joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005910
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rbx, r8
mov rcx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180005a20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
mov rbp, r9
call fcn.18003eed0
xor r12d, r12d
mov edi, 0x20019
nop word [rax + rax]
lea rax, [rsp + 0x38]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x180005af8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, rbp
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x180005aed
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
jne 0x180005b18
cmp rsi, 0xffffffff80000002
jne 0x180005b18
cmp edi, 0x20019
jne 0x180005b18
mov edi, 0x20219
jmp 0x180005a70
mov qword [r14 + 0x10], r12
lea rax, [rsp + 0x40]
mov qword [r14 + 0x18], 7
mov r8, 0xffffffffffffffff
mov word [r14], r12w
inc r8
cmp word [rax + r8*2], r12w
jne 0x180005b34
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.180005be0
mov rax, r14
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18001fcf0
add rsp, 0x260
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180005f40
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor bl, bl
xor ebp, ebp
mov r12, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x10], rbp
je 0x1800060bf
cmp qword [rdx + 0x10], rbp
je 0x1800060bf
cmp qword [rdx + 0x18], 0x10
mov rcx, rdx
mov qword [rsp + 0x80], r15
jb 0x180005f81
mov rcx, qword [rdx]
lea rdx, [rsp + 0x70]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov r15d, eax
test eax, eax
je 0x1800060ba
mov ecx, r15d
mov qword [rsp + 0x78], r14
lea rdx, [0x180093c38]
call fcn.18001fd84
mov r14, rax
test rax, rax
je 0x18000609f
cmp qword [rdi + 0x18], 0x10
jb 0x180005fc0
mov rdi, qword [rdi]
mov edx, dword [rsp + 0x70]
mov r9, r14
mov r8d, r15d
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x18000608a
lea r9, [rsp + 0x88]
mov rcx, r14
lea r8, [rsp + 0x30]
lea rdx, str.VarFileInfoTranslation
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x18000608a
mov rax, qword [rsp + 0x30]
lea rdx, [0x180093c38]
mov ecx, 0x80
movzx edi, word [rax]
movzx eax, word [rax + 2]
shl edi, 0x10
or edi, eax
call fcn.18001fd84
mov rbp, rax
test rax, rax
je 0x18000608a
cmp qword [rsi + 0x18], 0x10
jb 0x180006032
mov rsi, qword [rsi]
mov r9d, edi
mov qword [rsp + 0x20], rsi
lea r8, str.StringFileInfo_08lx_s
mov edx, 0x80
mov rcx, rbp
call fcn.1800060e0
lea r9, [rsp + 0x88]
mov rdx, rbp
lea r8, [rsp + 0x38]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x180006088
mov rdx, qword [rsp + 0x38]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180006076
mov rcx, r12
call fcn.180002270
mov bl, 1
mov rcx, r14
call fcn.18001f4e0
test rbp, rbp
je 0x18000609f
mov rcx, rbp
call fcn.18001f4e0
mov r14, qword [rsp + 0x78]
movzx eax, bl
mov r15, qword [rsp + 0x80]
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx eax, bl
jmp 0x1800060a7
movzx eax, bl
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180007a10
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov r13, rdx
mov rcx, 0xffffffffffffffff
xor bpl, bpl
mov rbx, rcx
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x180007a40
lea r15, [rbx + 1]
mov eax, 2
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.18001fd14
xor r12d, r12d
mov r14, rax
test r15, r15
je 0x180007a7a
movzx eax, r12w
mov rdi, r14
mov rcx, r15
rep stosw word [rdi], ax
mov r8, rsi
mov rdx, r15
mov rcx, r14
call fcn.18004240c
mov rdi, r12
nop dword [rax + rax]
movzx esi, word [r14 + rdi*2]
cmp si, 0x5c
je 0x180007aa1
cmp si, 0x2f
jne 0x180007ae3
mov rcx, r14
mov word [r14 + rdi*2], r12w
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007ade
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180007aed
mov rcx, qword [r13 + 0x38]
mov bpl, 1
test rcx, rcx
je 0x180007ade
mov qword [rsp + 0x60], r14
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov word [r14 + rdi*2], si
inc rdi
cmp rdi, rbx
jbe 0x180007a90
jmp 0x180007af0
xor bpl, bpl
mov rcx, r14
call fcn.18001f4e0
mov rbx, qword [rsp + 0x50]
movzx eax, bpl
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180007c10
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
movzx ebx, r8b
mov edi, edx
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.18003eed0
mov edx, edi
lea rax, [rsp + 0x30]
bts edx, 0xf
mov qword [rsp + 0x20], rax
test bl, bl
cmove edx, edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], 7
mov word [rsi], cx
test eax, eax
jne 0x180007caa
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], cx
jne 0x180007c93
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180005be0
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18001fcf0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180007d30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x238
call fcn.18003eed0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180007dbf
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180007db6
lea rdx, str.EXPLORER.EXE
lea rcx, [rsp + 0x4c]
call fcn.1800492d0
mov rcx, rbx
test eax, eax
je 0x180007ded
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180007d90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, rdi
call fcn.1800080a0
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18001fcf0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x28]
jmp 0x180007dc1
Function at 0x1800199a0
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
mov ecx, dword [rcx + 0x30]
cmp ecx, 0xffffffff
je 0x1800199e4
call fcn.18004e5f0
mov dword [rdi + 0x30], 0xffffffff
mov r8d, dword [rdi + 0x48]
dec r8d
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.180016860
nop
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rcx, qword [rsp + 0x68]
call fcn.18004d258
mov ebx, dword [rdi + 0x48]
sub ebx, 2
js 0x180019b0a
xor esi, esi
mov r8d, ebx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.180016860
nop
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.180016860
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180019aac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019aa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019b85
call fcn.18001f4e0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x180019b01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019afc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019b8b
call fcn.18001f4e0
sub ebx, 1
jns 0x180019a20
mov rcx, rdi
call fcn.180019130
mov byte [rdi + 0x90], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x180019b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019b7f
call fcn.18001f4e0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18001fcf0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
int3
Function at 0x180019ba0
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
mov ecx, dword [rcx + 0x30]
cmp ecx, 0xffffffff
je 0x180019be4
call fcn.18004e5f0
mov dword [rdi + 0x30], 0xffffffff
mov r8d, dword [rdi + 0x48]
dec r8d
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.180016860
nop
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rcx, qword [rsp + 0x68]
call fcn.18004d258
mov ebx, dword [rdi + 0x48]
sub ebx, 2
js 0x180019d0a
xor esi, esi
mov r8d, ebx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.180016860
nop
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.180016860
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180019cac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019ca7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019d85
call fcn.18001f4e0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x180019d01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019cfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019d8b
call fcn.18001f4e0
sub ebx, 1
jns 0x180019c20
mov rcx, rdi
call fcn.180019390
mov byte [rdi + 0x90], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x180019d5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019d55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019d7f
call fcn.18001f4e0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18001fcf0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
int3
Function at 0x18001add0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14d, dword [rsp + 0x110]
mov rbp, rcx
mov rcx, rdx
mov edi, r9d
mov ebx, r8d
mov rsi, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001ae1b
mov eax, 2
jmp 0x18001af0c
mov rdx, rbp
lea rcx, [rsp + 0x90]
call fcn.18001aa90
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call fcn.18003eed0
test r14d, r14d
mov dword [rsp + 0x20], 0x70
lea rcx, str.runas
mov qword [rsp + 0x38], rsi
lea rax, [0x18006c878]
mov dword [rsp + 0x24], 0x40
cmovne rax, rcx
mov qword [rsp + 0x48], 0
cmp qword [rsp + 0xa8], 8
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
cmovae rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x88]
mov esi, eax
test rcx, rcx
je 0x18001aec6
test ebx, ebx
je 0x18001aec6
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x18001af0a
mov rcx, qword [rsp + 0x90]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001af05
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001af2a
call fcn.18001f4e0
mov eax, esi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18001fcf0
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.180041e0c
int3
Function at 0x180021d88
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180021d9b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1800223b8
lea rdx, [0x18008e4e0]
lea rcx, [rsp + 0x20]
call fcn.18003ede0
int3

Function at 0x180027f50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, dword [0x180094638]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x180027f75
mov rcx, rax
call fcn.18002e424
cmp rax, rdi
je 0x180027fbe
mov bl, 1
mov rcx, rdi
mov dl, bl
call fcn.180027fdc
mov al, byte [0x18009474c]
mov dl, 4
mov r8d, dword [rdi + 0x258]
cmp al, dl
jb 0x180027fa3
mov eax, dword [0x180094748]
test bl, al
jne 0x180027fa5
xor bl, bl
test bl, bl
je 0x180027fb3
mov ecx, 7
call fcn.18002bb9c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.180022290
lea rdx, [0x18008e660]
lea rcx, [rsp + 0x20]
call fcn.18003ede0
int3

Function at 0x18002dfb4
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180094638]
xor edx, edx
jmp fcn.180021d88

Function at 0x18002e974
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180094638]
jmp fcn.180021d88
Function at 0x180036320
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, rcx
and dword [rbp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x90], eax
lea r14, [rsi + 0x10]
mov rcx, r14
call fcn.18002e974
mov rdi, qword [rsi + 0x48]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.18002053c
lea rdx, [rbp + 0x30]
mov rcx, rdi
call rbx
nop
mov dword [rbp + 0x20], 1
mov edx, 9
mov rcx, rax
call fcn.180030604
test eax, eax
jne 0x1800363a1
call fcn.180024a70
cmp eax, 6
jne 0x1800363a1
mov dil, 1
jmp 0x1800363a4
xor dil, dil
lea rcx, [rbp + 0x30]
call fcn.1800305d0
test dil, dil
je 0x1800363bc
mov ecx, 1
call fcn.1800332d0
mov rcx, r14
call fcn.18001a120
and dword [rsi + 0x120], 0
xor bl, bl
mov rcx, rsi
call fcn.180036548
test al, al
je 0x1800363eb
mov rcx, rsi
call fcn.180036a48
mov bl, al
test al, al
jne 0x1800364a6
and dword [rbp - 0x38], 0
and qword [rbp - 0x28], 0
and byte [rsi + 0x127], 0xfd
mov rcx, qword [rsi + 0x108]
test rcx, rcx
je 0x1800364cc
cmp byte [rsi + 0x126], 0
jne 0x18003643d
mov rcx, qword [rsi + 0x108]
call fcn.180034cdc
test al, al
je 0x18003643d
mov rcx, r14
call fcn.18001a120
mov rcx, qword [rsi + 0x48]
call fcn.180028458
mov rcx, r14
call fcn.18001a120
lea rdx, [rbp - 0x38]
mov rcx, rsi
call fcn.180037694
mov rcx, rsi
test al, al
je 0x180036479
cmp dword [rbp - 0x38], 1
jne 0x180036464
xor r8d, r8d
mov rdx, qword [rbp - 0x28]
call fcn.1800371e8
jmp 0x18003649c
lea rdx, [rbp - 0x38]
call fcn.1800364f0
mov rcx, rsi
call fcn.180036a48
mov bl, al
jmp 0x18003649e
call fcn.180036a48
test al, al
jne 0x18003649c
mov rcx, rsi
call fcn.180037534
mov al, byte [rsi + 0x124]
test al, al
je 0x18003649e
mov rcx, rsi
call fcn.1800362f8
mov bl, 1
test bl, bl
je 0x1800363eb
test dil, dil
je 0x1800364b0
call fcn.180033308
mov rcx, r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
jmp fcn.18002dfb4
mov rcx, r14
call fcn.18001a120
lea rcx, [rbp - 0x20]
call fcn.1800223a0
lea rdx, [0x18008e9c0]
lea rcx, [rbp - 0x20]
call fcn.18003ede0
int3
Function at 0x18003f9b4
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x180075af8]
xor ecx, ecx
lea r8, [0x180075af0]
lea rdx, str.FlsAlloc
call fcn.18003f7dc
mov rbx, rax
test rax, rax
je 0x18003f9f4
mov rcx, rax
call fcn.18002053c
mov rcx, rdi
call rbx
jmp 0x18003f9fa
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18003fa5c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180075b08]
mov ecx, 2
lea r8, [0x180075b00]
lea rdx, str.FlsGetValue
call fcn.18003f7dc
mov rdi, rax
test rax, rax
je 0x18003fa9d
mov rcx, rax
call fcn.18002053c
mov ecx, ebx
call rdi
jmp 0x18003faa5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18003fab0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x180075b10]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x180075b08]
call fcn.18003f7dc
mov rsi, rax
test rax, rax
je 0x18003fafc
mov rcx, rax
call fcn.18002053c
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x18003fb07
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18004d230
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18004d250
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180044ca4
or eax, 0xffffffff
jmp 0x18004d252
xor eax, eax
add rsp, 0x28
ret
jmp 0x18004d230

Function at 0x18004d258
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18004d250
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180044ca4
or eax, 0xffffffff
jmp 0x18004d252
xor eax, eax
add rsp, 0x28
ret
jmp 0x18004d230
Function at 0x180058bec
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180058a52
call fcn.180044d14
mov dword [rax], 0x16
call fcn.180041dec
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180058a34
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180058a34
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x180058a84
lock or dword [rax + 0x14], 0x10
jmp 0x180058a34
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180058aa1
mov rcx, qword [rbp + 0x20]
call fcn.180060b5c
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x180058ab6
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x180058abc
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1800563cc
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1800582d8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x180058b0f
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x180058a34
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x180058b7b
mov rcx, qword [rbp + 0x20]
call fcn.1800563cc
cmp eax, 0xffffffff
je 0x180058b62
mov rcx, qword [rbp + 0x20]
call fcn.1800563cc
cmp eax, 0xfffffffe
je 0x180058b62
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1800563cc
movsxd rdi, eax
lea r15, [0x180094e30]
mov rcx, rbx
sar rdi, 6
call fcn.1800563cc
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x180058b69
lea rax, [0x180090560]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180058b7b
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x180058bb1
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180058bad
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180058bad
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x180058bcf
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x180058bda
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x180058a39
jmp 0x180058a00