joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140119420
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x1402a2f90]
mov qword [rcx], rax
add rcx, 8
call fcn.14005b6a0
lea rcx, [rsi + 0x10]
call fcn.14005b6a0
mov byte [rsi + 0x18], 0
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], 0
call fcn.14005b6a0
mov byte [rsi + 0x48], 0
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], 0
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], 0
mov dword [rsi + 0xe8], 0x3f800000
mov dword [rsi + 0xf0], 0
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], 0x3f800000
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], 0x3f800000
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], 0x3f800000
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], 0x3f800000
mov qword [rsi + 0x1b0], 0
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], 0
mov eax, dword [0x1402bd69c]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.1401775c0
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], 0
lea rcx, [rsi + 0x310]
xor edx, edx
call fcn.140105ee0
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.140105ee0
lea rcx, [rsi + 0x330]
xor edx, edx
call fcn.140105ee0
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
mov dword [rsi + 0x360], 0x3f800000
movups xmmword [rsi + 0x368], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
mov byte [rsi + 0x398], 0
mov dword [rsi + 0x39c], edi
mov byte [rsi + 0x3a0], 0
movups xmmword [rsi + 0x3a8], xmm6
movups xmmword [rsi + 0x3b8], xmm6
call fcn.140019da0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.140119680
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
je 0x140119649
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140112150.0]
call fcn.140117ac0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140117c60
mov qword [0x140324738], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14011f300
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r9
mov r13, r8
mov r14, rdx
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov r12, r8
mov rax, qword [rbx + 0x10]
cmp rcx, rax
jae 0x14011f394
cmp r13, rcx
je 0x14011f3ff
add r13, 8
lea rax, [rcx - 8]
mov rdx, rcx
cmp rax, rcx
jae 0x14011f363
mov rdx, rcx
nop dword [rax + rax]
mov rbp, qword [rax]
mov qword [rdx], rbp
add rax, 8
add rdx, 8
cmp rax, rcx
jb 0x14011f350
mov qword [rbx + 8], rdx
cmp rcx, r13
je 0x14011f388
mov r8, rcx
sub r8, r13
mov rax, r8
sar rax, 3
shl rax, 3
sub rcx, rax
mov rdx, r12
call fcn.140258c70
mov rax, qword [rsi]
mov qword [r12], rax
jmp 0x14011f4c1
mov rdi, qword [rbx]
sub rcx, rdi
sar rcx, 3
inc rcx
mov rdx, rcx
shr rdx, 0x3d
jne 0x14011f52e
movabs rdx, 0x1fffffffffffffff
sub rax, rdi
mov r15, rax
sar r15, 2
cmp r15, rcx
cmovbe r15, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r15, rdx
test r15, r15
mov qword [rsp + 0x30], rsi
je 0x14011f413
cmp r15, rdx
ja 0x14011f533
lea rcx, [r15*8]
call fcn.140255d40
mov rsi, rax
jmp 0x14011f415
mov rax, qword [rsi]
mov qword [r12], rax
add r13, 8
mov qword [rbx + 8], r13
jmp 0x14011f4c1
xor esi, esi
mov rax, r13
sub rax, rdi
mov rcx, rax
sar rcx, 3
lea rbp, [rsi + rcx*8]
lea rdx, [rsi + r15*8]
cmp rcx, r15
jne 0x14011f458
test rax, rax
jle 0x14011f4d8
mov qword [rsp + 0x28], rdx
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
shl rax, 2
and rax, 0xfffffffffffffff8
sub rbp, rax
jmp 0x14011f45d
mov qword [rsp + 0x28], rdx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rbp], rax
lea r15, [rbp + 8]
mov rdx, qword [rbx]
mov r8, r13
sub r8, rdx
mov rsi, rbp
sub rsi, r8
mov rcx, rsi
call fcn.140258c70
mov rdi, qword [rbx + 8]
sub rdi, r13
mov rcx, r15
mov rdx, r12
mov r8, rdi
call fcn.140258c70
lea rax, [rdi + rbp]
add rax, 8
mov rcx, qword [rbx]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 0x10], rax
test rcx, rcx
je 0x14011f4be
call fcn.140255d7c
mov r12, rbp
mov qword [r14], r12
mov rax, r14
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
sar rax, 2
cmp rdi, r13
mov edi, 1
cmovne rdi, rax
movabs rax, 0x1fffffffffffffff
cmp rdi, rax
ja 0x14011f533
lea rcx, [rdi*8]
call fcn.140255d40
mov rcx, rdi
and rcx, 0xfffffffffffffffc
lea rbp, [rax + rcx*2]
lea rax, [rax + rdi*8]
mov qword [rsp + 0x28], rax
test rsi, rsi
je 0x14011f45d
mov rcx, rsi
call fcn.140255d7c
jmp 0x14011f45d
call fcn.14026f3e0
call fcn.1400207e0
int3
Function at 0x1401229d9
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x34]
mov dword [r12], 0xaaaaaaaa
mov qword [rsp + 0x20], r12
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140122a87
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x28]
mov qword [rbp], rax
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, eax
mov r15, qword [rbp]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140122a87
test r14d, r14d
setne al
cmp r15, rsi
sete sil
and sil, al
jmp 0x140122a89
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140257200
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140143dd4
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x158], rax
cmp qword [0x140310680], 0xffffffffffffffff
je 0x140143e1b
mov rsi, rcx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140257200
mov rcx, rsi
add rsp, 0x160
pop rsi
jmp fcn.140143ea0
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x140143e68
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x34c
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x30]
lea rdx, str.not_connected
mov r8d, 0xd
call fcn.14001eb4a
mov rcx, rsi
call fcn.1400f68f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7003
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140257200
nop
add rsp, 0x160
pop rsi
ret

Function at 0x140143ea0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1403259b0]
test rax, rax
jne 0x140143ee4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1403259b0]
test rax, rax
je 0x140143ed1
cmp eax, 2
jne 0x140143f32
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x140143fca
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8e
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x140143fbd
mov eax, 1
lock xadd qword [0x1403259e8], rax
test rax, rax
jle 0x140143f52
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140325968], eax
mov qword [0x140325960], rsi
mov rcx, qword [0x140310680]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x140143fca
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xba
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.14001eb4a
mov rcx, rsi
call fcn.1400f68f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140257200
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x14014529e
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1401452c5
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1401453bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140145306
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140257200
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1401453db
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x1401453bd
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.1400f7550
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14001eb4a
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140103680
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140145397
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.14001eb4a
cmp byte [rsp + 0x4f], 0
jns 0x1401453b3
mov rcx, qword [rsp + 0x38]
call fcn.140255d7c
lea rcx, [rsp + 0x50]
call fcn.1400f7640
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140257200
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
Function at 0x1401453db
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140145402
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401454e4
mov dil, 1
test al, 0x10
jne 0x14014559d
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x14014559b
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14001eb4a
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140103680
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401454a4
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.14001eb4a
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.14001eb4a
cmp byte [rsp + 0x5f], 0
jns 0x1401454d5
mov rcx, qword [rsp + 0x48]
call fcn.140255d7c
lea rcx, [rsp + 0x60]
call fcn.1400f68f0
jmp 0x14014559b
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x14014559b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.1400f7550
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14001eb4a
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140103680
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140145575
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.14001eb4a
cmp byte [rsp + 0x5f], 0
jns 0x140145591
mov rcx, qword [rsp + 0x48]
call fcn.140255d7c
lea rcx, [rsp + 0x60]
call fcn.1400f7640
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140257200
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
Function at 0x140146e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov rbp, qword [rcx + 0x58]
mov r15d, 1
cmp rdi, rbp
je 0x140146f08
mov r14, r8
mov rsi, rcx
lea rbx, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.140148558
test al, al
jne 0x140146ecc
add rdi, 0x70
cmp rdi, rbp
jne 0x140146eb1
mov rdi, rbp
cmp rdi, qword [rsi + 0x58]
je 0x140146f08
cmp byte [rdi + 0x27], 0
jns 0x140146ede
mov rcx, qword [rdi + 0x10]
jmp 0x140146ee2
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov r15d, 1
cmovne r15d, ecx
test r15d, r15d
jne 0x140146f08
mov qword [r14], rdi
xor r15d, r15d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140257200
mov eax, r15d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14014839c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x1401483b3
cmp byte [rcx + 0x27], 0
jns 0x1401483c2
mov rcx, qword [rcx + 0x10]
jmp 0x1401483c6
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x1401483df
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x140149280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x140149295
mov r8d, r8d
add rsp, 0x28
jmp fcn.140148b30
test r8d, r8d
jne 0x14014929f
call fcn.1401a4950
xor eax, eax
add rsp, 0x28
ret
Function at 0x140153340
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1b
call fcn.1400f5dc0
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.140153ea0
mov rcx, rsi
call fcn.14010b840
test al, al
je 0x1401534fb
mov rcx, rsi
call fcn.1400588a0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
cmp qword [rsi + 0x40], rax
je 0x14015345c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jb 0x14015343b
call fcn.1400f5de0
mov rcx, qword [rsi + 0x40]
call fcn.140112bc0
mov qword [rsi + 0x40], 0
mov rax, rdi
inc rax
cmp rax, 2
jb 0x140153450
mov qword [rsi + 0x40], rdi
call fcn.1400f5de0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x40]
lea rax, [rdi + 1]
cmp rax, 2
jae 0x14015346d
xor edi, edi
jmp 0x1401534fb
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, qword [rsi + 0x30]
mov rbx, qword [0x1403102a0]
mov rax, rbx
and rax, rcx
mov rdx, qword [0x140310288]
cmp rax, rdx
jne 0x1401534bd
call fcn.1400fa610
mov rbx, qword [0x1403102a0]
mov rdx, qword [0x140310288]
and rbx, rdi
cmp rbx, rdx
jne 0x1401534cd
mov rcx, rdi
call fcn.1400fa4f0
mov qword [rsi + 0x30], rdi
test rdi, rdi
je 0x140153466
lea rax, fcn.140024040
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x30]
call fcn.140180758
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.1401541a0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140257200
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14015e0d0
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x14015e2e2
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x140310ca0], rax
jne 0x14015e2e5
mov rsi, rcx
mov edi, dword [rcx + 0xc]
add rdi, 0x4f8
mov byte [rsp + 0x3f], 0xaa
movzx edx, byte [rcx + 2]
mov rcx, rdi
call fcn.1400fa070
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea r14, [rsi + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x14015e152
mov rcx, r14
call fcn.14015f330
mov rax, qword [r15]
mov rbx, qword [rax]
test rbx, rbx
je 0x14015e244
mov byte [rsp + 0x3f], 0
mov r8, qword [rbx]
test r8, r8
je 0x14015e1a3
lea rdx, [rsi + 0x48]
mov rcx, r8
bswap rcx
mov edi, dword [rdx + r12*8 + 0x18]
mov rdx, rcx
xor rdx, rbx
cmp rdx, 0x1fffff
ja 0x14015e2ab
mov edx, ecx
and edx, 0x1fc000
je 0x14015e2ab
prefetcht0 byte [rcx]
jmp 0x14015e1a5
xor ecx, ecx
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rbx
mov rdx, rsi
call fcn.14015e300
mov ecx, dword [0x140328e98]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x14031d424]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x180], rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140257200
mov rax, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, rdi
call fcn.14015f500
test rax, rax
je 0x14015e2db
mov rbx, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x14015e1bf
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.first
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.1400fa1c0
mov rcx, rsi
call fcn.140019da0
mov rcx, rdi
call fcn.1400fa240
xor ebx, ebx
jmp 0x14015e1e9
int3
int3

Function at 0x140163a80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14032a880]
mov ecx, dword [0x14031d424]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140163ab5
lea rcx, [0x14032a870]
add rsp, 0x28
jmp fcn.140105e50
lea rcx, [0x14032a880]
call fcn.140255ea0
cmp dword [0x14032a880], 0xffffffff
jne 0x140163aa5
xorps xmm0, xmm0
movups xmmword [0x14032a870], xmm0
lea rcx, [0x14032a870]
xor edx, edx
call fcn.140105ee0
lea rcx, [0x14032a880]
call fcn.140255f38
jmp 0x140163aa5
Function at 0x140164ad0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
call qword [case.0x140112150.0]
mov byte [rsi + 0x429], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [case.0x140112150.0]
test rax, rax
je 0x140164b42
mov eax, dword [0x14032a880]
mov ecx, dword [0x14031d424]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140164b49
lea rcx, [0x14032a870]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140105e90
nop
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14032a880]
call fcn.140255ea0
cmp dword [0x14032a880], 0xffffffff
jne 0x140164b2e
xorps xmm0, xmm0
movups xmmword [0x14032a870], xmm0
lea rcx, [0x14032a870]
xor edx, edx
call fcn.140105ee0
lea rcx, [0x14032a880]
call fcn.140255f38
jmp 0x140164b2e
Function at 0x140169d60
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rsi, qword [rcx + 0x10]
cmp rsi, qword [rcx + 0x18]
jne 0x140169e65
mov r15, qword [r13]
mov rbx, qword [r13 + 8]
mov rax, rbx
sub rax, r15
jbe 0x140169dd1
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea rdi, [rax + rcx]
inc rdi
shr rdi, 1
shl rdi, 3
mov rcx, rbx
sub rcx, rdi
mov r8, rsi
sub r8, rbx
mov rdx, rbx
call fcn.140258c70
sub rsi, rdi
mov qword [r13 + 0x10], rsi
sub qword [r13 + 8], rdi
jmp 0x140169e65
mov rax, rsi
sub rax, r15
sar rax, 2
cmp rsi, r15
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x140169e80
lea rcx, [r12*8]
call fcn.140255d40
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
lea r8, [rax + r12*8]
mov r9, rcx
sub rsi, rbx
je 0x140169e41
mov rdi, rsi
sar rdi, 3
and rsi, 0xfffffffffffffff8
mov r9, rsi
add r9, rcx
shl rdi, 3
xor esi, esi
mov rdx, qword [rbx + rsi]
mov qword [rcx + rsi], rdx
add rsi, 8
cmp rdi, rsi
jne 0x140169e30
mov qword [r13], rax
mov qword [r13 + 8], rcx
mov qword [r13 + 0x10], r9
mov qword [r13 + 0x18], r8
mov rsi, r9
test r15, r15
je 0x140169e65
mov rcx, r15
call fcn.140255d7c
mov rsi, qword [r13 + 0x10]
mov rax, qword [r14]
mov qword [rsi], rax
add qword [r13 + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400207e0
int3

Function at 0x140169e90
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rdi, qword [rcx + 8]
cmp rdi, qword [rcx]
je 0x140169eb6
mov rbx, rdi
jmp 0x140169fa2
mov r15, qword [r13 + 0x10]
mov rax, qword [r13 + 0x18]
cmp r15, rax
jae 0x140169f0b
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea rbx, [r15 + r12*8]
sub r15, rdi
je 0x140169efa
sub rbx, r15
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call fcn.140258c70
mov rdi, qword [r13 + 0x10]
mov qword [r13 + 8], rbx
lea rax, [rdi + r12*8]
mov qword [r13 + 0x10], rax
jmp 0x140169fa2
mov rcx, rax
sub rcx, rdi
sar rcx, 2
cmp rax, rdi
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x140169fbe
lea rcx, [r12*8]
call fcn.140255d40
lea rbx, [r12 + r12]
add rbx, 6
and rbx, 0xfffffffffffffff8
add rbx, rax
lea r8, [rax + r12*8]
mov r9, rbx
sub r15, rdi
je 0x140169f81
mov rcx, r15
sar rcx, 3
and r15, 0xfffffffffffffff8
mov r9, r15
add r9, rbx
shl rcx, 3
xor edx, edx
nop
mov rsi, qword [rdi + rdx]
mov qword [rbx + rdx], rsi
add rdx, 8
cmp rcx, rdx
jne 0x140169f70
mov qword [r13], rax
mov qword [r13 + 8], rbx
mov qword [r13 + 0x10], r9
mov qword [r13 + 0x18], r8
test rdi, rdi
je 0x140169fa2
mov rcx, rdi
call fcn.140255d7c
mov rbx, qword [r13 + 8]
mov rax, qword [r14]
mov qword [rbx - 8], rax
add qword [r13 + 8], 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400207e0
int3