 0x1800037e0

Function at 0x1800038d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x48
cmp dword [0x1804d0838], 0
je 0x1800039c2
mov qword [rsp + 0x60], rsi
mov rsi, qword [0x1804d0840]
test rsi, rsi
je 0x1800039b3
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
mov rdi, qword [rsp + 0x68]
je 0x18000399f
mov rcx, qword [rsi + 0x10]
lea rax, [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsi + 0x18]
mov qword [rax + 8], rcx
lea rcx, [rsp + 0x20]
call fcn.180002000
lea rcx, [rsi + 0x58]
call fcn.180001910
lea rcx, [rsi + 0x58]
mov dword [rsi + 0x28], 6
call fcn.180001a80
cmp dword [rsi + 0x44], 1
jne 0x18000399f
mov rax, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsi + 0x18]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x30]
call fcn.1800034e0
mov rax, qword [0x1804d0840]
xor edx, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, 1
add rsp, 0x48
ret
mov eax, 1
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
mov eax, 1
add rsp, 0x48
ret
Function at 0x180003ad0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp dword [0x1804d0838], 0
je 0x180003ae7
mov eax, 1
add rsp, 0x28
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov dword [0x1804d0838], 1
lea edx, [rbx + 0x20]
lea ecx, [rbx + 1]
mov qword [rsp + 0x48], rdi
call fcn.18028c898
test rax, rax
mov rdi, rax
jne 0x180003b15
lea ebx, [rax + 0xc]
jmp 0x180003b31
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rdi], eax
jne 0x180003b31
mov rcx, rdi
mov ebx, reloc.WS2_32.dll_inet_addr
call fcn.180281a3c
xor edi, edi
test ebx, ebx
mov qword [0x1804d0840], rdi
jne 0x180003b7d
lea edx, [rbx + 0x20]
lea ecx, [rbx + 1]
xor edi, edi
call fcn.18028c898
test rax, rax
mov rbx, rax
jne 0x180003b56
lea edi, [rax + 0xc]
jmp 0x180003b72
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
jne 0x180003b72
mov rcx, rbx
mov edi, reloc.WS2_32.dll_inet_addr
call fcn.180281a3c
xor ebx, ebx
test edi, edi
mov qword [0x1804d0848], rbx
je 0x180003b82
call fcn.1800033e0
lea rcx, [0x1804d8480]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1804d8500]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1804d8400]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1804d84c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1804d8440]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1804d83c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x1804d0838]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x180003cd0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x68], rdi
mov edi, ecx
lea rcx, [rsp + 0x30]
mov rbp, rdx
call fcn.180001710
lea rcx, [rsp + 0x20]
mov r8, qword [rax]
mov rax, qword [rax + 8]
mov qword [rcx], r8
mov qword [rcx + 8], rax
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x180003e6d
test edi, edi
je 0x180003d20
cmp edi, 1
jne 0x180003e6d
lea rcx, [rbx + 0x58]
mov qword [rsp + 0x60], rsi
call fcn.180001910
test rbp, rbp
je 0x180003d39
mov eax, dword [rbx + 0x60]
mov dword [rbp], eax
test edi, edi
mov dword [rbx + 0x60], edi
jne 0x180003e49
cmp dword [rbx + 0x64], edi
jne 0x180003e49
mov rcx, qword [rbx + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180003e49
mov rcx, qword [rbx + 0x68]
mov dword [rbx + 0x28], 4
mov dword [rbx + 0x60], 1
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rbx + 0x58]
call fcn.180001a80
mov rsi, qword [0x1804d0840]
test rsi, rsi
jne 0x180003d92
xor ebp, ebp
jmp 0x180003dc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rbp, rbp
je 0x180003dc9
test byte [rbp + 0x170], 1
je 0x180003de0
call fcn.1800038d0
mov ecx, 0xffffffff
call fcn.180294cd8
nop
nop
mov rsi, qword [0x1804d0848]
test rsi, rsi
je 0x180003e3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
je 0x180003e3a
mov rax, qword [rsi]
test rax, rax
je 0x180003e28
mov rcx, qword [rsi + 8]
call rax
mov rdx, qword [rsi + 0x10]
mov rcx, qword [0x1804d0848]
call fcn.180001e80
jmp 0x180003de0
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.18027c294
int3
lea rcx, [rbx + 0x58]
call fcn.180001a80
mov rsi, qword [rsp + 0x60]
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, reloc.WS2_32.dll_shutdown
add rsp, 0x48
ret
Function at 0x180003e90
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x68], rdi
mov edi, ecx
lea rcx, [rsp + 0x30]
mov rbp, rdx
call fcn.180001710
lea rcx, [rsp + 0x20]
mov r8, qword [rax]
mov rax, qword [rax + 8]
mov qword [rcx], r8
