joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020ff0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xd0]
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x68], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.1401cbbc4
mov rsi, rax
mov rax, qword [0x1402cbde0]
and rax, r15
cmp rax, qword [0x1402cbdc8]
jne 0x140021055
mov rcx, r15
call fcn.1401508a0
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
lea rax, [rsp + 0x64]
mov dword [rax], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
lea r8, [0x140028930]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400210d6
test r14, r14
je 0x1400210cb
mov eax, dword [rsp + 0x64]
mov qword [r14], rdi
mov dword [r14 + 8], eax
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400210a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400210ef
mov ebp, eax
cmp eax, 0x5af
je 0x1400210ef
cmp ebp, 0xe
jne 0x140021148
lea rdx, str.CreateThreadInternal
lea r8, [0x1402a8c90]
lea r14, [rsp + 0x48]
mov rcx, r14
mov r9d, 0xd9
call fcn.1402149c0
mov rcx, rbx
mov rdx, r14
call fcn.14020bbe0
test rsi, rsi
je 0x1400210a7
mov rcx, qword [rsi]
mov rax, qword [0x1402cbde0]
and rax, rcx
cmp rax, qword [0x1402cbdc8]
jne 0x14002113b
call fcn.1401509f0
mov rcx, rsi
call fcn.1401cbbbc
jmp 0x1400210a7
mov eax, dword [0x1402e4028]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400211cb
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov edx, ebp
call fcn.1401c9be0
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
jns 0x14002118e
mov r8, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
jmp 0x140021192
and r8d, 0x7f
lea r14, [rsp + 0x38]
mov rcx, r14
mov rdx, rbx
call fcn.1401c8260
mov rcx, qword [0x1402e4020]
mov rdx, r14
call fcn.140007350
cmp byte [rsp + 0x5f], 0
jns 0x14002111b
mov rcx, qword [rsp + 0x48]
call fcn.1401cbbbc
jmp 0x14002111b
lea rcx, [0x1402e4028]
call fcn.1401cc16c
cmp dword [0x1402e4028], 0xffffffff
jne 0x140021169
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140004060
mov qword [0x1402e4020], rax
lea rcx, [0x1402e4028]
call fcn.1401cc1d4
jmp 0x140021169
Function at 0x140021db0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x14029ca60]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str.file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xac
call fcn.140158eb0
xor edi, edi
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140181c40
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14], rax
mov rcx, qword [rbx]
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rdi, rdi
or rdi, qword [rbx]
mov rcx, rsi
call fcn.140181760
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400221a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1028
call fcn.1401ce550
sub rsp, rax
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, dword [0x1402da9c8]
cmp esi, 0xffffffff
je 0x140022253
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140022285
lea rdi, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.1401d06e0
lea rdx, [rsp + 0x23]
mov r14, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call r14
mov ecx, 0x1000
call fcn.1401cbf8c
mov rbx, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rdi
call fcn.1401d0030
mov rdx, rbx
or rdx, 3
mov ecx, esi
call r14
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rbx
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140022288
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x1402da9c8], esi
je 0x1400221d3
mov ecx, esi
call sub.KERNEL32.dll_TlsFree
mov esi, dword [0x1402da9c8]
jmp 0x1400221d3
int3
int3
Function at 0x1400224c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400224e7
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140022521
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140022540
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ce5b0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140022620
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
cmp dword [0x1402e5a28], 2
jg 0x14002260d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x26f
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140206b20
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
js 0x14002259b
and eax, 0x7f
jmp 0x1400225a2
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
test rax, rax
js 0x140022614
test rsi, rsi
jne 0x1400225bb
test rax, rax
jne 0x140022617
lea rsi, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14017d440
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1400225dd
and r8d, 0x7f
jmp 0x1400225e7
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140206b20
cmp byte [rsp + 0x4f], 0
jns 0x140022603
mov rcx, qword [rsp + 0x38]
call fcn.1401cbbbc
lea rcx, [rsp + 0x50]
call fcn.14023caa0
xor esi, esi
jmp 0x140022524
int3
int3

Function at 0x140022620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140022647
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140022675
mov dil, 1
test al, 0x10
je 0x1400226d6
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
cmp dword [0x1402e5a28], 2
jg 0x1400226d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x25b
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140206b20
mov rcx, rax
mov rdx, rsi
call fcn.140062f20
mov rcx, rdi
call fcn.14023caa0
xor edi, edi
jmp 0x140022659
cmp dword [0x1402e5a28], 2
jg 0x1400226d2
lea rdx, str.crash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x25f
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140206b20
mov rcx, rax
mov rdx, rsi
call fcn.140062f20
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140206b20
mov rcx, rdi
call fcn.1400038d0
jmp 0x1400226d2
Function at 0x140024bf0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400255d0
mov rax, qword [rsi]
test rax, rax
je 0x140024c67
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140024c6e
lea rcx, [rsp + 0x28]
call fcn.140024cd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140024c40
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140024c86
add rbx, 0x70
cmp rbx, r15
je 0x140024c40
jmp 0x140024c75
cmp byte [rbx + 0x27], 0
jns 0x140024c92
mov rcx, qword [rbx + 0x10]
jmp 0x140024c96
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x140024c7b
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x140024cbc
mov rcx, r14
mov rdx, rbx
call fcn.14012c830
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140024c7b
mov rcx, rdi
mov rdx, rbx
call fcn.14012c620
mov r14, rax
jmp 0x140024cb6
Function at 0x140026590
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1401d06e0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14002664d
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1401cc340
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1401b5140
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140027b20
cmp byte [rsi + 0x17], 0
jns 0x14002661f
mov rcx, qword [rsi]
call fcn.1401cbbbc
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x14002664d
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140027e30
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401d06e0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140027ed8
cmp word [rsp + 0x70], 0
je 0x140027ed8
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1401cc340
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1401b5140
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x140027ea7
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.140026590
test al, al
jne 0x140027ec5
lea rax, [0x1402a91a0]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1401b5140
cmp byte [rsp + 0x57], 0
jns 0x140027ea7
mov rcx, qword [rsp + 0x40]
call fcn.1401cbbbc
jmp 0x140027ea7
Function at 0x140028110
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x68]
mov rcx, rdi
call fcn.140172cd0
cmp byte [rdi + 0x17], 0
jns 0x140028157
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x7f], 0
jns 0x140028178
mov rcx, qword [rsp + 0x68]
call fcn.1401cbbbc
test rsi, rsi
je 0x140028181
test edi, edi
jne 0x1400281a5
test edi, edi
setne bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, edi
add rcx, rcx
call fcn.1401cbf8c
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x68]
mov rcx, r14
call fcn.140172cd0
cmp byte [r14 + 0x17], 0
jns 0x1400281d7
mov r14, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x7f], 0
jns 0x1400281f7
mov rcx, qword [rsp + 0x68]
call fcn.1401cbbbc
mov qword [rsp + 0x30], rbx
test rbx, rbx
je 0x14002824a
mov rcx, rbx
call fcn.1401cc340
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x68]
call fcn.14017d440
cmp byte [rsi + 0x17], 0
js 0x140028240
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1401cbf84
jmp 0x140028181
mov rcx, qword [rsi]
call fcn.1401cbbbc
jmp 0x140028222
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.140207060
int3
Function at 0x140028450
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402da9c8]
cmp ecx, 0xffffffff
je 0x140028472
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140028477
call fcn.1400221a0
mov eax, dword [0x1402e58c0]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140028527
mov rbx, qword [0x1402e58b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140028569
mov rax, qword [0x1402e40a8]
inc rax
xor ecx, ecx
lea rdx, [0x1402e40b0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x140028576
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1402e58b0]
inc ecx
mov dword [0x1402e58b0], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1402e40a8], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x140028588
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1402e58c0]
call fcn.1401cc16c
cmp dword [0x1402e58c0], 0xffffffff
jne 0x14002849c
mov ecx, 8
call fcn.1401cbbc4
mov qword [rax], 0
mov qword [0x1402e58b8], rax
lea rcx, [0x1402e58c0]
call fcn.1401cc1d4
jmp 0x14002849c
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x1400284b4
inc rcx
cmp rcx, 0x100
jne 0x1400284c7
jmp 0x14002850d
int3

Function at 0x14002bf20
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002bfc1
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14002bfb0
cmp eax, 0xffffffff
je 0x14002bffb
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x14002bfd5
mov eax, dword [rsp + 0x2c]
jmp 0x14002bf90
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14002bf92
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x14002bf83
jmp 0x14002bfc1
int3
Function at 0x14002fee0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1058
call fcn.1401ce550
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x1050], rax
lea r14, [rsp + 0x850]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401d06e0
lea r9, [rsp + 0x4c]
mov dword [r9], 1
lea rax, [rsp + 0x48]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ffe1
mov eax, dword [rsp + 0x4c]
cmp eax, 1
jne 0x14003003f
lea rbx, [rsp + 0x850]
mov rcx, rbx
call fcn.1401cc340
mov rdi, rax
mov al, byte [rsi + 0x17]
test al, al
js 0x14002ffeb
cmp rdi, 0xa
ja 0x14003000e
mov rbx, rsi
test rdi, rdi
je 0x14002ffaf
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x850]
mov rcx, rbx
call fcn.1401d0030
mov al, byte [rsi + 0x17]
test al, al
js 0x14002ffe5
mov eax, edi
and al, 0x7f
mov byte [rsi + 0x17], al
mov word [rbx + rdi*2], 0
xor edi, edi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
add rsp, 0x1058
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14002ffc2
mov qword [rsi + 8], rdi
jmp 0x14002ffba
mov rax, qword [rsi + 0x10]
mov rdx, rax
btr rdx, 0x3f
dec rdx
cmp rdx, rdi
jb 0x140030008
shr rax, 0x38
mov rbx, qword [rsi]
jmp 0x14002ff91
mov r9, qword [rsi + 8]
jmp 0x140030017
movzx r9d, al
mov edx, 0xa
mov r8, rdi
sub r8, rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], 0
mov rcx, rsi
call fcn.140009b70
jmp 0x14002ffc0
mov edi, 0x3f4
cmp eax, 2
jne 0x14002ffc2
lea rdi, [rsp + 0x50]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401d06e0
lea rcx, [rsp + 0x850]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x48], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x14002ffc2
lea rdi, [rsp + 0x50]
mov rcx, rdi
call fcn.1401cc340
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14005fbb0
jmp 0x14002ffc0
Function at 0x140030940
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140030a35
cmp qword [rsi], 0
jne 0x140030a35
cmp dword [rsi + 0x14], 0
jne 0x140030a35
cmp qword [rsi + 8], 0
jne 0x140030a35
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x1400309b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140030a1c
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400309ac
mov qword [rsi], r14
call fcn.14017a3f0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x1400309ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140030a04
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400309e6
mov qword [rsi + 8], r14
call fcn.14017a3f0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14017a3f0
mov rcx, qword [rsi + 8]
call fcn.14017b060
mov qword [rsi + 8], 0
jmp 0x1400309d3
call fcn.14017a3f0
mov rcx, qword [rsi]
call fcn.14017b060
mov qword [rsi], 0
jmp 0x14003099a
mov rcx, rsi
call fcn.1402454a0
mov rax, qword [rsi]
jmp 0x14003097a
Function at 0x140033080
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140033159
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x40]
mov qword [rbx], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov r14, rax
call r15
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne bl
je 0x14003315d
mov r14, qword [rsp + 0x40]
cmp qword [rsi], r14
je 0x140033128
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140033143
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140033120
mov qword [rsi], r14
call fcn.14017a3f0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14017a3f0
mov rcx, qword [rsi]
call fcn.14017b060
mov qword [rsi], 0
jmp 0x14003310e
mov bl, 1
jmp 0x140033128
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140033120

Function at 0x1400333d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1402e6228]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400334ff
mov ecx, dword [0x1402da9c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003342f
mov rcx, qword [0x1402e6218]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402e6220]
jne 0x14003342f
cmp qword [rax + rcx], 0
jne 0x1400334c0
mov ecx, 4
call fcn.1401cbbc4
mov rsi, rax
mov dword [rax], 0
mov ecx, dword [0x1402da9c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400334f8
mov rcx, qword [0x1402e6218]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402e6220]
jne 0x1400334f8
mov rdi, qword [rax + rcx]
mov ecx, dword [0x1402da9c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x140033493
test rsi, rsi
je 0x1400334b7
call fcn.1400221a0
mov rcx, qword [0x1402e6218]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1402e6220]
mov rdx, qword [0x1402e6218]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
test rdi, rdi
jne 0x140033552
mov ecx, dword [0x1402da9c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400334f4
mov rcx, qword [0x1402e6218]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402e6220]
jne 0x1400334f4
mov rax, qword [rax + rcx]
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1400334ed
xor edi, edi
jmp 0x140033477
lea rcx, [0x1402e6228]
call fcn.1401cc16c
cmp dword [0x1402e6228], 0xffffffff
jne 0x1400333fb
mov qword [0x1402e6220], 0
lea rcx, [0x1402e6218]
mov qword [0x1402e6218], 0xffffffffffffffff
lea rdx, [0x14005e8f0]
call fcn.140028450
lea rcx, [0x1402e6228]
call fcn.1401cc1d4
jmp 0x1400333fb
mov rcx, rdi
call fcn.1401cbbbc
jmp 0x1400334c0