joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400452c0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea r14, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1400dab60
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14005d260
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401849f0]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14005d470
movzx eax, byte [rdi + 0x17]
test al, al
js 0x140045356
and eax, 0x7f
jmp 0x14004535b
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14004542f
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
xor r12d, r12d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1400dab60
mov rcx, r15
mov rdx, r14
call fcn.14005d420
mov edx, dword [rsp + 0x48]
test dl, 1
jne 0x140045473
mov rcx, r14
call fcn.14005d250
test al, al
jne 0x1400454c0
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x1400453c2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14004546c
call r13
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
call fcn.140024cf0
mov rcx, r15
mov rdx, r14
call fcn.14005d470
mov rcx, rdi
mov rdx, r14
call fcn.1400b8160
mov rcx, r14
call fcn.1400b80e0
movzx eax, byte [rsp + 0x47]
test al, al
js 0x14004541e
and eax, 0x7f
jmp 0x140045423
mov rax, qword [rsp + 0x38]
mov r12d, ebp
test rax, rax
jne 0x14004537b
lea rcx, [rsp + 0x30]
call fcn.1400b80e0
lea rcx, [rsp + 0x298]
call fcn.14005d3b0
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1400d8a20
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x1400453e3
test bl, bl
je 0x140045498
cmp byte [rsp + 0x47], 0
js 0x140045485
lea rcx, [rsp + 0x30]
jmp 0x14004548a
mov rcx, qword [rsp + 0x30]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400453a3
lea rcx, [rsp + 0x48]
call fcn.14005d250
test al, al
jne 0x1400454ac
mov edx, dword [rsp + 0x48]
jmp 0x140045477
lea rcx, [rsp + 0x48]
call fcn.14005d250
test al, al
je 0x1400453b3
jmp 0x14004546c
xor ebp, ebp
test bl, bl
je 0x1400453e3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rdx, rsi
mov r8b, 1
call fcn.1400452c0
mov ebp, eax
test eax, eax
jne 0x1400453e3
cmp byte [rsp + 0x47], 0
jns 0x1400454fa
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x1400453e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x1400453e3
Function at 0x140046880
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x140046a49
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.1400f3c5c
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x80]
mov qword [r14 + 0x40], rax
movaps xmm6, xmmword [0x1401849f0]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x48
call fcn.1400b75a0
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400ad390
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.1400ea654
mov ecx, eax
call fcn.1400eae5c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140046a3e
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [0x1401dd008]
xor r12d, r12d
mov rcx, qword [rsp + 0x38]
add rcx, r12
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.1400f38e4
test rax, rax
je 0x1400469e1
mov r15, rax
mov rax, rdi
sub rax, r12
cmp rax, r15
jb 0x140046a4d
add r15, r12
mov rcx, rbx
call fcn.1400f30d0
test eax, eax
je 0x140046a51
mov r12, r15
mov rcx, rbx
call fcn.1400f30fc
test eax, eax
sete bl
mov rdi, r12
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [0x1401dd008]
lea rcx, [rsp + 0x80]
call fcn.1400ad600
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400d8a20
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14d, 0xffff
jmp 0x14004697f
xor ebx, ebx
jmp 0x140046a13
xor ebx, ebx
jmp 0x1400469f1
test r12, r12
mov eax, 0x10000
cmove r14, rax
lea r8, [r15 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [0x1401dd008]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r12, r15
jmp 0x1400469a4
Function at 0x14004b270
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14004b330
mov eax, dword [rsi]
mov dword [0x1401c06e0], eax
test al, 1
jne 0x14004b291
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x1401cd0e0]
test rcx, rcx
jne 0x14004b2ab
mov rcx, qword [0x1401cd0b8]
test rcx, rcx
je 0x14004b2cf
jmp 0x14004b2f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401cd0e0], 0
mov rcx, qword [0x1401cd0b8]
test rcx, rcx
jne 0x14004b2f1
and byte [0x1401c06e0], 0xfe
mov ecx, 0x18
call fcn.1400d74f8
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1401cd0b8], rax
mov rdx, qword [rsi + 8]
call fcn.14004c240
cmp dword [rsi + 0x14], 0
jne 0x14004b316
mov rcx, qword [0x1401cd0b8]
cmp byte [rcx + 0x17], 0
jns 0x14004b310
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.140137790
Function at 0x14004f750
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x68]
mov rcx, rdi
call fcn.1400aea50
cmp byte [rdi + 0x17], 0
jns 0x14004f797
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x7f], 0
jns 0x14004f7b8
mov rcx, qword [rsp + 0x68]
call fcn.1400d7534
test rsi, rsi
je 0x14004f85f
test edi, edi
je 0x14004f85f
mov ecx, edi
add rcx, rcx
call fcn.1400d756c
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x68]
mov rcx, r14
call fcn.1400aea50
cmp byte [r14 + 0x17], 0
jns 0x14004f7fb
mov r14, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x7f], 0
jns 0x14004f81b
mov rcx, qword [rsp + 0x68]
call fcn.1400d7534
mov qword [rsp + 0x30], rbx
test rbx, rbx
je 0x14004f88d
mov rcx, rbx
