joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100003668
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000036b5
cmp rcx, 0xffffffffffffffff
je 0x1000036b5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000036ad
cmp dword [rcx + 0x3c], edx
jl 0x1000036ad
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000036ad
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000036b5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x18000acc0
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov edi, dword [rcx]
lea r12, [0x180000000]
mov ebx, edi
mov r11, rcx
sar ebx, 0x1f
mov r8d, edi
and ebx, 0x20
add ebx, 0x20
test byte [rcx + 0xdb8], 1
je 0x18000ad9d
mov edx, edi
mov eax, edi
shr rax, 0x1f
and edx, 0x1f
shl rax, 5
mov r10d, edi
add rdx, rax
shr r10, 0x10
and r10d, 0x1f
mov r8d, edi
add r10, rax
shr r8, 5
and r8d, 0x1f
mov ecx, edi
add r8, rax
shr rcx, 0x1d
and ecx, 1
mov eax, edi
shr rax, 0x1e
mov r9d, edi
and eax, 1
lea rcx, [rcx + rax*2]
mov rax, qword [r12 + r10*8 + 0x120b80]
mov qword [rsp + 0x38], rax
mov rax, qword [r12 + r8*8 + 0x120b80]
mov r8, qword [r11 + 0x110]
mov qword [rsp + 0x30], rax
mov rax, qword [r12 + rdx*8 + 0x120b80]
lea rdx, str.PC:_0x_016llx___08x____10s__s___s___s_n
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + rcx*8 + 0x120000]
mov rcx, r11
mov qword [rsp + 0x20], rax
call fcn.180007bf0
mov edi, dword [r11]
mov r8d, edi
mov eax, r8d
shr eax, 5
and eax, 0x1f
cmp eax, 0x1f
jb 0x18000adb4
lea rax, [r11 + 0x100]
jmp 0x18000adbb
inc rax
lea rax, [r11 + rax*8]
mov rax, qword [rax]
lea rsi, [r11 + 0x100]
mov edx, eax
cmp ebx, 0x20
cmovne rdx, rax
mov eax, r8d
shr eax, 0x10
and eax, 0x1f
cmp eax, 0x1f
jb 0x18000ade2
mov rax, rsi
jmp 0x18000ade9
inc rax
lea rax, [r11 + rax*8]
mov rax, qword [rax]
lea ebp, [rbx - 1]
mov r14d, dword [r11 + 0x118]
cmp ebx, 0x20
mov ecx, eax
mov r15d, 0x40000000
cmovne rcx, rax
test r15d, r8d
mov r10, rcx
not r10
cmove r10, rcx
mov ecx, r14d
shr rcx, 0x1e
and ecx, 1
add rcx, r10
add rcx, rdx
cmp ebx, 0x40
ja 0x18000ae31
mov r8, qword [r12 + rbp*8 + 0x95180]
jmp 0x18000ae34
xor r8d, r8d
and r8, rcx
mov ecx, ebp
mov r9, r8
shr r9, cl
and r9d, 1
cmp r8, rdx
jb 0x18000ae52
jne 0x18000ae4f
test r10, r10
jne 0x18000ae52
xor r15d, r15d
shr rdx, cl
shr r10, cl
and edx, 1
and r10d, 1
cmp rdx, r10
jne 0x18000ae71
cmp rdx, r9
je 0x18000ae71
mov ecx, 0x80000000
jmp 0x18000ae73
xor ecx, ecx
mov edx, 0x20000000
test edx, edi
je 0x18000aeae
xor eax, eax
test r8, r8
cmove eax, edx
and r14d, 0xfffffff
or eax, r14d
and r9d, 1
and eax, 0x3fffffff
shl r9d, 0x1c
or eax, r15d
btr eax, 0x1f
or eax, r9d
or eax, ecx
mov dword [r11 + 0x118], eax
and edi, 0x1f
mov ecx, r8d
cmp ebx, 0x20
cmovne rcx, r8
cmp edi, 0x1f
jae 0x18000aece
mov esi, edi
inc rsi
lea rsi, [r11 + rsi*8]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov qword [rsi], rcx
add qword [r11 + 0x110], 4
mov rsi, qword [rsp + 0x70]
xor eax, eax
mov qword [r11 + 0x100], 0
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x180013860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov edi, 0xc0000001
mov ecx, dword [0x180152880]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [0x180157168]
call qword [case.0x180020d94.0]
test eax, eax
je 0x1800138b5
mov rax, qword [0x180157168]
call qword [case.0x180020d94.0]
movzx edi, ax
or edi, 0xe80f0000
jmp 0x180013964
test rbx, rbx
jne 0x180013952
lea rcx, [0x180152920]
call fcn.18008aaa0
mov rbx, rax
test rax, rax
jne 0x1800138dc
mov edi, 0xc000009a
jmp 0x180013964
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], al
mov rdx, rbx
mov ecx, dword [0x180152880]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x18001395f
lea rcx, [0x180146040]
mov rax, qword [0x180146040]
cmp rax, rcx
je 0x180013964
test byte [rax + 0x1c], 2
je 0x180013964
cmp byte [rax + 0x19], 2
jb 0x180013964
mov rax, qword [0x180157168]
call qword [case.0x180020d94.0]
movzx r9d, ax
or r9d, 0xe80f0000
mov edx, 0xa
lea r8, [0x180132018]
mov rcx, qword [0x180146040]
mov rcx, qword [rcx + 0x10]
call fcn.180012460
jmp 0x180013964
cmp rbx, 0xffffffffffffffff
jne 0x18001395f
mov edi, 0xe8040002
jmp 0x180013964
mov qword [rsi], rbx
xor edi, edi
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18001b5a0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180146030]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r14, rcx
xorps xmm0, xmm0
mov byte [rcx], bl
xor edx, edx
mov qword [rsp + 0x34], rbx
movdqu xmmword [rsp + 0x24], xmm0
lea ecx, [rbx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18001b634
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x180146040]
lea rdx, [0x180146040]
nop
cmp rcx, rdx
je 0x18001b627
test byte [rcx + 0x1c], 1
je 0x18001b627
cmp byte [rcx + 0x19], 2
jb 0x18001b627
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x56]
mov r9d, eax
lea r8, [0x180132130]
call fcn.180011560
movzx eax, bx
or eax, 0xe80f0000
jmp 0x18001b6e8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x18001b6a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x180146040]
lea rdx, [0x180146040]
cmp rcx, rdx
je 0x18001b68d
test byte [rcx + 0x1c], 1
je 0x18001b68d
cmp byte [rcx + 0x19], 2
jb 0x18001b68d
mov rcx, qword [rcx + 0x10]
lea r8, [0x180132130]
mov edx, 0x56
mov r9d, eax
call fcn.180011560
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bx
or eax, 0xe80f0000
jmp 0x18001b6e8
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
nop
cmp dword [rsp + 0x2c], esi
jne 0x18001b6bd
inc ebx
cmp ebx, 1
ja 0x18001b6cf
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18001b6b0
mov rsi, qword [rsp + 0x68]
cmp ebx, 1
jne 0x18001b6dc
mov byte [r14], bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18008e6f0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x18001d5a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x180146030]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, qword [rcx]
lea rsi, [rdx + 0x20]
xor r14d, r14d
mov rdi, rdx
mov qword [r11 - 0x30], r14
mov rax, qword [0x180146040]
lea rbp, [0x180146040]
cmp rax, rbp
je 0x18001d62d
test byte [rax + 0x44], 1
je 0x18001d62d
cmp byte [rax + 0x41], 4
jb 0x18001d62d
xor eax, eax
lea rcx, [r11 - 0x38]
mov qword [r11 - 0x38], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [0x180146040]
lea edx, [r14 + 0x20]
mov rax, qword [rbx + 0x20]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x38]
call fcn.18001cc00
mov qword [rsp + 0x88], r14
lea r9, [rsp + 0x98]
mov qword [rsp + 0x40], rbx
lea r8, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x38], r14
movdqa xmmword [rsp + 0x70], xmm0
mov rdx, rsi
mov rax, qword [rbx + 0x158]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
movups xmm0, xmmword [rax]
mov rax, qword [rsi + 0x20]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbx + 8]
mov qword [rsp + 0x80], rsi
movups xmmword [rsp + 0x58], xmm1
