joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d070
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x1401062a8]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004d0d3
mov rax, qword [0x1401062a0]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140069890
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401062a8]
call fcn.1400673a4
cmp dword [0x1401062a8], 0xffffffff
jne 0x14004d0ad
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14006bec0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140067308
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1401062e0]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004d18c
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r8d, edi
call fcn.140005e50
mov qword [0x1401062a0], rsi
lea rcx, [0x1401062a8]
call fcn.140067344
jmp 0x14004d0ad
lea rcx, [0x1401062e0]
call fcn.1400673a4
cmp dword [0x1401062e0], 0xffffffff
jne 0x14004d164
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x1401062d0], xmm2
movups xmmword [0x1401062c0], xmm1
movups xmmword [0x1401062b0], xmm0
lea rcx, [0x1401062e0]
call fcn.140067344
jmp 0x14004d164
Function at 0x140050600
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005063e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140050637
call fcn.140006a80
jmp 0x14005061e

Function at 0x140053330
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140053364
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140053364
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005335e
Function at 0x140055200
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140055251
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069890
mov rax, rsi
add rsp, 0x30
pop rsi
ret
int3
Function at 0x1400575c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401062e0]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005761c
movzx eax, word [0x1401062b0]
cmp ax, 9
jne 0x14005767e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140069890
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401062e0]
call fcn.1400673a4
cmp dword [0x1401062e0], 0xffffffff
jne 0x1400575f5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x1401062d0], xmm2
movups xmmword [0x1401062c0], xmm1
movups xmmword [0x1401062b0], xmm0
lea rcx, [0x1401062e0]
call fcn.140067344
jmp 0x1400575f5
cmp ax, 5
jg 0x14005769f
xor esi, esi
test ax, ax
je 0x140057607
cmp ax, 5
jne 0x1400576bf
mov esi, 3
jmp 0x140057607
cmp ax, 6
jne 0x1400576af
mov esi, 2
jmp 0x140057607
cmp ax, 0xc
jne 0x1400576bf
mov esi, 4
jmp 0x140057607
mov esi, 5
jmp 0x140057607
Function at 0x140063ca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x140063d2f
mov rax, r8
shr rax, 2
mov rdx, r9
not rdx
add rdx, r10
jne 0x140063cc7
xor edx, edx
jmp 0x140063d0c
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x1400f4340]
nop word [rax + rax]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x140063ce0
test r8b, 1
je 0x140063d29
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x1400f4340]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140063d29

Function at 0x140063f50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
mov rdi, qword [0x140109698]
cmp rdi, 1
jbe 0x140063fa0
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140063fe6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140109698]
call fcn.1400473a0
test al, al
je 0x140063ff2
mov qword [0x1401096a0], 0
lea rbx, [0x140109698]
lea rdi, [0x1401096a0]
mov rcx, rdi
xor edx, edx
call fcn.140036fb0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140047310
jmp 0x140063f6a
test rsi, rsi
je 0x140063f95
call fcn.140006a80
jmp 0x140063f7c
mov rdi, qword [0x140109698]
jmp 0x140063f6a

Function at 0x140064050
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x1401096c0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14006407d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140064073

Function at 0x140064090
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x14010acd0]
cmp rdi, 1
jbe 0x1400640df
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140064125
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14010acd0]
call fcn.1400473a0
test al, al
je 0x140064131
mov qword [0x14010acd8], 0
lea rbx, [0x14010acd0]
lea rdi, [0x14010acd8]
mov rcx, rdi
xor edx, edx
call fcn.140036fb0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140047310
jmp 0x1400640a9
test rsi, rsi
je 0x1400640d4
call fcn.140006a80
jmp 0x1400640bb
mov rdi, qword [0x14010acd0]
jmp 0x1400640a9
Function at 0x140064140
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14010acd0]
cmp rsi, 1
jbe 0x140064189
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140064182
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14010acd0]
call fcn.1400473a0
test al, al
je 0x1400641cf
mov qword [0x14010acd8], 0
lea rdi, [0x14010acd0]
lea rsi, [0x14010acd8]
mov rcx, rsi
xor edx, edx
call fcn.140036fb0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140047310
jmp 0x140064153
mov rsi, qword [0x14010acd0]
jmp 0x140064153
Function at 0x1400652c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14010b268]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140065325
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140065361
movsxd rcx, dword [0x14010b260]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14010b264]
movsxd rdx, dword [0x14010b260]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14010b268]
call fcn.1400673a4
cmp dword [0x14010b268], 0xffffffff
jne 0x1400652e9
mov qword [0x14010b260], 0
lea rcx, [0x14010b260]
xor edx, edx
call fcn.140036fb0
lea rcx, [0x14010b268]
call fcn.140067344
jmp 0x1400652e9
test rsi, rsi
je 0x14006531f
call fcn.140006a80
jmp 0x1400652fb

Function at 0x140065390
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x14010b23c], eax
mov dword [rcx + 4], eax
mov eax, dword [0x14010b238]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140065479
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400654ff
movsxd rcx, dword [0x14010b230]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14010b234]
movsxd rdx, dword [0x14010b230]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14010b248]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400654bc
lea rdi, [rsi + 4]
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140065512
movsxd rcx, dword [0x14010b240]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x14010b244]
movsxd rdx, dword [0x14010b240]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14010b238]
call fcn.1400673a4
cmp dword [0x14010b238], 0xffffffff
jne 0x1400653d2
mov qword [0x14010b230], 0
lea rcx, [0x14010b230]
xor edx, edx
call fcn.140036fb0
lea rcx, [0x14010b238]
call fcn.140067344
jmp 0x1400653d2
lea rcx, [0x14010b248]
call fcn.1400673a4
cmp dword [0x14010b248], 0xffffffff
jne 0x140065431
mov qword [0x14010b240], 0
lea rcx, [0x14010b240]
xor edx, edx
call fcn.140036fb0
lea rcx, [0x14010b248]
call fcn.140067344
jmp 0x140065431
test rsi, rsi
je 0x14006540c
call fcn.140006a80
jmp 0x1400653e8
test rdi, rdi
je 0x14006546f
call fcn.140006a80
jmp 0x14006544b
Function at 0x140065530
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x14010b250]
cmp rbx, 1
jbe 0x140065584
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400655ca
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14010b250]
call fcn.1400473a0
test al, al
je 0x1400655d6
mov qword [0x14010b258], 0
lea r14, [0x14010b250]
lea rbx, [0x14010b258]
mov rcx, rbx
xor edx, edx
call fcn.140036fb0
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.140047310
jmp 0x14006554c
test rdi, rdi
je 0x140065577
call fcn.140006a80
jmp 0x14006555e
mov rbx, qword [0x14010b250]
jmp 0x14006554c

Function at 0x1400655f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14010b250]
cmp rsi, 1
jbe 0x140065639
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140065632
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14010b250]
call fcn.1400473a0
test al, al
je 0x14006567f
mov qword [0x14010b258], 0
lea rdi, [0x14010b250]
lea rsi, [0x14010b258]
mov rcx, rsi
xor edx, edx
call fcn.140036fb0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140047310
jmp 0x140065603
mov rsi, qword [0x14010b250]
jmp 0x140065603

Function at 0x1400656f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14010b238]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400657b7
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140065753
movsxd rcx, dword [0x14010b230]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14010b234]
movsxd rdx, dword [0x14010b230]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14010b248]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400657fa
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400657b2
movsxd rcx, dword [0x14010b240]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14010b244]
movsxd rdx, dword [0x14010b240]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
ret
lea rcx, [0x14010b238]
call fcn.1400673a4
cmp dword [0x14010b238], 0xffffffff
jne 0x140065719
mov qword [0x14010b230], 0
lea rcx, [0x14010b230]
xor edx, edx
call fcn.140036fb0
lea rcx, [0x14010b238]
call fcn.140067344
jmp 0x140065719
lea rcx, [0x14010b248]
call fcn.1400673a4
cmp dword [0x14010b248], 0xffffffff
jne 0x140065778
mov qword [0x14010b240], 0
lea rcx, [0x14010b240]
xor edx, edx
call fcn.140036fb0
lea rcx, [0x14010b248]
call fcn.140067344
jmp 0x140065778
Function at 0x14007474c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140074870
Function at 0x140091ff0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, dword [0x1401096c0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test edi, edi
jne 0x140092027
cmp rsi, 2
jb 0x140092031
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140037b70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140092013
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140092980
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140109628]
cmp rdi, 1
jbe 0x1400929e5
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400929c6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
lea rcx, [rsi + 8]
call fcn.140036d90
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400929dd
lock dec dword [rcx + 8]
je 0x140092a3a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140109628]
call fcn.1400473a0
test al, al
je 0x140092a2e
mov qword [0x140109630], 0
lea rbx, [0x140109628]
lea rdi, [0x140109630]
mov rcx, rdi
xor edx, edx
call fcn.140036fb0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140047310
jmp 0x140092997
mov rdi, qword [0x140109628]
jmp 0x140092997
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140036e60