call fcn.1400f6614
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x68]
call fcn.1400aee90
cmp byte [rsi + 0x17], 0
js 0x14004f883
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1400d7574
test edi, edi
setne bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400d8a20
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.1400d7534
jmp 0x14004f846
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.1401104b0
int3
Function at 0x14004ff40
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1401cd198]
test rdi, rdi
jne 0x14004fff3
mov ecx, 0x50
call fcn.1400d74f8
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1400d74f8
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x140050015
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x1401cd198], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140050041
mov rcx, rax
call fcn.1400f6614
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140050070
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d8a20
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401104b0
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.1401104b0
int3
Function at 0x140050070
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1400424c0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x140050204
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x140192628]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14005023b
lea rdx, [0x140192678]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140050229
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [0x1401dd008]
mov r14, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x140050231
test r12d, r12d
js 0x1400502a6
shl r12, 3
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.1400d74f8
mov rbx, rax
mov qword [rsp + 0x30], rax
add r15, rax
mov qword [rsp + 0x40], r15
xor r13d, r13d
xor r15d, r15d
mov rcx, rbx
add rcx, r13
je 0x14005024e
mov rdx, qword [r14 + r15]
call fcn.14010f710
add r15, 8
add r13, 0x18
cmp r12, r15
jne 0x140050172
mov r15, rbx
add r15, r13
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14004fb70
movups xmmword [rsi], xmm6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400501c6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140050204
cmp r15, rbx
je 0x1400501fc
add r15, 0xffffffffffffffe8
jmp 0x1400501ea
mov rcx, qword [r15]
call fcn.1400d7534
lea rax, [r15 - 0x18]
cmp r15, rbx
mov r15, rax
je 0x1400501fc
test r15, r15
je 0x14005027a
cmp byte [r15 + 0x17], 0
jns 0x1400501de
jmp 0x1400501d6
mov rcx, rbx
call fcn.1400d7534
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d8a20
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x140050124
xor r15d, r15d
xor ebx, ebx
jmp 0x14005019f
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140050121
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401104b0
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.1401104b0
lea rcx, [rsp + 0x30]
call fcn.14010f480
int3

Function at 0x1400543a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x1400543ba
test r8d, r8d
jne 0x1400543b3
call fcn.140066e10
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.1400bda90
Function at 0x14005b210
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1401cd2f0]
mov ecx, dword [0x1401c1138]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005b270
lea rsi, [0x1401cd2e8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400d8a20
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1401cd2f0]
call fcn.1400d7650
cmp dword [0x1401cd2f0], 0xffffffff
jne 0x14005b24c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400dab60
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1400d74f8
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1401cd338]
mov ecx, dword [0x1401c1138]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005b330
lea r8, [0x1401cd308]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14005b430
mov qword [0x1401cd2e8], rsi
lea rcx, [0x1401cd2f0]
call fcn.1400d76e8
jmp 0x14005b24c
lea rcx, [0x1401cd338]
call fcn.1400d7650
cmp dword [0x1401cd338], 0xffffffff
jne 0x14005b301
xorps xmm0, xmm0
movups xmmword [0x1401cd328], xmm0
movups xmmword [0x1401cd318], xmm0
movups xmmword [0x1401cd308], xmm0
lea rcx, [0x1401cd308]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401cd338]
call fcn.1400d76e8
jmp 0x14005b301

Function at 0x14005b380
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401cd338]
mov ecx, dword [0x1401c1138]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005b3bb
movzx eax, word [0x1401cd308]
cmp eax, 9
jne 0x14005b403
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x1401cd338]
call fcn.1400d7650
cmp dword [0x1401cd338], 0xffffffff
jne 0x14005b3a5
xorps xmm0, xmm0
movups xmmword [0x1401cd328], xmm0
movups xmmword [0x1401cd318], xmm0
movups xmmword [0x1401cd308], xmm0
lea rcx, [0x1401cd308]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401cd338]
call fcn.1400d76e8
jmp 0x14005b3a5
test eax, eax
je 0x14005b3b6
cmp eax, 6
jne 0x14005b413
mov eax, 2
jmp 0x14005b3b6
cmp eax, 0xc
jne 0x14005b41f
mov eax, 3
jmp 0x14005b3b6
mov eax, 4
jmp 0x14005b3b6
Function at 0x14005bcd0
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1401849f0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1b
call fcn.1400b75a0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400ad390
mov rcx, rsi
call fcn.1400aa960
test al, al
je 0x14005be4d
mov rcx, rsi
call fcn.140042a20
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
cmp qword [rsi + 0x40], rax
je 0x14005bdcb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x14005be76
mov rax, rdi
inc rax
cmp rax, 2
jb 0x14005bdbf
mov qword [rsi + 0x40], rdi
call fcn.1400b75c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x40]
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14005be91
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, qword [rsi + 0x30]
movabs rbx, 0xfffffffc00000000
mov rax, rcx
and rax, rbx
cmp rax, qword [0x1401b1e88]
je 0x14005be95
and rbx, rdi
cmp rbx, qword [0x1401b1e88]
je 0x14005be9f
mov qword [rsi + 0x30], rdi
test rdi, rdi
je 0x14005be91
lea rax, fcn.14013fef0
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], rdi
call fcn.14006bc70
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.1400ad600
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400d8a20
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400b75c0
mov rcx, qword [rsi + 0x40]
call fcn.1400a9fb0
mov qword [rsi + 0x40], 0
jmp 0x14005bdaa
xor edi, edi
jmp 0x14005be4d
call fcn.1400a1610
jmp 0x14005be16
mov rcx, rdi
call fcn.1400a1110
jmp 0x14005be22
Function at 0x14006b2c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x14006b290]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x1401cd5c8]
lea rdx, [0x14006b130]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14006b3d0
cmp dword [0x1401cd5d0], 0
jne 0x14006b3c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x1401cd5d4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x14006b36c
mov ecx, 1
mov edx, 0x28
call fcn.14009da90
test rax, rax
je 0x14006b3c0
mov r14, rax
mov ecx, dword [0x1401cd5d4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14006b3b8
lea r15, [0x1401cd5d8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x1401cd5e0]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d8a20
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, r14
call fcn.14009d9f0
mov rcx, rsi
mov rax, rdi
call qword [0x1401dd008]
xor esi, esi
jmp 0x14006b39c
call fcn.1400eceb0
int3

Function at 0x14006b820
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401c0738]
cmp ecx, 0xffffffff
je 0x14006b8fa
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14006b8fa
mov eax, dword [0x1401cee30]
mov ecx, dword [0x1401c1138]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006b904
mov rbx, qword [0x1401cee28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14006b94a
mov rax, qword [0x1401cd618]
inc rax
xor ecx, ecx
lea rdx, [0x1401cd620]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14006b957
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1401cee20]
inc ecx
mov dword [0x1401cee20], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1401cd618], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14006b96c
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14006b970
jmp 0x14006b84a
lea rcx, [0x1401cee30]
call fcn.1400d7650
cmp dword [0x1401cee30], 0xffffffff
jne 0x14006b86f
mov ecx, 8
call fcn.1400d74f8
mov rbx, rax
mov rcx, rax
call fcn.1400aa490
mov qword [0x1401cee28], rbx
lea rcx, [0x1401cee30]
call fcn.1400d76e8
jmp 0x14006b86f
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14006b887
inc rcx
cmp rcx, 0x100
jne 0x14006b89a
jmp 0x14006b8e0
int3
Function at 0x14006b970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1400d89c0
sub rsp, rax
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1401c0738]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14006ba24
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006ba87
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400dab60
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400d756c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400da4b0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400d8a20
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400808c0
test al, al
je 0x14006ba8a
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14006ba62
mov eax, 0xffffffff
lock cmpxchg dword [0x1401c0738], ecx
je 0x14006b9a8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401c0738]
mov dword [rsp + 0x2c], ecx
jmp 0x14006b9a8
lea rcx, [rsp + 0x2c]
call fcn.1400808c0
test al, al
je 0x14006ba8d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14006ba8d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14006ba3b
int3
int3
int3

Function at 0x14006baa0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401c0738]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x14006bae9
and rax, 0xfffffffffffffffc
je 0x14006bb1c
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x14006bb1c
mov rsi, qword [rax + rcx]
jmp 0x14006bb1e
lea rdx, [0x14019af0e]
lea r8, str....._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r9d, 0x1f6
call fcn.1400b75a0
movabs rdx, 0x141dd76000
mov rcx, rsi
call fcn.140138d10
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d8a20
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x14006bb40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401c0738]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006bb7e
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14006bb77
call fcn.14006b970
jmp 0x14006bb5e