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov rcx, rbx
call fcn.1800162c0
nop dword [rax + rax]
cmp eax, 0x68040003
jne 0x18001d716
mov rax, qword [rsp + 0x98]
mov qword [rdi], rax
mov eax, dword [rsp + 0x78]
mov dword [rdi + 8], eax
mov rax, qword [0x180146040]
cmp rax, rbp
je 0x18001d70f
test byte [rax + 0x44], 1
je 0x18001d70f
cmp byte [rax + 0x41], 4
jb 0x18001d70f
xor eax, eax
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [0x180146040]
mov edx, 0x21
mov rax, qword [rbx + 0x20]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x38]
call fcn.18001cc00
mov eax, 1
jmp 0x18001d771
mov rax, qword [0x180146040]
nop dword [rax]
cmp rax, rbp
je 0x18001d76f
test byte [rax + 0x44], 1
je 0x18001d76f
cmp byte [rax + 0x41], 4
jb 0x18001d76f
xor eax, eax
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [0x180146040]
mov edx, 0x22
mov rax, qword [rbx + 0x20]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x38]
call fcn.18001cc00
xor eax, eax
mov rcx, qword ds:[rsp + 0xa0]
xor rcx, rsp
call fcn.18008e6f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180025720
Capabilities:
Get thread local storage value

Disassembly:
mov qword ss:[rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x180152a20]
xor ebx, ebx
mov edi, dword [0x180157648]
mov qword [rsp + 0x30], rbx
cmp eax, 2
jne 0x18002577b
mov ecx, dword [0x180152a24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180025760
cmp rax, 0xffffffffffffffff
je 0x18002577b
mov rbx, qword [rax + rdi*8]
mov edx, dword [0x180157648]
lea r8, [rbx + 1]
lea r9, [rsp + 0x30]
lea rcx, [0x180152a20]
call fcn.18008b080
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800257a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword ss:[rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x180152a20]
xor ebx, ebx
mov edi, dword [0x180157648]
mov qword [rsp + 0x30], rbx
cmp eax, 2
jne 0x1800257fd
mov ecx, dword [0x180152a24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1800257e3
cmp rax, 0xffffffffffffffff
je 0x1800257fd
mov rbx, qword [rax + rdi*8]
dec rbx
mov edx, dword [0x180157648]
lea r9, [rsp + 0x30]
mov r8, rbx
lea rcx, [0x180152a20]
call fcn.18008b080
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp ebx, 3
jge 0x1800291e6
movsxd rcx, ebx
mov rax, qword [rsp + 0xa0]
lea r12, [rax + rcx*8]
mov rax, qword [r12]
test rax, rax
je 0x1800291df
mov rdi, qword [rax + 0x10]
mov rax, qword [rsi + 0x18]
mov r14, qword [rax + 0x60]
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov rcx, qword [r14 + 0x50]
test rcx, rcx
jne 0x1800290b8
xor edi, edi
lea r15d, [rcx + 8]
jmp 0x1800290c2
mov eax, edi
mov edi, dword [rcx + rax*8 + 4]
mov r15d, dword [rcx + rax*8]
mov dword [rsp + 0x3c], edi
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov ecx, dword ds:[r14 + 4]
cmp ecx, dword [r14 + 8]
cmovle ecx, dword [r14 + 8]
cmp r15d, ecx
jg 0x1800291df
cmp byte [r14 + 0xc], 0
je 0x1800290fc
shr edi, 1
test dil, 1
je 0x1800291df
test byte [rsp + 0x3c], 1
jne 0x1800291df
mov rcx, qword [0x180146040]
lea rax, [0x180146040]
cmp rcx, rax
je 0x18002914a
test dword [rcx + 0x1c], 0x100
je 0x18002914a
cmp byte [rcx + 0x19], 5
jb 0x18002914a
mov r9, qword [r12]
mov edx, 0x2d
mov qword [rsp + 0x20], rsi
mov r9, qword [r9]
lea r8, [0x180132600]
mov rcx, qword [rcx + 0x10]
call fcn.180013760
mov rax, qword [r12]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movzx r9d, byte [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, rsi
call fcn.18008e64e
jmp 0x1800291df
inc ebx
jmp 0x180029068
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002a9c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword ss:[rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x180152a20]
xor ebx, ebx
mov edi, dword [0x180156e24]
mov qword [rsp + 0x30], rbx
cmp eax, 2
jne 0x18002aa1d
mov ecx, dword [0x180152a24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002aa03
cmp rax, 0xffffffffffffffff
je 0x18002aa1d
mov rbx, qword [rax + rdi*8]
dec rbx
mov edx, dword [0x180156e24]
lea r9, [rsp + 0x30]
mov r8, rbx
lea rcx, [0x180152a20]
call fcn.18008b080
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180035ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r14, r8
mov rbp, rdx
cmp r8, rdx
jb 0x180035e7a
movzx ecx, word ds:[r9]
mov esi, 0xffff
mov rax, r8
sub rax, rdx
cmp rax, rsi
cmovbe si, ax
add ecx, 0x40
movzx r13d, si
add r13d, ecx
lea r12d, [r13 + 0xc]
mov ebx, r12d
lea rax, [r12 + 0x10]
cmp rax, rbx
jb 0x180035e73
lea r8, [r12 + 0x18]
cmp r8, rbx
jb 0x180035e73
lfence
mov rcx, qword [0x180152670]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180035e73
mov dword [rax + 0xc], 0xaaaaaaaa
lea rdi, [rax + 0x10]
mov dword [rax + 8], 0x56454d23
mov qword [rax], rbx
mov dword [rax + r12 + 0x10], 0xbbbbbbbb
mov dword [rax + r12 + 0x14], 0x56454d23
lock inc dword [0x180152678]
test rdi, rdi
je 0x180035e73
mov rax, qword [rsp + 0x50]
lea rcx, [rdi + 0x48]
mov dword [rdi + 4], 0x1cd
xorps xmm0, xmm0
mov dword [rdi + 8], r13d
movups xmmword [rdi + 0xc], xmm0
movups xmmword [rdi + 0x1c], xmm0
movups xmmword [rdi + 0x2c], xmm0
movups xmmword [rdi + 0x3c], xmm0
mov qword [rdi + 0x14], rax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x2c], rax
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x34], rax
movzx eax, byte [rsp + 0x80]
mov byte [rdi + 0x3c], al
movzx eax, byte [rsp + 0x88]
mov byte [rdi + 0x3d], al
mov eax, dword [rsp + 0x90]
mov dword [rdi + 0x40], eax
mov dword [rdi + 0xc], 0x1cd
mov qword [rdi + 0x1c], rbp
mov qword [rdi + 0x24], r14
movzx eax, word [r15]
mov word [rdi + 0x44], ax
mov word [rdi + 0x46], si
movzx r8d, word [r15]
mov rdx, qword [r15 + 8]
call sub.ntdll.dll_memcpy
movzx ecx, word [r15]
mov rdx, rbp
add rcx, 0x48
movzx r8d, si
add rcx, rdi
call sub.ntdll.dll_memcpy
mov edx, r12d
mov rcx, rdi
call fcn.180030740
mov ebx, eax
test eax, eax
jns 0x180035e57
mov rcx, qword [0x180146040]
lea rdx, [0x180146040]
cmp rcx, rdx
je 0x180035e57
test byte [rcx + 0x1c], 1
je 0x180035e57
cmp byte [rcx + 0x19], 2
jb 0x180035e57
lfence
mov rcx, qword [0x180146040]
lea r8, [0x180133798]
mov edx, 0xb
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.180012460
mov rcx, qword [0x180152670]
lea r8, [rdi - 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lock dec dword [0x180152678]
jmp 0x180035eba
mov ebx, 0xc000009a
jmp 0x180035e7f
mov ebx, 0xe80f0216
lfence
mov rcx, qword [0x180146040]
lea rdx, [0x180146040]
cmp rcx, rdx
je 0x180035eba
test byte [rcx + 0x1c], 1
je 0x180035eba
cmp byte ds:[rcx + 0x19], 2
jb 0x180035eba
mov rcx, qword [rcx + 0x10]
lea r8, [0x180133798]
mov edx, 0xa
mov r9d, ebx
call fcn.180012460
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800481e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x180152a20]
xor ebx, ebx
mov esi, dword [0x18015a790]
mov edi, ebx
mov qword [rsp + 0x30], rbx
cmp eax, 2
je 0x180048211
mov r9d, 0xc000a003
jmp 0x180048238
mov ecx, dword [0x180152a24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop dword [rax]
test rax, rax
jne 0x18004822c
mov eax, 0xe804006f
jmp 0x18004828b
cmp rax, 0xffffffffffffffff
jne 0x180048285
mov r9d, 0xc000004b
mov rax, qword [0x180146040]
lea rcx, [0x180146040]
cmp rax, rcx
je 0x1800482af
test byte [rax + 0x1c], 1
je 0x1800482af
cmp byte [rax + 0x19], 2
jb 0x1800482af
lfence
mov rcx, qword [0x180146040]
lea r8, [0x180133f58]
mov edx, 0xa
mov rcx, qword [rcx + 0x10]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180012460
mov rdi, qword [rax + rsi*8]
mov eax, ebx
mov edx, dword [0x18015a790]
lea r9, [rsp + 0x30]
cmp eax, 0xe804006f
lea rcx, [0x180152a20]
cmovne rbx, rdi
lea r8, [rbx + 1]
call fcn.18008b080
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800482c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword ss:[rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x180152a20]
xor ebx, ebx
mov edi, dword [0x18015a790]
mov qword [rsp + 0x30], rbx
cmp eax, 2
je 0x1800482ed
mov r9d, 0xc000a003
jmp 0x18004830c
mov ecx, dword [0x180152a24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180048360
nop
cmp rax, 0xffffffffffffffff
jne 0x180048354
mov r9d, 0xc000004b
mov rax, qword [0x180146040]
lea rcx, [0x180146040]
cmp rax, rcx
je 0x18004837a
test byte [rax + 0x1c], 1
je 0x18004837a
cmp byte [rax + 0x19], 2
jb 0x18004837a
lfence
mov rcx, qword [0x180146040]
lea r8, [0x180133f58]
mov edx, 0xb
mov rcx, qword [rcx + 0x10]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180012460
mov rbx, qword [rax + rdi*8]
test rbx, rbx
je 0x180048360
dec rbx
mov edx, dword [0x18015a790]
lea r9, [rsp + 0x30]
mov r8, rbx
lea rcx, [0x180152a20]
call fcn.18008b080
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180057d40
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x180146030]
xor rax, rsp
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
mov qword [r11 - 0x68], 0
mov rsi, rdx
lea rax, [r11 - 0x68]
mov rdx, qword [rcx + 0x20]
lea r8, [r11 - 0x58]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r9d, 0x40
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180057e28
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
nop dword [rax]
cmp rcx, rbx
je 0x180057f8f
test byte [rcx + 0x1c], 1
je 0x180057e01
cmp byte [rcx + 0x19], 2
jb 0x180057e01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180146040]
lea r8, [0x180134310]
mov r9d, eax
mov edx, 0xc
mov rcx, qword [rcx + 0x10]
call fcn.180012460
mov rcx, qword [0x180146040]
cmp rcx, rbx
je 0x180057f8f
test byte [rcx + 0x1c], 1
je 0x180057f8f
cmp byte [rcx + 0x19], 2
jb 0x180057f8f
mov edx, 0xe
jmp 0x180057f7f
cmp qword [rsp + 0x130], 0x40
jne 0x180057f5b
mov eax, 0x5a4d
cmp word [rsp + 0x140], ax
jne 0x180057f5b
movsxd rbx, dword [rsp + 0x17c]
lea rcx, [rsp + 0x30]
add rbx, qword [rdi + 0x20]
xor edx, edx
mov r8d, 0xf8
call sub.ntdll.dll_memset
lea rax, [rsp + 0x130]
mov r9d, 0xf8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180057f0d
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
cmp rcx, rbx
je 0x180057f8f
test byte [rcx + 0x1c], 1
je 0x180057ee3
cmp byte [rcx + 0x19], 2
jb 0x180057ee3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180146040]
lea r8, [0x180134310]
mov r9d, eax
mov edx, 0xc
mov rcx, qword [rcx + 0x10]
call fcn.180012460
mov rcx, qword [0x180146040]
cmp rcx, rbx
je 0x180057f8f
test byte [rcx + 0x1c], 1
je 0x180057f8f
cmp byte ds:[rcx + 0x19], 2
jb 0x180057f8f
mov edx, 0x10
jmp 0x180057f7f
cmp qword [rsp + 0x130], 0xf8
jne 0x180057f35
cmp dword [rsp + 0x30], 0x4550
jne 0x180057f35
mov eax, dword [rsp + 0x58]
add rax, qword [rdi + 0x20]
mov qword [rdi + 0x30], rax
mov al, 1
jmp 0x180057f91
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
cmp rcx, rbx
je 0x180057f8f
test byte [rcx + 0x1c], 1
je 0x180057f8f
cmp byte [rcx + 0x19], 2
jb 0x180057f8f
mov edx, 0x11
jmp 0x180057f7f
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
cmp rcx, rbx
je 0x180057f8f
test byte [rcx + 0x1c], 1
je 0x180057f8f
cmp byte [rcx + 0x19], 2
jb 0x180057f8f
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x180134508]
call fcn.180011520
xor al, al
mov rcx, qword ds:[rsp + 0x180]
xor rcx, rsp
call fcn.18008e6f0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180057fc0
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x180146030]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov qword [r11 - 0x68], 0
mov rsi, rdx
lea rax, [r11 - 0x68]
mov rdx, qword [rcx + 0x20]
lea r8, [r11 - 0x58]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r9d, 0x40
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1800580a8
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
nop dword [rax]
cmp rcx, rbx
je 0x18005820f
test byte [rcx + 0x1c], 1
je 0x180058081
cmp byte [rcx + 0x19], 2
jb 0x180058081
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180146040]
lea r8, [0x180134310]
mov r9d, eax
mov edx, 0xc
mov rcx, qword [rcx + 0x10]
call fcn.180012460
mov rcx, qword [0x180146040]
cmp rcx, rbx
je 0x18005820f
test byte [rcx + 0x1c], 1
je 0x18005820f
cmp byte [rcx + 0x19], 2
jb 0x18005820f
mov edx, 0xe
jmp 0x1800581ff
cmp qword [rsp + 0x140], 0x40
jne 0x1800581db
mov eax, 0x5a4d
cmp word [rsp + 0x150], ax
jne 0x1800581db
movsxd rbx, dword [rsp + 0x18c]
lea rcx, [rsp + 0x30]
add rbx, qword [rdi + 0x20]
xor edx, edx
mov r8d, 0x108
call sub.ntdll.dll_memset
lea rax, [rsp + 0x140]
mov r9d, 0x108
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x18005818d
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
cmp rcx, rbx
je 0x18005820f
test byte [rcx + 0x1c], 1
je 0x180058163
cmp byte [rcx + 0x19], 2
jb 0x180058163
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180146040]
lea r8, [0x180134310]
mov r9d, eax
mov edx, 0xc
mov rcx, qword [rcx + 0x10]
call fcn.180012460
mov rcx, qword [0x180146040]
cmp rcx, rbx
je 0x18005820f
test byte [rcx + 0x1c], 1
je 0x18005820f
cmp byte ds:[rcx + 0x19], 2
jb 0x18005820f
mov edx, 0x10
jmp 0x1800581ff
cmp qword [rsp + 0x140], 0x108
jne 0x1800581b5
cmp dword [rsp + 0x30], 0x4550
jne 0x1800581b5
mov eax, dword [rsp + 0x58]
add rax, qword [rdi + 0x20]
mov qword [rdi + 0x30], rax
mov al, 1
jmp 0x180058211
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
cmp rcx, rbx
je 0x18005820f
test byte [rcx + 0x1c], 1
je 0x18005820f
cmp byte [rcx + 0x19], 2
jb 0x18005820f
mov edx, 0x11
jmp 0x1800581ff
mov rcx, qword [0x180146040]
lea rbx, [0x180146040]
cmp rcx, rbx
je 0x18005820f
test byte [rcx + 0x1c], 1
je 0x18005820f
cmp byte [rcx + 0x19], 2
jb 0x18005820f
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x180134508]
call fcn.180011520
xor al, al
mov rcx, qword ds:[rsp + 0x190]
xor rcx, rsp
call fcn.18008e6f0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret