joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016410
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800e4040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18001643d
xor eax, eax
jmp 0x18001659a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180016468
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180016468
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x18001659a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18001658d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1800164ab
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800164d6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180016592
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180016545
sub eax, 1
je 0x180016545
cmp eax, 2
jne 0x18001658d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180016592
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180016573
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18001658d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180016592
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800ad680
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180017ca0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800e4040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180017d73
cmp byte [rcx + 0x71], 0
je 0x180017d73
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180017d6f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180017d34
sub eax, 1
je 0x180017d38
cmp eax, 2
jne 0x180017d6f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800ad680
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180017d66
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180017d6f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180017d1c
xor al, al
jmp 0x180017d1c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800ad680
add rsp, 0x60
pop rbx
ret

Function at 0x18002aec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
jne 0x18002af10
lea rax, [0x1800e64e0]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x18002ac60]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18002af10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x18002c750
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18002c78a
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [0x1800e64f8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [0x1800e6508]
call fcn.18002c270
lea rax, [rdi - 1]
mov qword [0x1800e6520], rax
mov qword [0x1800e6528], rdi
lea rax, [0x1800e64f0]
mov qword [rsp + 0x20], rax
mov rax, qword [0x1800e64f8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18002c8d4
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
mov rcx, qword [rcx]
movzx r11d, byte [rax + 0x10]
xor r11, rsi
imul r11, rdi
movzx edx, byte [rax + 0x11]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x12]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x13]
xor r11, rdx
imul r11, rdi
and r11, qword [0x1800e6520]
shl r11, 4
add r11, qword [0x1800e6508]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18002c853
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18002c8c8
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18002c890
mov r10, qword [rdx]
cmp r10, rax
je 0x18002c88a
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18002c8c8
cmp r9, rdx
je 0x18002c8a4
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18002c8ed
cmp r9, rdx
jne 0x18002c895
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18002c800
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18002c8c8
Function at 0x180033b60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0xf
mov r9, qword [rdx + 0x10]
jbe 0x180033b6e
mov rdx, qword [rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x180033ba4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
inc r8
xor rax, rcx
imul rax, r10
cmp r8, r9
jb 0x180033b90
ret
Function at 0x180050890
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1800e6638]
xor r14d, r14d
mov ebx, r14d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800e65b8], esi
je 0x1800508e4
cmp rbx, 0x20
jae 0x1800508cd
xor ecx, ecx
jmp 0x1800508cf
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x1800508c3
cmp qword [0x1800e65c0], r14
je 0x180050a1a
test rdi, rdi
jne 0x180050901
xor ecx, ecx
call fcn.1800abdc4
mov edi, eax
jmp 0x18005092c
mov ecx, dword [0x1800e6a3c]
mov ebx, r14d
test ecx, ecx
je 0x180050927
mov r8, qword [0x1800e6a30]
mov rax, r8
cmp rdi, qword [rax]
je 0x180050962
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180050918
mov edi, 4
mov eax, r14d
xchg dword [0x1800e65b8], eax
test edi, edi
je 0x180050942
cmp edi, 6
jne 0x180050a26
mov rcx, qword [0x1800e6638]
call fcn.1800ac138
test eax, eax
jne 0x180050a28
mov qword [0x1800e6638], r14
jmp 0x180050a28
cmp ebx, 0xffffffff
je 0x180050927
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x180050a10
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov edi, eax
test eax, eax
jne 0x18005092c
xor edx, edx
mov ecx, ebx
call fcn.1800abcb4
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x18005092c
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800509f7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800509e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800509c0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18005092c
mov edi, 6
jmp 0x18005092c
xchg dword [0x1800e65b8], r14d
mov edi, 2
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180050a40
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1800e6628]
xor r14d, r14d
mov ebx, r14d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800e65b8], esi
je 0x180050a94
cmp rbx, 0x20
jae 0x180050a7d
xor ecx, ecx
jmp 0x180050a7f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180050a73
cmp qword [0x1800e65c0], r14
je 0x180050bca
test rdi, rdi
jne 0x180050ab1
xor ecx, ecx
call fcn.1800abdc4
mov edi, eax
jmp 0x180050adc
mov ecx, dword [0x1800e6a3c]
mov ebx, r14d
test ecx, ecx
je 0x180050ad7
mov r8, qword [0x1800e6a30]
mov rax, r8
cmp rdi, qword [rax]
je 0x180050b12
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180050ac8
mov edi, 4
mov eax, r14d
xchg dword [0x1800e65b8], eax
test edi, edi
je 0x180050af2
cmp edi, 6
jne 0x180050bd6
mov rcx, qword [0x1800e6628]
call fcn.1800ac138
test eax, eax
jne 0x180050bd8
mov qword [0x1800e6628], r14
jmp 0x180050bd8
cmp ebx, 0xffffffff
je 0x180050ad7
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x180050bc0
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov edi, eax
test eax, eax
jne 0x180050adc
xor edx, edx
mov ecx, ebx
call fcn.1800abcb4
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x180050adc
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180050ba7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180050b98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180050b70
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180050adc
mov edi, 6
jmp 0x180050adc
xchg dword [0x1800e65b8], r14d
mov edi, 2
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180050bf0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1800e6618]
xor r14d, r14d
mov ebx, r14d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800e65b8], esi
je 0x180050c44
cmp rbx, 0x20
jae 0x180050c2d
xor ecx, ecx
jmp 0x180050c2f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180050c23
cmp qword [0x1800e65c0], r14
je 0x180050d7a
test rdi, rdi
jne 0x180050c61
xor ecx, ecx
call fcn.1800abdc4
mov edi, eax
jmp 0x180050c8c
mov ecx, dword [0x1800e6a3c]
mov ebx, r14d
test ecx, ecx
je 0x180050c87
mov r8, qword [0x1800e6a30]
mov rax, r8
cmp rdi, qword [rax]
je 0x180050cc2
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180050c78
mov edi, 4
mov eax, r14d
xchg dword [0x1800e65b8], eax
test edi, edi
je 0x180050ca2
cmp edi, 6
jne 0x180050d86
mov rcx, qword [0x1800e6618]
call fcn.1800ac138
test eax, eax
jne 0x180050d88
mov qword [0x1800e6618], r14
jmp 0x180050d88
cmp ebx, 0xffffffff
je 0x180050c87
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x180050d70
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov edi, eax
test eax, eax
jne 0x180050c8c
xor edx, edx
mov ecx, ebx
call fcn.1800abcb4
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x180050c8c
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180050d57
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180050d48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180050d20
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180050c8c
mov edi, 6
jmp 0x180050c8c
xchg dword [0x1800e65b8], r14d
mov edi, 2
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180050da0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1800e6608]
xor r14d, r14d
mov ebx, r14d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800e65b8], esi
je 0x180050df4
cmp rbx, 0x20
jae 0x180050ddd
xor ecx, ecx
jmp 0x180050ddf
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180050dd3
cmp qword [0x1800e65c0], r14
je 0x180050f2a
test rdi, rdi
jne 0x180050e11
xor ecx, ecx
call fcn.1800abdc4
mov edi, eax
jmp 0x180050e3c
mov ecx, dword [0x1800e6a3c]
mov ebx, r14d
test ecx, ecx
je 0x180050e37
mov r8, qword [0x1800e6a30]
mov rax, r8
cmp rdi, qword [rax]
je 0x180050e72
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180050e28
mov edi, 4
mov eax, r14d
xchg dword [0x1800e65b8], eax
test edi, edi
je 0x180050e52
cmp edi, 6
jne 0x180050f36
mov rcx, qword [0x1800e6608]
call fcn.1800ac138
test eax, eax
jne 0x180050f38
mov qword [0x1800e6608], r14
jmp 0x180050f38
cmp ebx, 0xffffffff
je 0x180050e37
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x180050f20
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov edi, eax
test eax, eax
jne 0x180050e3c
xor edx, edx
mov ecx, ebx
call fcn.1800abcb4
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x180050e3c
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180050f07
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180050ef8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180050ed0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180050e3c
mov edi, 6
jmp 0x180050e3c
xchg dword [0x1800e65b8], r14d
mov edi, 2
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180050f50
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1800e65f8]
xor r14d, r14d
mov ebx, r14d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800e65b8], esi
je 0x180050fa4
cmp rbx, 0x20
jae 0x180050f8d
xor ecx, ecx
jmp 0x180050f8f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180050f83
cmp qword [0x1800e65c0], r14
je 0x1800510da
test rdi, rdi
jne 0x180050fc1
xor ecx, ecx
call fcn.1800abdc4
mov edi, eax
jmp 0x180050fec
mov ecx, dword [0x1800e6a3c]
mov ebx, r14d
test ecx, ecx
je 0x180050fe7
mov r8, qword [0x1800e6a30]
mov rax, r8
cmp rdi, qword [rax]
je 0x180051022
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180050fd8
mov edi, 4
mov eax, r14d
xchg dword [0x1800e65b8], eax
test edi, edi
je 0x180051002
cmp edi, 6
jne 0x1800510e6
mov rcx, qword [0x1800e65f8]
call fcn.1800ac138
test eax, eax
jne 0x1800510e8
mov qword [0x1800e65f8], r14
jmp 0x1800510e8
cmp ebx, 0xffffffff
je 0x180050fe7
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x1800510d0
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov edi, eax
test eax, eax
jne 0x180050fec
xor edx, edx
mov ecx, ebx
call fcn.1800abcb4
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x180050fec
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800510b7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800510a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180051080
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180050fec
mov edi, 6
jmp 0x180050fec
xchg dword [0x1800e65b8], r14d
mov edi, 2
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180051100
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1800e65d8]
xor r14d, r14d
mov ebx, r14d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800e65b8], esi
je 0x180051154
cmp rbx, 0x20
jae 0x18005113d
xor ecx, ecx
jmp 0x18005113f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180051133
cmp qword [0x1800e65c0], r14
je 0x18005128a
test rdi, rdi
jne 0x180051171
xor ecx, ecx
call fcn.1800abdc4
mov edi, eax
jmp 0x18005119c
mov ecx, dword [0x1800e6a3c]
mov ebx, r14d
test ecx, ecx
je 0x180051197
mov r8, qword [0x1800e6a30]
mov rax, r8
cmp rdi, qword [rax]
je 0x1800511d2
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180051188
mov edi, 4
mov eax, r14d
xchg dword [0x1800e65b8], eax
test edi, edi
je 0x1800511b2
cmp edi, 6
jne 0x180051296
mov rcx, qword [0x1800e65d8]
call fcn.1800ac138
test eax, eax
jne 0x180051298
mov qword [0x1800e65d8], r14
jmp 0x180051298
cmp ebx, 0xffffffff
je 0x180051197
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x180051280
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov edi, eax
test eax, eax
jne 0x18005119c
xor edx, edx
mov ecx, ebx
call fcn.1800abcb4
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x18005119c
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180051267
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180051258
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180051230
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18005119c
mov edi, 6
jmp 0x18005119c
xchg dword [0x1800e65b8], r14d
mov edi, 2
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1800512b0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1800e65c8]
xor r14d, r14d
mov ebx, r14d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x1800e65b8], esi
je 0x180051304
cmp rbx, 0x20
jae 0x1800512ed
xor ecx, ecx
jmp 0x1800512ef
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x1800512e3
cmp qword [0x1800e65c0], r14
je 0x18005143a
test rdi, rdi
jne 0x180051321
xor ecx, ecx
call fcn.1800abdc4
mov edi, eax
jmp 0x18005134c
mov ecx, dword [0x1800e6a3c]
mov ebx, r14d
test ecx, ecx
je 0x180051347
mov r8, qword [0x1800e6a30]
mov rax, r8
cmp rdi, qword [rax]
je 0x180051382
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180051338
mov edi, 4
mov eax, r14d
xchg dword [0x1800e65b8], eax
test edi, edi
je 0x180051362
cmp edi, 6
jne 0x180051446
mov rcx, qword [0x1800e65c8]
call fcn.1800ac138
test eax, eax
jne 0x180051448
mov qword [0x1800e65c8], r14
jmp 0x180051448
cmp ebx, 0xffffffff
je 0x180051347
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x180051430
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov edi, eax
test eax, eax
jne 0x18005134c
xor edx, edx
mov ecx, ebx
call fcn.1800abcb4
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x18005134c
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180051417
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180051408
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800513e0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18005134c
mov edi, 6
jmp 0x18005134c
xchg dword [0x1800e65b8], r14d
mov edi, 2
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret