joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012e3c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000caa0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140012ec6
cmp byte [rbp - 0x21], r15b
je 0x140012ec1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140012efc
call fcn.14000982c
test eax, eax
jne 0x140012ee8
cmp byte [rbp - 0x21], r15b
je 0x140012ee0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140012efc
cmp byte [rbp - 0x21], r15b
je 0x140012ef9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c07c
test eax, eax
jne 0x140012f9c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000caa0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140012f3b
cmp byte [rbp - 0x21], r15b
je 0x140012f70
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140012f70
call fcn.14000982c
test eax, eax
jne 0x140012f5c
cmp byte [rbp - 0x21], r15b
je 0x140012f55
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140012f70
cmp byte [rbp - 0x21], r15b
je 0x140012f6d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c07c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140012f9c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140012f9f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140012fad
mov rcx, rdi
call fcn.1400095d8
cmp byte [rbp + 0x3f], r15b
je 0x140012fbc
mov rcx, qword [rbp + 0x27]
call fcn.1400095d8
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x238
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x220], rax
lea rdx, [rsp + 0x20]
mov ecx, 3
lea rax, [0x140003250]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140001030
movups xmm0, xmmword [rax]
mov rcx, qword [rax + 0x70]
movups xmm1, xmmword [rax + 0x10]
movdqa xmm2, xmmword [str.dddddddddddddddd]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
xor eax, eax
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
mov qword [rdx + 0x70], rcx
nop dword [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
psubb xmm0, xmm2
movdqu xmmword [rsp + rax + 0x20], xmm0
movdqu xmm1, xmmword [rsp + rax + 0x30]
psubb xmm1, xmm2
movdqu xmmword [rsp + rax + 0x30], xmm1
add rax, 0x20
cmp rax, 0x1df
jle 0x1400010d0
mov eax, 0x1e0
nop dword [rax]
nop word [rax + rax]
add byte [rsp + rax + 0x20], 0x9c
inc rax
cmp rax, 0x1f6
jle 0x140001110
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1415e7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1415e71df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1415e7089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415e706f
add dl, dl
jne 0x1415e7096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415e70f6
xor eax, eax
add dl, dl
jne 0x1415e70a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415e71ad
add dl, dl
jne 0x1415e70b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415e70c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415e70d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415e70dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415e70ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1415e707e
mov eax, 1
add dl, dl
jne 0x1415e7106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415e7113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415e70fb
sub eax, ebx
mov ebx, 1
jne 0x1415e714c
mov ecx, 1
add dl, dl
jne 0x1415e712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415e713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415e7123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415e707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1415e7168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415e7175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415e715d
cmp eax, 0x7d00
jae 0x1415e719b
cmp eax, 0x500
jb 0x1415e7196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415e707e
cmp eax, 0x7f
ja 0x1415e719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415e707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415e71d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1415e707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001450
Capabilities:
Open clipboard

Disassembly:
push rsi
sub rsp, 0x20
xor esi, esi
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
xor esi, esi
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x140001580
call sub.KERNEL32.dll_GetLastError
lea rsi, [0x140115e50]
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x140041f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x828
mov ecx, dword [0x14010a018]
test ecx, ecx
je 0x140041fc3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140041fdc
cmp qword [rax + 8], 0
je 0x140041fdc
add rax, 0x10
jmp 0x1400421d7
lea rcx, section..data
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140041fb3
mov ecx, dword [0x14010a018]
test ecx, ecx
je 0x1400421b8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400421d5
mov rsi, rax
test rax, rax
jne 0x14004204c
movzx eax, byte [0x14017a148]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x1400421fa
mov rsi, rax
lea rax, section..data
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14010a018]
test ecx, ecx
je 0x1400421fc
dec ecx
mov rdx, rsi
call fcn.140107c40
mov rax, qword [0x14017a078]
cmp rax, 3
jne 0x1400421e4
mov rdi, qword [0x14017a080]
lock inc qword [rdi]
jle 0x1400421fa
mov eax, 0x60
movups xmm0, xmmword [0x140115df8]
movups xmm1, xmmword [0x140115de8]
nop word cs:[rax + rax]
movups xmmword [rsp + rax - 0x30], xmm0
movups xmmword [rsp + rax - 0x40], xmm1
movups xmmword [rsp + rax - 0x20], xmm1
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax], xmm1
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax + 0x20], xmm1
movups xmmword [rsp + rax + 0x30], xmm0
sub rax, 0xffffffffffffff80
cmp rax, 0x860
jne 0x140042090
movzx eax, byte [0x14017a148]
mov edx, 0x980
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x1400421fa
mov r14, rax
and r14, 0xffffffffffffff80
lea rbx, [r14 + 0x80]
mov qword [r14 + 0x78], rax
mov qword [r14 + 0x80], 0
mov qword [r14 + 0x88], rdi
lea rcx, [r14 + 0x90]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
call sub.msvcrt.dll_memcpy
xorps xmm0, xmm0
movaps xmmword [r14 + 0x890], xmm0
mov qword [r14 + 0x8a0], 1
mov qword [r14 + 0x8a8], 0
mov qword [r14 + 0x900], 0
mov rcx, qword [0x14017a080]
mov rax, qword [rcx + 0x200]
nop word cs:[rax + rax]
mov qword [rbx], rax
lock cmpxchg qword [rcx + 0x200], rbx
jne 0x140042160
lea rax, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rbx
je 0x1400421d7
mov rdx, qword [rcx + 0x820]
lea r8, [rdx - 1]
mov qword [rcx + 0x820], r8
cmp qword [rcx + 0x818], 0
jne 0x1400421d7
cmp rdx, 1
jne 0x1400421d7
mov rsi, rax
call fcn.1400414c0
mov rax, rsi
jmp 0x1400421d7
lea rcx, section..data
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140041ffb
xor eax, eax
add rsp, 0x828
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400418f0
mov rdi, qword [0x14017a080]
lock inc qword [rdi]
jg 0x14004206e
ud2
lea rcx, section..data
call fcn.1400dcb90
mov ecx, eax
jmp 0x140042044
Function at 0x140047020
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x14010a140]
test ecx, ecx
je 0x140047050
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140047069
cmp qword [rax + 8], 0
je 0x140047069
add rax, 0x10
jmp 0x140047125
lea rcx, [0x14010a128]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140047040
mov ecx, dword [0x14010a140]
test ecx, ecx
je 0x140047106
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140047123
test rax, rax
jne 0x1400470d5
movzx eax, byte [0x14017a148]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x140047142
lea rcx, [0x14010a128]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14010a140]
test ecx, ecx
je 0x14004712c
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140107c40
mov rax, rdi
test rsi, rsi
je 0x1400470ef
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x1400470f1
mov rcx, qword [rsi + 8]
jmp 0x1400470f1
xor ecx, ecx
lea rdx, [rax + 0x10]
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
mov rax, rdx
jmp 0x140047125
lea rcx, [0x14010a128]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140047088
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14010a128]
mov rdi, rax
call fcn.1400dcb90
mov ecx, eax
mov rax, rdi
jmp 0x1400470c7
ud2
Function at 0x14009cfd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x14010a070]
test ecx, ecx
je 0x14009d000
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14009d019
cmp qword [rax + 8], 0
je 0x14009d019
add rax, 0x10
jmp 0x14009d0e2
lea rcx, [0x14010a058]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14009cff0
mov ecx, dword [0x14010a070]
test ecx, ecx
je 0x14009d0c3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14009d0e0
test rax, rax
jne 0x14009d085
movzx eax, byte [0x14017a148]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14009d102
lea rcx, [0x14010a058]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14010a070]
test ecx, ecx
je 0x14009d0e9
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.140107c40
mov rax, rdi
test rsi, rsi
je 0x14009d09b
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x14009d0ae
mov ecx, 1
lock xadd qword [0x14010a078], rcx
test rcx, rcx
je 0x14009d102
lea rdx, [rax + 0x10]
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
mov rax, rdx
jmp 0x14009d0e2
lea rcx, [0x14010a058]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14009d038
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14010a058]
mov rdi, rax
call fcn.1400dcb90
mov ecx, eax
mov rax, rdi
jmp 0x14009d077
ud2
Function at 0x1400c8d70
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov r14, r8
mov rsi, rcx
mov rdi, r8
sub rdi, rdx
shr rdi, 3
sub r14, rdx
je 0x1400c8dfe
movabs rax, 0x7ffffffffffffff8
cmp r14, rax
ja 0x1400c8fc2
mov rbx, rdx
movzx eax, byte [0x14017a148]
xor ecx, ecx
mov rdx, r14
call fcn.1400dbb10
test rax, rax
je 0x1400c8fc2
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
cmp r14, 0xc0
jae 0x1400c8e29
xor ecx, ecx
mov r8, rcx
or r8, 1
test r14b, 8
jne 0x1400c8ef6
mov r9, rcx
cmp rdi, r8
jne 0x1400c8f23
jmp 0x1400c8f91
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
test rdi, rdi
jne 0x1400c8fac
xor edx, edx
jmp 0x1400c8f91
lea rdx, [rax + rdi*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x1400c8ddc
lea rdx, [rax + 4]
lea r8, [rax + rdi*8]
add r8, 0xfffffffffffffffc
cmp r8, rdx
jb 0x1400c8ddc
movabs rdx, 0x1ffffffffffffffe
lea r8, [rdi - 1]
lea r9, [rdx + 1]
cmp r8, r9
ja 0x1400c8ddc
mov rcx, r14
and rcx, 0xfffffffffffffff8
lea r8, [rbx + rcx]
cmp rax, r8
jae 0x1400c8e80
add rcx, rax
cmp rcx, rbx
ja 0x1400c8dda
and rdx, rdi
xor ecx, ecx
movdqa xmm0, xmmword [0x14010dc50]
nop dword [rax]
movdqu xmm1, xmmword [rbx + rcx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx*8], xmm2
add rcx, 2
cmp rdx, rcx
jne 0x1400c8e90
mov rcx, rdx
cmp rdi, rdx
jne 0x1400c8ddc
jmp 0x1400c8f91
mov edx, dword [rbx + rcx*8]
mov r9d, dword [rbx + rcx*8 + 4]
cmp edx, r9d
mov r10d, r9d
cmovb r10d, edx
cmova r9d, edx
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
inc rcx
mov rdx, rcx
mov r9, r8
cmp rdi, r8
je 0x1400c8f91
lea rax, [rax + rcx*8]
add rax, 0xc
lea rdx, [rbx + r9*8]
add rdx, 0xc
sub rdi, r9
xor r8d, r8d
nop dword [rax]
mov r9d, dword [rdx + r8*8 - 0xc]
mov r10d, dword [rdx + r8*8 - 8]
cmp r9d, r10d
mov r11d, r10d
cmovb r11d, r9d
cmova r10d, r9d
mov dword [rax + r8*8 - 0xc], r11d
mov dword [rax + r8*8 - 8], r10d
mov r9d, dword [rdx + r8*8 - 4]
mov r10d, dword [rdx + r8*8]
cmp r9d, r10d
mov r11d, r10d
cmovb r11d, r9d
cmova r10d, r9d
mov dword [rax + r8*8 - 4], r11d
mov dword [rax + r8*8], r10d
add r8, 2
cmp rdi, r8
jne 0x1400c8f40
add rcx, r8
mov rdx, rcx
mov qword [rsp + 0x30], rdx
mov qword [rsi + 0x10], rdx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rdi
call fcn.1400d3ba0
mov rdx, qword [rsp + 0x30]
jmp 0x1400c8f91
ud2
Function at 0x1400dcb90
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400dcc0e
mov rax, qword [0x14017d038]
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x1400dcc45
cmp dword [rsp + 0x2c], 0
je 0x1400dcc36
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400dcc47
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x14017a0a0]
nop dword [rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x14017a0a0], rsi
jne 0x1400dcbf0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1400dcc3b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400dcc45
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x1400dcc3b
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x1400dcc3b
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2

Function at 0x1400dce40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14010a0c0]
test ecx, ecx
je 0x1400dcf27
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400dce6b
cmp qword [rax + 8], 0
jne 0x1400dcf1d
mov ecx, dword [0x14010a0c0]
test ecx, ecx
je 0x1400dcf49
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400dcf66
test rax, rax
jne 0x1400dcedb
movzx eax, byte [0x14017a148]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x1400dcf87
lea rcx, [0x14010a0a8]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14010a0c0]
test ecx, ecx
je 0x1400dcf6e
dec ecx
mov rdx, rax
mov rsi, rax
call fcn.140107c40
mov rax, rsi
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
test rdx, rdx
je 0x1400dcf1d
test rcx, rcx
je 0x1400dcf1d
lock dec qword [rcx]
jne 0x1400dcf1d
lea rcx, [rsp + 0x28]
mov rsi, rax
call fcn.1400e6c90
mov rax, rsi
add rax, 0x10
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14010a0a8]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400dce60
jmp 0x1400dce6b
lea rcx, [0x14010a0a8]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400dce8a
xor eax, eax
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14010a0a8]
mov rsi, rax
call fcn.1400dcb90
mov ecx, eax
mov rax, rsi
jmp 0x1400dcecd
ud2
Function at 0x1400dcf90
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x14017a148]
mov edx, 0x10
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x1400dd058
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400dd060]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x1400dd04b
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400dd026
cmp qword [rbx + 0x10], 0x11
jb 0x1400dd015
mov rdi, qword [rdi - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x1400dd1c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x14010a108]
test ecx, ecx
je 0x1400dd1ed
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400dd206
cmp qword [rax + 8], 0
je 0x1400dd206
add rax, 0x10
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14010a0f0]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400dd1dc
mov ecx, dword [0x14010a108]
test ecx, ecx
je 0x1400dd2bc
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400dd2d9
test rax, rax
jne 0x1400dd272
movzx eax, byte [0x14017a148]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x1400dd2fa
lea rcx, [0x14010a0f0]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x14010a108]
test ecx, ecx
je 0x1400dd2e1
dec ecx
mov rdx, rax
mov rsi, rax
call fcn.140107c40
mov rax, rsi
mov rdx, rax
add rax, 0x10
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 8], 0
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], 0
je 0x1400dd1e7
test rcx, rcx
je 0x1400dd1e7
lock dec qword [rcx]
jne 0x1400dd1e7
mov rsi, rax
call fcn.1400e6cf0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14010a0f0]
call fcn.1400dcb90
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400dd225
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14010a0f0]
mov rsi, rax
call fcn.1400dcb90
mov ecx, eax
mov rax, rsi
jmp 0x1400dd264
ud2
Function at 0x1400de7f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r15, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.1400e2bb0
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp rax, r15
je 0x1400de853
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.1400dc530
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmp rbx, r15
jne 0x1400de8bb
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400de8ac
test rax, rax
je 0x1400de8ac
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1400de89b
cmp qword [rdi + 0x10], 0x11
jb 0x1400de88a
mov r14, qword [r14 - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov qword [rsi], r15
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r14, qword [rsp + 0x38]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1400de8da
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x1400de8af
mov qword [rsi], r15
test rbx, rbx
je 0x1400de8af
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree