joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bfc50
Capabilities:
Create thread

Disassembly:
jmp 0x1400bfc50
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.14008d2b8
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x1400b9640]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400bfcf1
test rbp, rbp
je 0x1400bfd21
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400bfd0a
mov ebp, eax
cmp eax, 0x5af
je 0x1400bfd0a
cmp ebp, 0xe
jne 0x1400bfd2c
mov rcx, r15
call fcn.14010d8c0
test r14, r14
je 0x1400bfccf
mov rcx, r14
call fcn.14008d2a8
jmp 0x1400bfccf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400bfccf
mov eax, dword [0x1401845c8]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400bfd9b
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.140111920
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x1401845c0]
call fcn.140041550
cmp byte [rsi + 0x17], 0
jns 0x1400bfd12
mov rcx, qword [rsp + 0x38]
call fcn.14008d2a8
jmp 0x1400bfd12
lea rcx, [0x1401845c8]
call fcn.14008d354
cmp dword [0x1401845c8], 0xffffffff
jne 0x1400bfd4d
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400ba410
mov qword [0x1401845c0], rax
lea rcx, [0x1401845c8]
call fcn.14008d2f4
jmp 0x1400bfd4d
Function at 0x1400c1e70
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x1400c1fa0
cmp qword [rsi], 0
jne 0x1400c1fa0
cmp dword [rsi + 0x14], 0
jne 0x1400c1fa0
cmp qword [rsi + 8], 0
jne 0x1400c1fa0
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x1400c1ee1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400c1f32
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400c1ed9
mov qword [rsi], rbx
call fcn.140041560
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x1400c1f1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400c1f5a
lea rax, [rbp + 1]
cmp rax, 2
jb 0x1400c1f13
mov qword [rsi + 8], rbp
call fcn.140041560
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140041560
mov r14, qword [rsi]
mov rcx, qword [0x140184a28]
test rcx, rcx
je 0x1400c1f84
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400c1ec7
call fcn.140041560
mov r14, qword [rsi + 8]
mov rcx, qword [0x140184a28]
test rcx, rcx
je 0x1400c1f92
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi + 8], 0
jmp 0x1400c1f00
call fcn.1400c7320
mov rcx, qword [0x140184a28]
jmp 0x1400c1f46
call fcn.1400c7320
mov rcx, qword [0x140184a28]
jmp 0x1400c1f6f
mov rcx, rsi
call fcn.1400c1dd0
mov rax, qword [rsi]
jmp 0x1400c1eab
Function at 0x1400c2350
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov r13d, r8d
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea rsi, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, rsi
mov dl, 0xaa
call fcn.1400924f0
mov qword [rsp + 0x20], r14
xor ebp, ebp
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.1400c25c0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x14015c320]
movaps xmmword [rbx], xmm0
mov rcx, rsi
mov rdx, rbx
call fcn.1400069f0
movzx eax, byte [rbx + 0x17]
test al, al
jns 0x1400c23e6
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400c24aa
xor r12d, r12d
lea rdi, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov rsi, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 0x250
mov rcx, rdi
mov dl, 0xaa
call fcn.1400924f0
mov rcx, r15
mov rdx, rdi
call fcn.1400c25d0
mov edx, dword [rsp + 0x48]
test dl, 1
jne 0x1400c2527
mov rcx, rdi
call fcn.1400c25b0
test al, al
jne 0x1400c24e7
test r13b, 2
jne 0x1400c2554
cmp byte [rsp + 0x47], 0
mov rcx, rbx
jns 0x1400c2457
mov rcx, qword [rsp + 0x30]
call rsi
xor ebp, ebp
test eax, eax
je 0x1400c2568
test r12d, r12d
cmovne ebp, r12d
mov rcx, rdi
call fcn.1400c3680
mov rcx, r15
mov rdx, rdi
call fcn.1400069f0
mov rcx, rbx
mov rdx, rdi
call fcn.140070380
mov rcx, rdi
call fcn.14005b0c0
movzx eax, byte [rsp + 0x47]
test al, al
jns 0x1400c249e
mov rax, qword [rsp + 0x38]
mov r12d, ebp
test rax, rax
jne 0x1400c2406
lea rcx, [rsp + 0x30]
call fcn.14005b0c0
lea rcx, [rsp + 0x298]
call fcn.14005af50
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
test r13b, 1
je 0x1400c2463
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8d, r13d
call fcn.1400c2350
test eax, eax
jne 0x1400c25a5
cmp byte [rsp + 0x47], 0
lea rcx, [rsp + 0x30]
jns 0x1400c251c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400c245b
test r13b, 1
jne 0x1400c2584
lea rcx, [rsp + 0x48]
call fcn.1400c25b0
test al, al
je 0x1400c2580
lea rcx, [rsp + 0x48]
call fcn.1400c25b0
test al, al
je 0x1400c243e
xor ebp, ebp
jmp 0x1400c2463
lea rcx, [rsp + 0x30]
call fcn.14010d120
xor ebp, ebp
test al, al
jne 0x1400c2463
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x1400c2463
mov edx, dword [rsp + 0x48]
and edx, 0xfffffffe
cmp byte [rsp + 0x47], 0
jns 0x1400c2595
mov rcx, qword [rsp + 0x30]
jmp 0x1400c259a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400c242e
mov ebp, eax
jmp 0x1400c2463
Function at 0x1400c3350
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140189d98]
cmp rdi, 1
jbe 0x1400c3379
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14005cfc0
lea rcx, [0x140189d98]
call fcn.140055e00
test al, al
je 0x1400c33bf
mov qword [0x140189da0], 0
lea rbx, [0x140189d98]
lea rdi, [0x140189da0]
mov rcx, rdi
xor edx, edx
call fcn.1400421b0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140055de0
jmp 0x1400c3367
mov rdi, qword [0x140189d98]
jmp 0x1400c3367

Function at 0x1400c35a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401881f0]
cmp rdi, 1
jbe 0x1400c35ea
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c3630
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401881f0]
call fcn.140055e00
test al, al
je 0x1400c363c
mov qword [0x1401881f8], 0
lea rbx, [0x1401881f0]
lea rdi, [0x1401881f8]
mov rcx, rdi
xor edx, edx
call fcn.1400421b0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140055de0
jmp 0x1400c35b7
test rsi, rsi
je 0x1400c35e2
call fcn.1400074b0
jmp 0x1400c35c9
mov rdi, qword [0x1401881f0]
jmp 0x1400c35b7

Function at 0x1400c3ab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov ebx, ecx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x14014bd30]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x14018a268]
lea rdx, [0x14014bd20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400c3ba9
cmp dword [0x14018a270], 0
jne 0x1400c3bb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x14018a274]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
jne 0x1400c3b5f
mov ecx, 0x20
call fcn.14006b210
test rax, rax
je 0x1400c3bb6
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov ecx, dword [0x14018a274]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400c3bae
lea rbp, [0x14018a278]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x14018a280]
mov qword [rax + rbx*8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsi + rbx*8], r14
mov esi, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.14008d5e0
mov rcx, rsi
call fcn.14006f460
mov rcx, r14
call rdi
xor esi, esi
jmp 0x1400c3b8f
Function at 0x1400c48a0
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x14015c320]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x14015fbb2]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x472
call fcn.140048d60
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140048d80
cmp byte [rdi + 0x17], 0
jns 0x1400c4924
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rsi
call fcn.140046cc0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400c4960
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2d8
mov r14, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x270]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x14015c320]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x14015fb9d]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov r9d, 0x462
call fcn.140048d60
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140048d80
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400924f0
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x1400c4a63
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.14008d7c8
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14005f360
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.140069180
mov rcx, r14
mov rdx, rsi
call fcn.140070380
mov rcx, rsi
call fcn.14005b0c0
mov rcx, rbx
call fcn.14005b0c0
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x270]
call fcn.140046cc0
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebx
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400c59e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14008fe50
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r15, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r15
mov dl, 0xaa
call fcn.1400924f0
lea r12, [rsp + 0x3c]
mov dword [r12], 1
lea rsi, [rsp + 0x38]
mov dword [rsi], 0x800
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.140048d60
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdx, rdi
xor r8d, r8d
mov r9, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c5abd
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x1400c5ac1
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.14005f658
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14008fec0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x1400c5a9a
cmp eax, 2
jne 0x1400c5b06
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1400924f0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x1400c5b0d
lea rdx, [rsp + 0x40]
jmp 0x1400c5a90
mov edi, 0x3f4
jmp 0x1400c5a9a
mov edi, 0xea
jmp 0x1400c5a9a

Function at 0x1400c5cc6
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400c5d9d
mov rax, qword [rsi + 0x28]
cmp rax, 0x60
mov edi, 0x60
cmova rdi, rax
mov rcx, rdi
call qword [rsi + 0x48]
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], 0x18
mov qword [rax + 0x10], rdi
lock add qword [rsi + 0x10], rdi
lea rcx, [rax + 0x18]
mov qword [rax + 8], 0x60
mov qword [rax + 0x18], rsi
mov edi, dword [0x140181920]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdi*8]
lea rax, [rax + 0x120]
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rdx
lea rax, [rdx + 0x60]
mov qword [rdx + 0x40], rax
mov rax, qword [rdx + 0x10]
add rax, rdx
mov qword [rdx + 0x48], rax
mov qword [rdx + 0x30], r8
xorps xmm0, xmm0
movups xmmword [rdx + 0x50], xmm0
mov rax, qword [rsi]
mov qword [rdx + 0x38], rax
lock cmpxchg qword [rsi], rcx
jne 0x1400c5d5f
mov eax, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov qword [rax + 0x128], rcx
mov rdx, qword [rsi + 0x20]
mov qword [rax + 0x120], rdx
mov qword [rsi + 8], rcx
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
lea rax, [rax + 0x120]
cmp qword [rcx + 8], rax
je 0x1400c5d6a
mov rcx, qword [rcx + 0x20]
jmp 0x1400c5cd2
Function at 0x1400c5fd0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x1400c600a
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r15
jbe 0x1400c6066
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400c6055
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.140091e40
mov r14, qword [rsi + 8]
add rbx, r15
mov qword [rsi + 0x10], rbx
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1400c5fef
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x1400c60fc
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.14008d2b8
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, r14
je 0x1400c60d0
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea r11, [rax + r12*8]
xor edx, edx
mov rcx, qword [r14 + rdx]
mov qword [r11 + rdx], rcx
add rdx, 8
cmp rbx, rdx
jne 0x1400c60bf
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbx, r10
test r15, r15
je 0x1400c5fef
mov rcx, r15
call fcn.14008d2a8
mov rbx, qword [rsi + 0x10]
jmp 0x1400c5fef
call fcn.14008d5e0
int3

Function at 0x1400c7090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x14015c320]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2a9
call fcn.140048d60
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140048d80
cmp byte [rdi + 0x17], 0
jns 0x1400c7114
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.140046cc0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14008fec0
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400cb040
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400924f0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x1400cb0df
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.14008d7c8
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14005f360
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.140069180
mov rcx, r14
mov rdx, rsi
call fcn.140070380
mov rcx, rsi
call fcn.14005b0c0
mov rcx, rbx
call fcn.14005b0c0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400cb860
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x14015af80]
mov qword [rcx], rax
lea rdi, [rcx + 8]
lea rax, [0x14015b6e0]
mov qword [rcx + 8], rax
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140043210
mov rcx, rbx
mov rdx, rsi
call fcn.1400cb9c0
call fcn.140042fe0
mov rcx, rax
mov rdx, rdi
call fcn.140069a00
mov rdi, qword [rsi + 0x10]
add rdi, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400cb969
mov rax, qword [rsi + 0x18]
test rax, rax
jne 0x1400cb976
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x20]
mov dword [rdx], eax
mov ecx, 0x308
add rcx, qword [rsi + 0x10]
call fcn.1400cb9d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [rsi + 0x10]
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400cb942
movsxd rcx, dword [rdi + 0x2f0]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 0x2f4]
movsxd rdx, dword [rdi + 0x2f0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
test rdi, rdi
jne 0x1400cb9ad
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008fec0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.140041630
jmp 0x1400cb8d3
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + 0x360]
cmp dword [rsi + 0x28], edx
jne 0x1400cb8e0
mov rcx, qword [rcx + 0x20]
mov qword [rsi + 0x18], 0
lea r8, [rsp + 0x20]
mov qword [r8], rax
mov rdx, qword [rsi + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400cb8e0
mov rcx, rdi
call fcn.1400ba420
mov rcx, rdi
call fcn.14008d2a8
jmp 0x1400cb953
Function at 0x1400cd7e9
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400924f0
xor ebx, ebx
lea r14, str.PROGRAMFILES
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r14]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call r15
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400cd864
mov edx, eax
mov rcx, rdi
mov r8, rsi
call fcn.1400cd896
test al, al
jne 0x1400cd891
add rbx, 8
cmp rbx, 0x18
jne 0x1400cd831
xor esi, esi
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov sil, 1
jmp 0x1400cd870

Function at 0x1400cdada
Capabilities:
Get common file path
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x250], rax
movabs rbx, 0x7fffffffffffffef
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400924f0
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [0x14015c320]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rsi
call fcn.14008d7c8
cmp rax, rbx
ja 0x1400cdc0d
mov rsi, rax
cmp rax, 0xb
jae 0x1400cdb6f
lea rdi, [rsp + 0x20]
mov byte [rdi + 0x17], sil
test rsi, rsi
jne 0x1400cdb99
jmp 0x1400cdbac
lea r14, [rsi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
call fcn.14008d2b8
mov rdi, rax
mov qword [rsp + 0x20], rax
add rbx, 0x11
or rbx, r14
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140091e40
mov word [rdi + rsi*2], 0
lea rdx, str.usp10.dll
lea rcx, [rsp + 0x20]
call fcn.140058ef4
cmp byte [rax + 0x17], 0
jns 0x1400cdbcc
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [rsp + 0x37], 0
jns 0x1400cdbe8
mov rcx, qword [rsp + 0x20]
call fcn.14008d2a8
cmp esi, 0xffffffff
setne bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebx
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x20]
call fcn.1400bd3f0
int3