joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9df0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx], 0
jne 0x1400c9f0a
mov rax, qword [rsi + 0x10]
test rax, rax
jne 0x1400c9f02
test byte [0x140329260], 0x19
je 0x1400c9ec7
mov rax, qword [0x14032a8e8]
lea rcx, [0x140038c30]
cmp rax, rcx
jne 0x1400c9fd1
lea rdi, [rsp + 0x58]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x1400c9fe1
imul rax, rax, 0xf4240
cqo
idiv qword [0x14033afc8]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x140329260]
lea r8, str.ScopedMayLoadLibraryAtBackgroundPriority
mov cl, 0x45
xor r9d, r9d
call fcn.140189ab0
mov rcx, qword [rsi + 0x10]
movabs rax, 0xfffffffc00000000
and rax, rcx
cmp rax, qword [0x140336a08]
je 0x1400c9fc7
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14013d520
nop
add rsp, 0x68
pop rdi
pop rsi
ret
mov byte [rax], 1
jmp 0x1400c9e1e
test byte [0x140329260], 0x19
jne 0x1400c9f20
mov ecx, dword [rsi + 4]
call fcn.1400ead10
jmp 0x1400c9e11
mov rax, qword [0x14032a8e8]
lea rcx, [0x140038c30]
cmp rax, rcx
jne 0x1400ca008
lea rdi, [rsp + 0x58]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x1400ca018
imul rax, rax, 0xf4240
cqo
idiv qword [0x14033afc8]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x140329260]
lea r8, str.ScopedMayLoadLibraryAtBackgroundPriority_:_Priority_Increased
mov cl, 0x45
xor r9d, r9d
call fcn.140189ab0
cmp byte [rsi], 0
jne 0x1400c9f13
jmp 0x1400ca03f
call fcn.14010edf0
jmp 0x1400c9ee5
lea rcx, [rsp + 0x58]
call qword [case.0x14017aab5.0]
jmp 0x1400c9e82
mov rcx, qword [0x14033afc8]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x1400c9e7d
lea rcx, [rsp + 0x58]
call qword [case.0x14017aab5.0]
jmp 0x1400c9f77
mov rcx, qword [0x14033afc8]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x1400c9f72
call fcn.1401a3145
int3
Function at 0x1400cb330
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rcx], 0xffffffffffffffff
mov dword [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
mov byte [rcx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x1400cb594
lea rbx, [rsi + 0x18]
mov rax, qword [rbx]
inc rax
cmp rax, 1
ja 0x1400cb470
cmp byte [rsi + 0x20], 0
jne 0x1400cb470
lea r15, [rsi + 0x10]
mov rax, 0xffffffffffffffff
mov qword [rsi], rax
mov rcx, qword [rdi]
mov qword [rsi], rcx
mov qword [rdi], rax
mov eax, dword [rdi + 8]
mov dword [rsi + 8], eax
mov dword [rdi + 8], 0
mov r12, qword [rdi + 0x10]
mov qword [rdi + 0x10], 0
lea r13, [r12 + 1]
cmp r13, 2
jb 0x1400cb3db
call fcn.1400a6030
cmp qword [r15], r12
je 0x1400cb40e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r15]
inc rax
cmp rax, 2
jae 0x1400cb4ac
cmp r13, 2
jb 0x1400cb406
mov qword [r15], r12
call fcn.1400a6030
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x18]
mov qword [rdi + 0x18], 0
lea r12, [r15 + 1]
cmp r12, 2
jae 0x1400cb469
cmp qword [rbx], r15
jne 0x1400cb50c
mov al, byte [rdi + 0x20]
mov byte [rsi + 0x20], al
mov byte [rdi + 0x20], 0
mov rax, qword [rdi + 0x18]
inc rax
cmp rax, 2
jae 0x1400cb4db
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14013d520
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400a6030
jmp 0x1400cb424
mov r14, qword [rsi]
lea r15, [rsp + 0x38]
mov qword [r15], r14
mov rcx, rbx
call fcn.1400c2280
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 1
mov rcx, rax
mov rdx, r14
xor r8d, r8d
mov r9, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x1400cb39b
call fcn.1400a6030
mov r14, qword [r15]
mov rcx, qword [0x14033c3e8]
test rcx, rcx
je 0x1400cb53b
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x14017aab5.0]
mov qword [r15], 0
jmp 0x1400cb3f8
call fcn.1400a6030
mov rbx, qword [rdi + 0x18]
mov rcx, qword [0x14033c3e8]
test rcx, rcx
je 0x1400cb54c
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x14017aab5.0]
mov qword [rdi + 0x18], 0
jmp 0x1400cb448
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jae 0x1400cb55a
cmp r12, 2
jb 0x1400cb52e
mov qword [rbx], r15
call fcn.1400a6030
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400cb42d
call fcn.1400515d0
mov rcx, qword [0x14033c3e8]
jmp 0x1400cb4c0
call fcn.1400515d0
mov rcx, qword [0x14033c3e8]
jmp 0x1400cb4f0
call fcn.1400a6030
mov r14, qword [rbx]
mov rcx, qword [0x14033c3e8]
test rcx, rcx
je 0x1400cb586
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x14017aab5.0]
mov qword [rbx], 0
jmp 0x1400cb520
call fcn.1400515d0
mov rcx, qword [0x14033c3e8]
jmp 0x1400cb56e
int3
Function at 0x1400cccf0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400ccd1a
call fcn.1400a6030
cmp qword [rsi], r14
je 0x1400ccd5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400ccd47
call fcn.1400a6030
mov rcx, qword [rsi]
call fcn.1400ccd80
mov qword [rsi], 0
cmp r15, 2
jb 0x1400ccd55
mov qword [rsi], r14
call fcn.1400a6030
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400cf410
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140337724]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400cf44e
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400cf447
call fcn.14006b200
jmp 0x1400cf42e
Function at 0x1400d4fb8
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov dword [rcx], eax
mov qword [rcx + 8], rax
mov ecx, dword [rdx]
mov dword [rsi], ecx
mov dword [rdx], eax
mov r14, qword [rdx + 8]
mov qword [rdx + 8], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400d4fee
call fcn.1400a6030
cmp qword [rsi + 8], r14
je 0x1400d5020
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400d5054
cmp r15, 2
jb 0x1400d5018
mov qword [rsi + 8], r14
call fcn.1400a6030
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x1400d503c
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400a6030
mov rcx, qword [rdi + 8]
call fcn.1400ccd80
mov qword [rdi + 8], 0
jmp 0x1400d502d
call fcn.1400a6030
mov rcx, qword [rsi + 8]
call fcn.1400ccd80
mov qword [rsi + 8], 0
jmp 0x1400d5009
Function at 0x1400d5f20
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x48]
movups xmmword [rdi + 0x34], xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x18], xmm0
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi - 8], xmm0
movaps xmm0, xmmword [0x1402fbed0]
movups xmmword [rdi - 0x28], xmm0
movaps xmm0, xmmword [0x1402fbee0]
movups xmmword [rdi - 0x18], xmm0
mov dword [rdi + 0x44], 0x20
test rdx, rdx
je 0x1400d5fbc
mov r14, rdx
mov rbx, rcx
lea eax, [rdx*8]
mov rcx, rdx
shr rcx, 0x1d
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x40], eax
mov r8, rdx
cmp rdx, 0x40
jae 0x1400d60a8
mov dword [rsp + 0x88], r14d
mov rcx, rdi
mov rdx, rbx
call fcn.14013efb0
mov eax, dword [rsp + 0x88]
lea rcx, [rax + 1]
mov ebx, dword [rsp + 0x8c]
mov ebp, dword [rsp + 0x40]
mov r14d, dword [rsp + 0x44]
mov byte [rsp + rax + 0x48], 0x80
cmp rax, 0x38
jae 0x1400d60d5
cmp rcx, 0x38
je 0x1400d5fff
mov r8d, 0x38
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.14013f660
bswap r14d
lea rcx, [rsp + 0x20]
mov dword [rcx + 0x60], r14d
bswap ebp
mov dword [rcx + 0x64], ebp
mov r8d, 1
mov rdx, rdi
call fcn.140012800
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
lea eax, [rbx - 0x21]
cmp eax, 0xffffffe3
jb 0x1400d6061
shr rbx, 2
xor eax, eax
nop word cs:[rax + rax]
mov ecx, dword [rsp + rax*4 + 0x20]
bswap ecx
mov dword [rsi + rax*4], ecx
inc rax
cmp rbx, rax
jne 0x1400d6050
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14013d520
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
shr r8, 6
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140012800
mov r8, r14
and r8, 0x3f
je 0x1400d5fbc
and r14, 0xffffffffffffffc0
add rbx, r14
mov r14d, r8d
jmp 0x1400d5fa9
cmp eax, 0x3f
je 0x1400d60ed
mov r8d, 0x3f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.14013f660
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.140012800
xor ecx, ecx
jmp 0x1400d5fec
Function at 0x1400dd3f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov rdx, qword [rcx]
mov r9, qword [rcx + 8]
mov r8, r9
sub r8, rdx
je 0x1400dd487
mov rax, r8
shr rax, 2
mov r10, rdx
not r10
add r10, r9
je 0x1400dd45e
mov r10, r8
and r10, 0xfffffffffffffffe
xor r9d, r9d
lea r11, [0x1402fc7e0]
nop dword [rax + rax]
movzx esi, al
movzx edi, byte [rdx + r9]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [rdx + r9 + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add r9, 2
cmp r10, r9
jne 0x1400dd430
jmp 0x1400dd461
xor r9d, r9d
test r8b, 1
je 0x1400dd481
movzx r8d, al
movzx edx, byte [rdx + r9]
xor edx, r8d
lea r8, [0x1402fc7e0]
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1400dd481
Function at 0x1400e1b90
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1400e1bcf
test r15, r15
je 0x1400e1cbd
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1400e1c19
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.14013efb0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x1400e1bad
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1400e1cc3
lea rcx, [r12*8]
call fcn.14013a6b4
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x1400e1c8d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x1400e1cc0
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x1400e1c75
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x1400e1bad
mov rcx, r14
call fcn.14013a6ac
mov r15, qword [rsi + 0x10]
jmp 0x1400e1bad
int3
int3
int3
Function at 0x1400e3600
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x450]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x1402f1156]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x240]
mov rcx, r15
mov r9d, 0x26b
call fcn.1400b5b90
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140062770
lea r14, [rsp + 0x240]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14013f660
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400e36b0
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.1400e37c0
mov rcx, r14
call fcn.1400b5b70
lea r14, [rsp + 0x30]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14013f660
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x1400e36e7
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.1400e37c0
mov rcx, r14
call fcn.1400b5b70
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400e3709
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x1400e3715
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400e376e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e3810
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x1400e3748
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400e3751
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x1400e3771
test eax, eax
jne 0x1400e3771
jmp 0x1400e37a0
mov dil, 1
lea rcx, [rsp + 0x450]
call fcn.140062a80
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.14013d520
mov eax, edi
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp ebp, 0xfffffffc
jne 0x1400e37ac
call fcn.1401f7f70
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x1400e3771
Function at 0x1400e54b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
je 0x1400e5599
mov rcx, qword [r9 + 0x30]
lock inc dword [rcx + 8]
lea rax, [0x140339d90]
mov qword [rbp - 0x20], rax
lea rax, [0x1401eb220]
mov qword [rbp - 0x18], rax
mov rax, qword [0x140339d90]
cmp rax, 0xffffffffffffffff
jne 0x1400e564e
movsxd rax, dword [0x140339d98]
lea rdx, [rax - 1]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
sub r8, r9
sar r8, 3
cmp r8, rdx
jbe 0x1400e5680
mov r14, qword [r9 + rax*8 - 8]
test r14, r14
je 0x1400e5680
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
je 0x1400e563c
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [case.0x14017aab5.0]
mov al, byte [rbx + 0x17]
test al, al
mov rcx, qword [rbx]
mov r14, rbx
cmovs r14, rcx
jmp 0x1400e55e4
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [case.0x14017aab5.0]
jmp 0x1400e55fd
test rdi, rdi
je 0x1400e5625
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400e560d
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
inc r14
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
test al, al
cmovs rdx, rcx
js 0x1400e5629
movzx eax, al
add rdx, rax
cmp r14, rdx
jne 0x1400e55be
mov qword [rsi], rdi
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [case.0x14017aab5.0]
cmp eax, 0xffffffff
jne 0x1400e55da
xor edi, edi
jmp 0x1400e55da
add rdx, qword [rbp - 0x18]
cmp r14, rdx
jne 0x1400e55be
mov qword [rsi], rdi
call fcn.14013a6ac
jmp 0x1400e55fd
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14017aab5.0]
jmp 0x1400e5550
mov qword [rbp - 8], rcx
lea rax, [rbp - 0x20]
lea rcx, [rbp - 0x30]
mov qword [rcx], rax
lea rdx, [rbp - 0x28]
mov qword [rdx], rcx
lea rcx, [0x140339d90]
lea r8, [0x14003e830]
call fcn.1400b66f1
mov rcx, qword [rbp - 8]
jmp 0x1400e550d
mov qword [rbp - 8], rcx
call fcn.1401a18d2
jmp 0x1400e568b
int3
Function at 0x1400e8580
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.14013f660
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x1400e8635
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14013ad74
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400afe70
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400e8670
cmp byte [rsi + 0x17], 0
js 0x1400e865d
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x1400e8635
mov rcx, qword [rsp + 0x30]
call fcn.14013a6ac
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14013d520
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.14013a6ac
jmp 0x1400e8607

Function at 0x1400e9340
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, dword [0x140344408]
mov ecx, dword [0x140337e40]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e93d4
lea rcx, [0x1403443f8]
call fcn.1400c7ea0
test rax, rax
jne 0x1400e93b3
mov ecx, 4
call fcn.14013a6b4
mov dword [rax], 0
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.140066ed0
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400e9417
lea rsi, [0x1403443f8]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14013d520
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp fcn.1400c7ea0
lea rcx, [0x140344408]
call fcn.14013b388
cmp dword [0x140344408], 0xffffffff
jne 0x1400e9375
xorps xmm0, xmm0
movups xmmword [0x1403443f8], xmm0
lea rcx, [0x1403443f8]
lea rdx, [0x14007ef70]
call fcn.1400e9420
lea rcx, [0x140344408]
call fcn.14013a7d4
jmp 0x1400e9375
call fcn.14013a6ac
jmp 0x1400e93b3
Function at 0x1400ec790
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1400ec7cf
test r15, r15
je 0x1400ec8bd
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1400ec819
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.14013efb0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x1400ec7ad
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1400ec8e9
lea rcx, [r12*8]
call fcn.14013a6b4
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x1400ec88d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x1400ec8bd
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x1400ec875
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x1400ec7ad
mov rcx, r14
call fcn.14013a6ac
mov r15, qword [rsi + 0x10]
jmp 0x1400ec7ad
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140181600
call fcn.140181600
int3