mov qword [rcx + 8], rax
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x18000402d
cmp edi, 1
je 0x180003ee0
test edi, edi
jne 0x18000402d
lea rcx, [rbx + 0x58]
mov qword [rsp + 0x60], rsi
call fcn.180001910
test rbp, rbp
je 0x180003ef9
mov eax, dword [rbx + 0x64]
mov dword [rbp], eax
cmp dword [rbx + 0x60], 0
mov dword [rbx + 0x64], edi
jne 0x180004009
test edi, edi
jne 0x180004009
mov rcx, qword [rbx + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180004009
mov rcx, qword [rbx + 0x68]
mov dword [rbx + 0x28], 4
mov dword [rbx + 0x60], 1
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rbx + 0x58]
call fcn.180001a80
mov rsi, qword [0x1804d0840]
test rsi, rsi
jne 0x180003f53
xor ebp, ebp
jmp 0x180003f8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rbp, rbp
je 0x180003f8a
test byte [rbp + 0x170], 1
je 0x180003fa0
call fcn.1800038d0
mov ecx, 0xffffffff
call fcn.180294cd8
nop
nop
mov rsi, qword [0x1804d0848]
test rsi, rsi
je 0x180003ffa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
je 0x180003ffa
mov rax, qword [rsi]
test rax, rax
je 0x180003fe8
mov rcx, qword [rsi + 8]
call rax
mov rdx, qword [rsi + 0x10]
mov rcx, qword [0x1804d0848]
call fcn.180001e80
jmp 0x180003fa0
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.18027c294
int3
lea rcx, [rbx + 0x58]
call fcn.180001a80
mov rsi, qword [rsp + 0x60]
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, reloc.WS2_32.dll_shutdown
add rsp, 0x48
ret
Function at 0x180004050
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
call fcn.180001710
lea rdx, [rsp + 0x20]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x1800041b2
mov eax, dword [rbx + 0x28]
cmp eax, 3
jne 0x1800041b2
lea rcx, [rbx + 0x58]
mov qword [rsp + 0x68], rdi
call fcn.180001910
cmp dword [rbx + 0x60], 1
je 0x1800041a4
mov rcx, qword [rbx + 0x68]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rbx + 0x58]
mov dword [rbx + 0x28], 4
call fcn.180001a80
lea rcx, [rbx + 0x58]
mov dword [rbx + 0x60], 1
call fcn.180001a80
mov rsi, qword [0x1804d0840]
test rsi, rsi
jne 0x1800040ec
xor ebp, ebp
jmp 0x180004123
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rbp, rbp
je 0x180004123
test byte [rbp + 0x170], 1
je 0x180004132
call fcn.1800038d0
mov ecx, 0xffffffff
call fcn.180294cd8
mov rsi, qword [0x1804d0848]
test rsi, rsi
je 0x18000418c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
je 0x18000418c
mov rax, qword [rsi]
test rax, rax
je 0x18000417a
mov rcx, qword [rsi + 8]
call rax
mov rdx, qword [rsi + 0x10]
mov rcx, qword [0x1804d0848]
call fcn.180001e80
jmp 0x180004132
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.18027c294
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
lea rcx, [rbx + 0x58]
call fcn.180001a80
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x1800044b6
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rcx, qword [str.KERNEL32.DLL]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
mov edx, dword [0x1803c3b01]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov edx, dword [0x1803c3b01]
mov rcx, rax
call fcn.180004406
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0xffffffff
mov rcx, qword [str.puddock.eps]
nop
inc eax
cmp word [rdi + rax*2], 0
jne 0x180004516
lea edx, [rax - 1]
cmp word [rdi + rdx*2], 0x5c
je 0x18000454a
nop word cs:[rax + rax]
mov edx, eax
mov word [rdi + rdx*2], 0
lea edx, [rax - 2]
dec eax
cmp word [rdi + rdx*2], 0x5c
jne 0x180004536
movzx ebx, byte [rcx]
test bl, bl
je 0x18000456d
mov edx, 1
movsx ebp, bl
mov ebx, eax
mov word [rdi + rbx*2], bp
inc eax
mov ebp, edx
movzx ebx, byte [rcx + rbp]
inc edx
test bl, bl
jne 0x180004556
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 1
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x18000484a
mov rbx, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov edi, dword [0x1803c3b19]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov edx, dword [0x1803c3b19]
mov rcx, rax
call fcn.180004406
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000484a
mov r15d, dword [rsp + 0x3c]
mov esi, dword [0x1803c3aed]
lea r12, [rdi + rsi]
mov eax, dword [rdi + rsi]
test eax, eax
je 0x180004711
mov ecx, dword [rdi + rsi + 4]
lea rdx, [rdi + rsi]
add rdx, 4
lea r8d, [rax - 1]
xor r9d, r9d
cmp r8d, 6
jbe 0x1800046fd
inc r8
mov r9, r8
and r9, 0xfffffffffffffff8
movd xmm0, ecx
pshufd xmm0, xmm0, 0
lea rbp, [r9 - 8]
mov r10, rbp
shr r10, 3
inc r10
test rbp, rbp
je 0x18000481b
mov rbp, r10
and rbp, 0xfffffffffffffffe
lea rbx, [rsi + rdi]
add rbx, 0x38
xor esi, esi
nop dword [rax + rax]
xor esi, esi
test r10b, 1
jne 0x1800046d4
jmp 0x1800046f4
Function at 0x1800049b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rdi
mov esi, edx
mov edi, 1
call fcn.180001710
mov rcx, qword [rax]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rbx, qword [rsp + 0x30]
xor ebp, ebp
test rbx, rbx
je 0x180004a15
cmp dword [rbx + 0x60], ebp
jne 0x180004a1a
mov rax, qword [rbx + 0x68]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x180004a1a
lea edi, [rbp + 2]
jmp 0x180004a1a
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x20]
mov r9d, esi
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x180004b5a
cmp eax, 1
je 0x180004a51
mov ebp, reloc.WS2_32.dll_shutdown
mov ecx, 0x274c
cmp eax, 0x102
cmove ebp, ecx
jmp 0x180004b5a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test rbx, rbx
je 0x180004b55
lea rcx, [rbx + 0x58]
call fcn.180001910
mov eax, dword [rbx + 0x28]
cmp eax, 4
jge 0x180004b4c
lea rcx, [rbx + 0x58]
mov dword [rbx + 0x28], 4
mov dword [rbx + 0x60], 1
call fcn.180001a80
mov rsi, qword [0x1804d0840]
test rsi, rsi
je 0x180004ad4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rbp, rbp
je 0x180004ad4
test byte [rbp + 0x170], 1
je 0x180004ae3
call fcn.1800038d0
mov ecx, 0xffffffff
call fcn.180294cd8
mov rsi, qword [0x1804d0848]
test rsi, rsi
je 0x180004b3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
je 0x180004b3d
mov rax, qword [rsi]
test rax, rax
je 0x180004b2b
mov rcx, qword [rsi + 8]
call rax
mov rdx, qword [rsi + 0x10]
mov rcx, qword [0x1804d0848]
call fcn.180001e80
jmp 0x180004ae3
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.18027c294
int3
lea rcx, [rbx + 0x58]
call fcn.180001a80
mov ebp, reloc.WS2_32.dll_shutdown
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
add rsp, 0x58
ret

Function at 0x180004b80
Capabilities:
Get thread local storage value

Disassembly:
mov edx, 0xffffffff
jmp fcn.1800049b0
Function at 0x180008910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rcx + 0x38]
mov r14, rcx
mov r9d, dword [rcx + 0x94]
xor r13d, r13d
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
nop dword [rax]
mov esi, dword [r14 + 0x50]
mov edx, dword [r14 + 0x8c]
sub esi, edx
sub esi, r9d
jne 0x180008962
test edx, edx
jne 0x180008971
test r9d, r9d
jne 0x180008971
mov esi, ebx
jmp 0x180008a10
cmp esi, 0xffffffff
jne 0x180008971
mov esi, 0xfffffffe
jmp 0x180008a10
mov ecx, dword [r14 + 0x38]
add ecx, 0xfffffefa
add ecx, ebx
cmp edx, ecx
jb 0x180008a10
mov rcx, qword [r14 + 0x48]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.18027aec0
mov r8d, dword [r14 + 0x6c]
mov rax, qword [r14 + 0x60]
sub dword [r14 + 0x90], ebx
sub dword [r14 + 0x8c], ebx
sub dword [r14 + 0x7c], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, bx
cmp ecx, ebx
cmovb ax, r13w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x1800089c0
mov rax, qword [r14 + 0x58]
mov r8d, ebx
lea rdx, [rax + rbx*2]
nop dword [rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, bx
cmp ecx, ebx
cmovb ax, r13w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x1800089f0
add esi, ebx
mov r15, qword [r14]
mov ecx, dword [r15 + 8]
test ecx, ecx
je 0x180008ad9
mov edx, dword [r14 + 0x94]
mov r12d, dword [r14 + 0x8c]
add r12, rdx
add r12, qword [r14 + 0x48]
cmp ecx, esi
cmovbe esi, ecx
test esi, esi
jne 0x180008a42
mov esi, r13d
jmp 0x180008a86
mov rax, qword [r15 + 0x28]
sub ecx, esi
mov rbp, qword [r15]
mov dword [r15 + 8], ecx
cmp dword [rax + 0x2c], r13d
jne 0x180008a68
mov ecx, dword [r15 + 0x4c]
mov r8d, esi
mov rdx, rbp
call fcn.1800096e0
mov dword [r15 + 0x4c], eax
mov r8d, esi
mov rdx, rbp
mov rcx, r12
mov edi, esi
call fcn.18027aec0
add qword [r15], rdi
add dword [r15 + 0xc], esi
mov edx, dword [r14 + 0x94]
lea r9d, [rdx + rsi]
mov dword [r14 + 0x94], r9d
cmp r9d, 3
jb 0x180008ac3
mov eax, dword [r14 + 0x8c]
mov rdx, qword [r14 + 0x48]
mov ecx, dword [r14 + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [r14 + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [r14 + 0x74]
mov dword [r14 + 0x68], r8d
cmp r9d, 0x106
jae 0x180008ad9
mov rax, qword [r14]
cmp dword [rax + 8], r13d
jne 0x180008940
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret