joyce8/EMBER2024-capa huggingface dataset:
Function at 0x179a0b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x039f4f20]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
test rax, rax
mov r11, rax
jne 0x179a0dd
mov eax, 3
cmp eax, 2
sete al
add rsp, 0x28
ret
cmp byte [rax + 0x10], cl
je 0x179a0f1
mov eax, 2
cmp eax, eax
sete al
add rsp, 0x28
ret
cmp byte [rax + 0x11], cl
je 0x179a103
mov eax, ecx
cmp eax, 2
sete al
add rsp, 0x28
ret
cmp qword [r11], rcx
mov eax, 1
mov edx, 4
cmove eax, edx
cmp eax, 2
sete al
add rsp, 0x28
ret

Function at 0x179a6f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rax, qword [0x039f4f20]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x179a740
mov rcx, qword [0x039f4f20]
add rcx, 0x48
call fcn.012d6670
mov rdi, rax
mov rdx, rax
mov rax, qword [0x039f4f20]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rdi, 0x10
movzx ebx, byte [rdi]
mov byte [rsp + 0x30], bl
mov byte [rdi], 1
mov qword [rsp + 0x28], rdi
lea r8, [0x01580600]
mov edx, 0x2e3
lea rcx, [0x01580570]
call fcn.017eea00
nop
mov byte [rdi], bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x179ab40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov esi, ecx
mov rax, qword [0x039f4f20]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x179ab97
mov rcx, qword [0x039f4f20]
add rcx, 0x48
call fcn.012d6670
mov rdi, rax
mov rdx, rax
mov rax, qword [0x039f4f20]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rdi, 0x10
movzx ebx, byte [rdi]
mov byte [rsp + 0x40], bl
mov byte [rdi], 1
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, esi
call fcn.0124e580
nop
mov byte [rdi], bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x179d610
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov r13, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov qword [rax - 0x40], 0
mov rax, qword [0x039f1180]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x179d65f
lea rbx, [rax + 0x20]
jmp 0x179d661
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
mov rsi, rax
mov qword [rsp + 0x60], rax
test rbp, rbp
je 0x179d81b
test r13, r13
je 0x179d81b
mov r12, qword [rsp + 0xc0]
test r12, r12
je 0x179d81b
mov rcx, qword [rdi]
test rcx, rcx
je 0x179d6bf
test byte [rcx - 5], 0x40
jne 0x179d6af
movsxd rax, dword [rcx - 4]
jmp 0x179d6ba
mov rcx, qword [rcx]
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov eax, eax
shr rax, 1
jmp 0x179d6c1
xor eax, eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x179d6dc
movzx edx, byte [rcx - 5]
test dl, 0x40
jne 0x179d6d7
test dl, 0x20
je 0x179d6de
mov rcx, qword [rcx]
jmp 0x179d6de
xor ecx, ecx
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea r8, [rsp + 0xa8]
mov qword [rsp + 0x20], r8
mov r9, r14
mov r8, rbp
mov edx, eax
call fcn.02d70010
test eax, eax
jne 0x179d740
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1090009
call fcn.0124e580
mov edi, eax
mov rcx, qword [rbx + 0x30]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 0x78]
jmp 0x179d842
cmp dword [rbp], 0x10411
jne 0x179d750
mov dword [rbp], 0x411
lea rcx, [rsp + 0x48]
call fcn.0116a950
nop
mov rdx, qword [rdi]
mov al, byte [rdx - 5]
and eax, 7
lea rax, [rax + rax*2]
lea rcx, [0x01173e9a]
movzx ecx, byte [rcx + rax*2]
sub rdx, rcx
xor r8d, r8d
mov rdx, qword [rdx]
lea rcx, [rsp + 0x48]
call fcn.01174500
mov edi, eax
test eax, eax
jns 0x179d7a9
lea rcx, [rsp + 0x48]
call fcn.0116a920
nop
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x78]
jmp 0x179d842
lea rdx, [rsp + 0x48]
mov ecx, dword [rbp]
call fcn.0134a6b0
mov edi, eax
test eax, eax
jns 0x179d7d6
lea rcx, [rsp + 0x48]
call fcn.0116a920
nop
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x78]
jmp 0x179d842
lea rcx, [rsp + 0x48]
call fcn.0116a920
mov r11d, dword [rsp + 0xa8]
mov dword [r13], r11d
cmp dword [rsp + 0x40], 0
setne al
mov byte [r12], al
cmp dword [rsp + 0x44], 0
setne cl
mov rax, qword [rsp + 0xc8]
mov byte [rax], cl
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x78]
xor eax, eax
jmp 0x179d844
lea r8, [0x0179d900]
mov edx, 0x2f8
lea rcx, [0x0179d860]
call fcn.017eea00
mov edi, eax
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x78]
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x179e1f0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x179e32a
cmp qword [rcx + 0x10], 0
jne 0x179e32a
cmp qword [rcx + 0x18], 0
jne 0x179e32a
cmp qword [rcx + 0x20], 0
jne 0x179e32a
cmp qword [rcx + 0x28], 0
jne 0x179e32a
cmp qword [rcx + 0x30], 0
jne 0x179e32a
cmp byte [0x039fbba8], 0
lea rax, [0x0179e3f0]
lea rcx, [0x0179e3d8]
cmove rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
je 0x179e2f7
lea rdx, [0x0179e3c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x0179e3b8]
mov rcx, rdi
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x0179e3a8]
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x0179e398]
mov rcx, rdi
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x0179e380]
mov rcx, rdi
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x0179e370]
mov rcx, rdi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x0179e360]
mov rcx, rdi
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbx + 0x10]
test rdx, rdx
mov rdi, rax
je 0x179e310
mov ecx, setsockopt
call rdx
mov r9, qword [rbx + 8]
test r9, r9
je 0x179e325
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call r9
mov rdi, qword [rsp + 0x30]
cmp qword [rbx + 8], 0
je 0x179e355
cmp qword [rbx + 0x10], 0
je 0x179e355
cmp qword [rbx + 0x18], 0
je 0x179e355
cmp qword [rbx + 0x20], 0
je 0x179e355
cmp qword [rbx + 0x28], 0
je 0x179e355
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0x80004005
add rsp, 0x20
pop rbx
ret
Function at 0x17b0540
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x17b059d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [0x03e490f8], eax
je 0x17b0578
cmp eax, 5
je 0x17b0578
cmp eax, 0x21
jne 0x17b058d
mov ecx, socket
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 1
cmp rbx, 0xa
jl 0x17b0550
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x17b05b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
xor ebx, ebx
mov rsi, rdx
or edi, 2
mov rbp, rcx
nop
nop
nop
nop
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x17b062a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [0x03e490f8], eax
je 0x17b060e
cmp eax, 5
je 0x17b060e
cmp eax, 0x21
jne 0x17b0623
mov ecx, socket
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 1
cmp rbx, 0xa
jl 0x17b05e0
mov eax, 1
jmp 0x17b062c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x17b0650
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
movzx ebp, r8b
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x17b06ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [0x03e490f8], eax
je 0x17b069e
cmp eax, 5
je 0x17b069e
cmp eax, 0x21
jne 0x17b06b3
mov ecx, socket
call qword [sym.imp.KERNEL32.dll_Sleep]
add rbx, 1
cmp rbx, 0xa
jl 0x17b0670
mov eax, 1
jmp 0x17b06bc
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x17b1c40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x17b1c62
movzx eax, byte [rcx - 5]
test al, 0x40
jne 0x17b1c5d
test al, 0x20
je 0x17b1c64
mov rcx, qword [rcx]
jmp 0x17b1c64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x17b1c77
test al, 0x10
jne 0x17b1d03
mov rcx, qword [rbx]
test rcx, rcx
je 0x17b1c90
movzx eax, byte [rcx - 5]
test al, 0x40
jne 0x17b1c8b
test al, 0x20
je 0x17b1c92
mov rcx, qword [rcx]
jmp 0x17b1c92
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x17b1d03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov dword [0x03e490f8], eax
je 0x17b1d03
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010000
mov qword [rsp + 0x20], 0x1000000f
call fcn.0124e580
mov r8, qword [rbx]
test r8, r8
je 0x17b1ce6
movzx eax, byte [r8 - 5]
test al, 0x40
jne 0x17b1ce1
test al, 0x20
je 0x17b1ce9
mov r8, qword [r8]
jmp 0x17b1ce9
xor r8d, r8d
lea rdx, [0x01580c90]
xor r9d, r9d
mov ecx, 0xc102000c
call fcn.017ee830
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x17cbb30
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x70
mov rax, qword [rcx + 0x168]
mov rsi, rcx
mov rbx, rdx
test rax, rax
cmovne rcx, rax
mov rcx, qword [rcx + 0x138]
add rcx, 0x5370
call fcn.017c6370
test al, al
jne 0x17cbb75
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rsi
ret
mov qword [rsp + 0x88], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x80]
lea rdx, [rsi + 0x2000]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
jne 0x17cbbbf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010000
mov qword [rsp + 0x20], 0x1000000f
call fcn.0124e580
jmp 0x17cbd9d
test rbx, rbx
je 0x17cbbec
mov rdx, qword [rsi + 0x2000]
mov rcx, qword [rsp + 0x80]
cmp rdx, rcx
mov rax, rcx
cmovb rax, rdx
cmp rbx, rax
jb 0x17cbbec
mov rbx, rcx
cmp rdx, rcx
cmovb rbx, rdx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], reloc.OLEAUT32.dll_VarI4FromDisp
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x17cbc23
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010014
mov qword [rsp + 0x20], 0x1000000f
call fcn.0124e580
jmp 0x17cbd9d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
movsd xmm0, qword [0x039f4030]
cmp rcx, rax
mov qword [rsp + 0x90], rdi
cmovb rax, rcx
test rbx, rbx
mov qword [rsi + 0x2008], rax
je 0x17cbc5f
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x2008], rax
mov rax, qword [rsp + 0x40]
cmp rax, rcx
cmovb rcx, rax
test rbx, rbx
jne 0x17cbd2e
comisd xmm0, xmmword [0x0116a980]
movsd xmm1, qword [0x01174e80]
jbe 0x17cbce2
comisd xmm1, xmm0
jb 0x17cbce2
test rcx, rcx
mulsd xmm0, qword [0x0116a978]
cvtsi2sd xmm1, rcx
jns 0x17cbca6
addsd xmm1, qword [0x01276eb8]
mulsd xmm0, xmm1
movsd xmm1, qword [0x0116c6b8]
xor eax, eax
comisd xmm0, xmm1
jbe 0x17cbcd8
subsd xmm0, xmm1
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
comisd xmm0, xmm1
jbe 0x17cbcd8
subsd xmm0, xmm1
add rax, rdx
cvttsd2si rbx, xmm0
add rbx, rax
jmp 0x17cbd2e
comisd xmm0, xmm1
jbe 0x17cbd2b
movsd xmm1, qword [0x0116c6b8]
xor r8d, r8d
comisd xmm0, xmm1
jbe 0x17cbd17
subsd xmm0, xmm1
movabs rdx, 0x7fffffffffffffff
mov r8, rdx
comisd xmm0, xmm1
jbe 0x17cbd17
subsd xmm0, xmm1
add r8, rdx
cvttsd2si rax, xmm0
mov rbx, rcx
add rax, r8
cmp rax, rcx
cmovb rbx, rax
jmp 0x17cbd2e
mov rbx, rcx
mov rdi, qword [rsi + 0x2008]
movabs rax, 0xcccccccccccccccd
mul rdi
shr rdx, 4
cmp rbx, qword [rsi + 0x2000]
mov qword [rsi + 0x2010], rdx
jbe 0x17cbd93
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
jne 0x17cbd8c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010000
mov qword [rsp + 0x20], 0x1000000f
call fcn.0124e580
jmp 0x17cbd95
mov qword [rsi + 0x2000], rbx
xor eax, eax
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rsi
ret
Function at 0x17cc110
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [rdx], 0
mov rcx, qword [rcx + 0x2d0]
test rcx, rcx
mov rdi, rdx
jne 0x17cc197
mov rcx, qword [0x039f1188]
test rcx, rcx
je 0x17cc17e
xor r9d, r9d
mov r8b, 1
xor edx, edx
mov byte [rsp + 0x20], 1
call fcn.0116c230
mov r11, qword [0x039f1188]
test r11, r11
je 0x17cc17e
mov ecx, dword [r11 + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x17cc17e
cmp dword [rax + 0xf8], 2
jne 0x17cc17e
mov rcx, qword [rbx + 0x2c8]
jmp 0x17cc185
mov rcx, qword [rbx + 0x2c0]
test rcx, rcx
jne 0x17cc197
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp 0x180dd90
sub rsp, 0x28
mov rcx, qword [rcx + 0x70]
test rcx, rcx
jne 0x180dda7
mov qword [rdx], rcx
xor eax, eax
add rsp, 0x28
ret
mov qword [rdx], rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
add rsp, 0x28
ret
Function at 0x17ed740
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov dl, 1
xor ecx, ecx
call fcn.01808f30
xor edx, edx
mov ecx, 0xc1000016
call fcn.017da2d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x17f0200
Capabilities:
Get thread local storage value

Disassembly:
push r12
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov rsi, rcx
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov rax, qword [0x039f1180]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x17f0244
lea rbx, [rax + 0x20]
jmp 0x17f0247
mov rbx, r12
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x17f0260
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
mov qword [rsp + 0x40], rax
test rbx, rbx
jne 0x17f026f
mov eax, 0xc1030001
jmp 0x17f02fc
cmp qword [rbx + 0x48], 0
jne 0x17f0281
mov edi, 1
mov dword [rsp + 0x24], edi
jmp 0x17f02eb
mov qword [rsp + 0x68], r12
mov r8d, 0x138a
mov rdx, qword [rbx + 0x48]
lea rcx, [rsp + 0x68]
call fcn.0124d7c0
mov edi, eax
mov dword [rsp + 0x24], eax
test eax, eax
jns 0x17f02b7
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x17f02b5
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
jmp 0x17f02eb
mov rcx, qword [rsi]
test rcx, rcx
je 0x17f02c8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsi], r12
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], r12
mov qword [rsi], rax
jmp 0x17f02eb
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
call qword [rax + 0x78]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x1808e20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1d8
mov rax, qword [0x039f1190]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1808e95
mov r9, qword [rsp + 0x1e0]
lea rax, [rsp + 0x1e8]
lea rcx, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR80.dll__vsnwprintf_s]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x1be], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.01003340
add rsp, 0x1d8
ret
Function at 0x180c250
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
xor esi, esi
test cl, cl
movzx ebx, cl
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov edi, 0x80004005
je 0x180c28c
lea r8, [rsp + 0x50]
lea rdx, [fcn.0180c250]
lea ecx, [rsi + 6]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov rax, qword [rsp + 0x50]
jmp 0x180c299
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x50], rax
test rax, rax
mov qword [rsp + 0x48], rsi
jne 0x180c2b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180c2ce
lea rdx, [0x0180c460]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180c2ce
lea rcx, [rsp + 0x48]
call rax
jmp 0x180c2e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180c2e2
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x180c384
test bl, bl
je 0x180c2f5
cmp byte [0x03e49fc8], sil
jne 0x180c304
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x180c37b
mov rcx, qword [rsp + 0x48]
mov rdx, qword [0x03a79ee0]
lea r8, [rsp + 0x58]
mov rax, qword [rcx]
mov byte [0x03e49fc8], 1
mov qword [rsp + 0x58], rsi
call qword [rax + 0x38]
test eax, eax
js 0x180c372
lea rcx, [0x0180c410]
call fcn.01808e20
mov rcx, qword [0x039f11b0]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test bl, bl
mov edi, esi
je 0x180c36b
mov rcx, qword [rsp + 0x48]
call fcn.0180abe0
test eax, eax
mov edi, eax
jns 0x180c36b
lea rcx, [0x0180c590]
call fcn.01808e20
mov qword [rsp + 0x48], rsi
jmp 0x180c3a0
lea rcx, [0x0180c530]
jmp 0x180c38b
lea rcx, [0x0180c4d0]
jmp 0x180c38b
lea rcx, [0x0180c480]
call fcn.01808e20
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180c3a0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [0x039f1180]
test rax, rax
je 0x180c3e3
mov ecx, dword [rax + 8]
cmp ecx, 0xffffffff
je 0x180c3e3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180c3e3
call fcn.0115c5b0
lea rcx, [0x03e4a3e8]
mov rsi, rax
call fcn.02d87a10
test eax, eax
mov ebx, eax
je 0x180c3f1
mov rcx, rsi
call fcn.0109c0c0
jmp 0x180c3f1
lea rcx, [0x03e4a3e8]
call fcn.02d87a10
mov ebx, eax
test ebx, ebx
mov eax, edi
setns byte [0x03e49fc9]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x181f0e0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor ecx, ecx
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rcx, qword [0x039f1180]
test rcx, rcx
je 0x181f13c
mov ecx, dword [rcx + 8]
cmp ecx, 0xffffffff
je 0x181f13c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r11, rax
test rax, rax
je 0x181f13c
lea rax, [rsp + 0x38]
sub rax, qword [r11 + 0x90]
cmp rax, 0x3e8
jae 0x181f13c
mov eax, 1
jmp 0x181f1a0
mov rcx, qword [0x039f11b0]
mov rdx, qword [rcx + 0x168]
test rdx, rdx
je 0x181f154
mov r8, rdx
jmp 0x181f157
mov r8, rcx
cmp qword [r8 + 0x170], 0
jne 0x181f168
mov eax, 1
jmp 0x181f1a0
cmp qword [0x03e49fc0], 0
jne 0x181f179
mov eax, 1
jmp 0x181f1a0
test rdx, rdx
je 0x181f181
mov rcx, rdx
mov rcx, qword [rcx + 0x138]
call fcn.017c5020
nop
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
xor eax, eax
jmp 0x181f1a0
add rsp, 0x30
pop rbx
ret

Function at 0x181f580
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdx, qword [0x039f1180]
test rdx, rdx
je 0x181f5e4
mov ecx, dword [rdx + 8]
cmp ecx, 0xffffffff
je 0x181f5e4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r11, rax
test rax, rax
je 0x181f5e4
lea rax, [rsp + 0x38]
sub rax, qword [r11 + 0x90]
cmp rax, 0x3e8
jae 0x181f5e4
mov eax, 1
jmp 0x181f654
mov rax, qword [0x039f11b0]
cmp qword [rax + 0x168], 0
je 0x181f5fc
mov rax, qword [rax + 0x168]
cmp qword [rax + 0x170], 0
jne 0x181f60d
mov eax, 1
jmp 0x181f654
cmp qword [0x03e49fc0], 0
jne 0x181f61e
mov eax, 1
jmp 0x181f654
xor eax, eax
mov dword [0x03a89f10], eax
mov qword [0x03a89f18], rax
mov rcx, rdi
call fcn.0181f0e0
lea rcx, [0x03a79f00]
call fcn.0181ebf0
nop
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
xor eax, eax
jmp 0x181f654
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret