joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025bc0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.1400444d0
test al, al
je 0x140025c19
call fcn.1400444c0
mov rdi, rax
lea rbx, [0x1400cfff8]
mov rcx, rax
mov rdx, rbx
call fcn.1400444e0
test al, al
jne 0x140025c48
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1400444e0
test al, al
jne 0x140025c48
mov eax, dword [rsi]
mov dword [0x1400e6f78], eax
mov bl, 1
test al, 1
jne 0x140025d09
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14005e850
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp qword [0x1400ec5e8], 0
jne 0x140025d9a
mov rax, qword [0x1400ec5f0]
mov qword [0x1400ec5e8], rax
mov ecx, 0x20
call fcn.14005dad8
mov r14, rax
lea rcx, str.vmodule
lea r15, [rsp + 0x48]
mov qword [r15], rcx
call fcn.1400762e0
mov qword [r15 + 8], rax
lea r12, [rsp + 0x58]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.1400445f0
lea r15, [rsp + 0x20]
mov qword [r15], rbx
mov rcx, rbx
call fcn.1400762e0
mov qword [r15 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.1400445f0
lea r9, [0x1400ec5f8]
mov rcx, r14
mov rdx, rbx
mov r8, r12
call fcn.1400ad1b0
mov qword [0x1400ec5f0], r14
cmp byte [rbx + 0x17], 0
jns 0x140025cef
mov rcx, qword [rsp + 0x30]
call fcn.14005db14
cmp byte [rsp + 0x6f], 0
jns 0x140025c19
mov rcx, qword [rsp + 0x58]
call fcn.14005db14
jmp 0x140025c19
mov rcx, qword [0x1400ec620]
test rcx, rcx
jne 0x140025d23
mov rcx, qword [0x1400ec600]
test rcx, rcx
je 0x140025d47
jmp 0x140025d69
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400ec620], 0
mov rcx, qword [0x1400ec600]
test rcx, rcx
jne 0x140025d69
and byte [0x1400e6f78], 0xfe
mov ecx, 0x18
call fcn.14005dad8
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1400ec600], rax
mov rdx, qword [rsi + 8]
call fcn.1400437e0
cmp dword [rsi + 0x14], 0
jne 0x140025d8e
mov rcx, qword [0x1400ec600]
cmp byte [rcx + 0x17], 0
jns 0x140025d88
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1400ab5a0
mov ebx, eax
jmp 0x140025c2b
int3
Function at 0x140028740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1400ca990]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1ce
call fcn.14004acb0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14004b310
cmp byte [rdi + 0x17], 0
jns 0x1400287b6
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.14004b4a0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14005e850
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400287f0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400611e0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14002888f
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.140076a78
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.140044e90
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.1400256b0
mov rcx, r14
mov rdx, rsi
call fcn.140044fa0
mov rcx, rsi
call fcn.140044f90
mov rcx, rbx
call fcn.140044f90
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14005e850
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400288c0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400611e0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140028955
cmp word [rsp + 0x70], 0
je 0x140028955
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.140076a78
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140044e90
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14005e850
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1400ca990]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.140044e50
mov rcx, rdi
call fcn.1400287f0
test al, al
je 0x140028995
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140044e70
jmp 0x1400289b4
lea rax, [0x1400cfcc4]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.140044e90
lea rcx, [rsp + 0x40]
call fcn.140044f90
jmp 0x140028937
Function at 0x140029780
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400297f3
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400297f3
cmp dword [rsp + 0x38], 4
jne 0x1400297f3
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005e850
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140029810
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14005e7e0
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1400611e0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400298c3
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x1400298c7
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.1400437e0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005e850
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x1400298a4
cmp eax, 2
jne 0x14002990c
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1400611e0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x140029913
lea rdx, [rsp + 0x40]
jmp 0x14002989a
mov edi, 0x3f4
jmp 0x1400298a4
mov edi, 0xea
jmp 0x1400298a4

Function at 0x140029920
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005e850
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor r8d, r8d
test edx, edx
cmovns r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x140029920
Function at 0x14002b400
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.14005dad8
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x14002b820]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14002b4a1
test rbp, rbp
je 0x14002b4cc
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005e850
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14002b4ba
mov ebp, eax
cmp eax, 0x5af
je 0x14002b4ba
cmp ebp, 0xe
jne 0x14002b4d7
mov rcx, r15
call fcn.1400b3510
mov rcx, r14
call fcn.14005db14
jmp 0x14002b47f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002b47f
mov eax, dword [0x1400ec6d0]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002b546
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.1400279e0
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x1400ec6c8]
call fcn.140050bd0
cmp byte [rsi + 0x17], 0
jns 0x14002b4c2
mov rcx, qword [rsp + 0x38]
call fcn.14005db14
jmp 0x14002b4c2
lea rcx, [0x1400ec6d0]
call fcn.14005dc30
cmp dword [0x1400ec6d0], 0xffffffff
jne 0x14002b4f8
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.14002fc40
mov qword [0x1400ec6c8], rax
lea rcx, [0x1400ec6d0]
call fcn.14005dcc8
jmp 0x14002b4f8

Function at 0x14002d380
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1400ec770]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002d3dc
movzx eax, word [0x1400ec740]
cmp ax, 9
jne 0x14002d43e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005e850
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1400ec770]
call fcn.14005dc30
cmp dword [0x1400ec770], 0xffffffff
jne 0x14002d3b5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x1400ec760], xmm2
movups xmmword [0x1400ec750], xmm1
movups xmmword [0x1400ec740], xmm0
lea rcx, [0x1400ec770]
call fcn.14005dcc8
jmp 0x14002d3b5
xor esi, esi
test ax, ax
je 0x14002d3c7
cmp ax, 6
jne 0x14002d455
mov esi, 2
jmp 0x14002d3c7
cmp ax, 0xc
jne 0x14002d465
mov esi, 3
jmp 0x14002d3c7
mov esi, 4
jmp 0x14002d3c7
Function at 0x14002d470
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov al, 1
test al, al
je 0x14002d57e
mov rax, qword [rsi]
test rax, rax
jne 0x14002d585
cmp dword [rsi + 0x14], 0
jne 0x14002d583
xor eax, eax
cmp qword [rsi + 8], 0
mov edx, 0
jne 0x14002d585
mov rdi, qword [r14]
cmp rdx, rdi
je 0x14002d4f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002d54d
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002d4ed
mov qword [rsi], rdi
call fcn.14004acd0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi + 8]
mov rdi, qword [r14 + 8]
cmp rax, rdi
je 0x14002d532
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14002d566
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002d52a
mov qword [rsi + 8], rdi
call fcn.14004acd0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [r14 + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [r14 + 0x14]
mov dword [rsi + 0x14], eax
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14004acd0
mov rcx, qword [rsi]
call fcn.14004ace0
mov qword [rsi], 0
jmp 0x14002d4db
call fcn.14004acd0
mov rcx, qword [rsi + 8]
call fcn.14004ace0
mov qword [rsi + 8], 0
jmp 0x14002d517
mov rax, qword [rsi]
jmp 0x14002d585
xor eax, eax
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x14002d5cd
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jae 0x14002d5b0
mov rdx, rax
mov qword [rsi + 0x10], 0
mov rax, rcx
jmp 0x14002d4bf
call fcn.14004acd0
mov rcx, qword [rsi + 8]
call fcn.14004ace0
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
jmp 0x14002d59d
call fcn.14004acd0
mov rcx, qword [rsi]
call fcn.14004ace0
mov qword [rsi], 0
xor eax, eax
jmp 0x14002d58f
Function at 0x140030060
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1400ee930]
cmp rdi, 1
jbe 0x140030089
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140052240
lea rcx, [0x1400ee930]
call fcn.140034240
test al, al
je 0x1400300cf
mov qword [0x1400ee938], 0
lea rbx, [0x1400ee930]
lea rdi, [0x1400ee938]
mov rcx, rdi
xor edx, edx
call fcn.140030c00
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400342e0
jmp 0x140030077
mov rdi, qword [0x1400ee930]
jmp 0x140030077

Function at 0x140030aa0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e82d8]
cmp ecx, 0xffffffff
je 0x140030ac5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x140030ac0

Function at 0x140030ad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14005e7e0
sub rsp, rax
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1400e82d8]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x140030b84
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140030bb3
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400611e0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14005db4c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140060dd0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14005e850
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400349c0
test al, al
je 0x140030bb6
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140030bb9
mov eax, 0xffffffff
lock cmpxchg dword [0x1400e82d8], ecx
jne 0x140030bde
mov ecx, dword [rsp + 0x2c]
jmp 0x140030b08
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.1400349c0
test al, al
je 0x140030bf6
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140030bf6
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140030b9b
mov ecx, dword [rsp + 0x2c]
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1400e82d8]
mov dword [rsp + 0x2c], ecx
jmp 0x140030b08
int3
Function at 0x140030c00
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov eax, 0xffffffff
mov qword [rcx], rax
mov ecx, dword [0x1400e82d8]
cmp ecx, 0xffffffff
je 0x140030ce2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140030ce2
mov eax, dword [0x1400f0198]
mov ecx, dword [0x1400e843c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140030cec
mov rbx, qword [0x1400f0190]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140030d32
mov rax, qword [0x1400ee980]
inc rax
xor ecx, ecx
lea r8, [0x1400ee990]
lea edx, [rax + rcx]
movzx edi, dl
lea rdx, [rdi + rdi*2]
cmp dword [r8 + rdx*8], 0
jne 0x140030d3f
lea rax, [r8 + rdx*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x1400ee980], rdi
mov dword [rsi], edi
mov eax, dword [rax + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
je 0x140030d54
cmp eax, 0x100
jge 0x140030d57
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140030ad0
jmp 0x140030c34
lea rcx, [0x1400f0198]
call fcn.14005dc30
cmp dword [0x1400f0198], 0xffffffff
jne 0x140030c59
mov ecx, 8
call fcn.14005dad8
mov rbx, rax
mov rcx, rax
call fcn.14004bf70
mov qword [0x1400f0190], rbx
lea rcx, [0x1400f0198]
call fcn.14005dcc8
jmp 0x140030c59
mov rcx, rbx
call fcn.14004bf80
jmp 0x140030c71
inc rcx
cmp rcx, 0x100
jne 0x140030c84
jmp 0x140030cb6
int3
int3
Function at 0x1400349c0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400349d5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x140037180
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1400f03a0], 0
jne 0x1400371bd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400371b0
mov dword [rdi], eax
mov dword [0x1400f03a8], eax
mov qword [0x1400f03a0], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x140037870
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
lea r15, [rcx + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140037a51
mov r8, qword [r13 + 0x28]
test r8, r8
je 0x1400379ef
mov rax, r12
shr rax, 0x20
lea edx, [r12*8]
add rdx, 8
xor rdx, rax
movabs rbx, 0x9ddfea08eb382d69
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rdx, rax
xor rdx, rcx
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rbx
mov rax, r8
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, r8
sub rax, rdx
movabs rdx, 0x3333333333333333
mov rbx, rax
and rbx, rdx
shr rax, 2
and rax, rdx
add rax, rbx
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs rdi, 0x101010101010101
imul rdi, rax
shr rdi, 0x38
cmp rdi, 1
ja 0x140037a5e
lea rbx, [r8 - 1]
and rbx, rcx
mov rax, qword [r13 + 0x20]
mov rax, qword [rax + rbx*8]
test rax, rax
je 0x1400379ef
mov rsi, qword [rax]
test rsi, rsi
je 0x1400379ef
lea r9, [r8 - 1]
mov rax, qword [rsi + 8]
cmp rax, rcx
jne 0x1400379d6
cmp qword [rsi + 0x10], r12
jne 0x1400379e7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [0x1400f0c50]
cmp rdi, 1
jbe 0x140037a08
mov rcx, rdi
call fcn.140052200
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call fcn.140052240
mov rcx, qword [r14 + 0x28]
mov rdx, r12
call qword [rcx + 8]
mov rcx, rdi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140052240
cmp edi, 1
ja 0x140037a7a
and rax, r9
cmp rax, rbx
jne 0x1400379ef
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140037977
mov rcx, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rcx, [0x1400f0c50]
call fcn.140034240
test al, al
je 0x140037a90
mov qword [0x1400f0c58], 0
lea rbx, [0x1400f0c50]
lea rdi, [0x1400f0c58]
mov rcx, rdi
xor edx, edx
call fcn.140030c00
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400342e0
jmp 0x14003799c
mov rcx, r15
call fcn.14004bf80
jmp 0x14003789d
mov rbx, rcx
cmp rcx, r8
jb 0x14003795a
mov rax, rcx
xor edx, edx
div r8
mov rbx, rdx
jmp 0x14003795a
cmp rax, r8
jb 0x1400379e2
xor edx, edx
div r8
mov rax, rdx
jmp 0x1400379e2
mov rdi, qword [0x1400f0c50]
jmp 0x14003799c
Function at 0x140037d70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1400f0c10]
cmp rdi, 1
jbe 0x140037d99
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140052240
lea rcx, [0x1400f0c10]
call fcn.140034240
test al, al
je 0x140037ddf
mov qword [0x1400f0c18], 0
lea rbx, [0x1400f0c10]
lea rdi, [0x1400f0c18]
mov rcx, rdi
xor edx, edx
call fcn.140030c00
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400342e0
jmp 0x140037d87
mov rdi, qword [0x1400f0c10]
jmp 0x140037d87
Function at 0x14004a2b0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14004a2f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004a311
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14004a2ef
mov qword [rsi], rdi
call fcn.14004acd0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14004a327
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14004acd0
mov rcx, qword [rsi]
call fcn.14004ace0
mov qword [rsi], 0
jmp 0x14004a2dd
int3