Function at 0x140092a60
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140092a75
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x140095460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1400e9af0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x281
call fcn.14003f330
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14003e410
cmp byte [rdi + 0x17], 0
jns 0x1400954e4
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.14003e090
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140069890
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x140096c20
Capabilities:
Create thread

Disassembly:
jmp 0x140096c20
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.140067308
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x140091270]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140096cc1
test rbp, rbp
je 0x140096cf1
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069890
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x140096cda
mov ebp, eax
cmp eax, 0x5af
je 0x140096cda
cmp ebp, 0xe
jne 0x140096cfc
mov rcx, r15
call fcn.1400c3c80
test r14, r14
je 0x140096c9f
mov rcx, r14
call fcn.1400672f8
jmp 0x140096c9f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140096c9f
mov eax, dword [0x140106298]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140096d6b
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.1400c3c90
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x140106290]
call fcn.140036350
cmp byte [rsi + 0x17], 0
jns 0x140096ce2
mov rcx, qword [rsp + 0x38]
call fcn.1400672f8
jmp 0x140096ce2
lea rcx, [0x140106298]
call fcn.1400673a4
cmp dword [0x140106298], 0xffffffff
jne 0x140096d1d
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140092040
mov qword [0x140106290], rax
lea rcx, [0x140106298]
call fcn.140067344
jmp 0x140096d1d
Function at 0x140099ac0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140099bf0
cmp qword [rsi], 0
jne 0x140099bf0
cmp dword [rsi + 0x14], 0
jne 0x140099bf0
cmp qword [rsi + 8], 0
jne 0x140099bf0
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x140099b31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140099b82
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140099b29
mov qword [rsi], rbx
call fcn.140036360
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x140099b6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140099baa
lea rax, [rbp + 1]
cmp rax, 2
jb 0x140099b63
mov qword [rsi + 8], rbp
call fcn.140036360
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140036360
mov r14, qword [rsi]
mov rcx, qword [0x1401096a8]
test rcx, rcx
je 0x140099bd4
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140099b17
call fcn.140036360
mov r14, qword [rsi + 8]
mov rcx, qword [0x1401096a8]
test rcx, rcx
je 0x140099be2
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi + 8], 0
jmp 0x140099b50
call fcn.14009d7f0
mov rcx, qword [0x1401096a8]
jmp 0x140099b96
call fcn.14009d7f0
mov rcx, qword [0x1401096a8]
jmp 0x140099bbf
mov rcx, rsi
call fcn.140099a20
mov rax, qword [rsi]
jmp 0x140099afb

Function at 0x14009ab90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14010ad60]
cmp rdi, 1
jbe 0x14009abb9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140050600
lea rcx, [0x14010ad60]
call fcn.1400473a0
test al, al
je 0x14009abff
mov qword [0x14010ad68], 0
lea rbx, [0x14010ad60]
lea rdi, [0x14010ad68]
mov rcx, rdi
xor edx, edx
call fcn.140036fb0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140047310
jmp 0x14009aba7
mov rdi, qword [0x14010ad60]
jmp 0x14009aba7

Function at 0x14009ade0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401095a0]
cmp rdi, 1
jbe 0x14009ae2a
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14009ae70
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401095a0]
call fcn.1400473a0
test al, al
je 0x14009ae7c
mov qword [0x1401095a8], 0
lea rbx, [0x1401095a0]
lea rdi, [0x1401095a8]
mov rcx, rdi
xor edx, edx
call fcn.140036fb0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140047310
jmp 0x14009adf7
test rsi, rsi
je 0x14009ae22
call fcn.140006a80
jmp 0x14009ae09
mov rdi, qword [0x1401095a0]
jmp 0x14009adf7