joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e2f80
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x1400e30c3
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x1400e30bc
cmp r14, rax
ja 0x1400e30c8
lea rcx, [r14*8]
call fcn.14014c3b0
shl rbx, 3
add rbx, rax
je 0x1400e30cd
mov rcx, qword [rdi]
mov qword [rbx], rcx
test rcx, rcx
je 0x1400e3019
lock inc dword [rcx + 8]
lea rax, [rax + r14*8]
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x1400e30a5
mov r8, qword [rdx - 8]
mov qword [rbx - 8], r8
mov qword [rdx - 8], 0
lea r8, [rdx - 8]
add rbx, 0xfffffffffffffff8
mov rdx, r8
cmp r8, rdi
jne 0x1400e302d
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x1400e308f
add r14, 0xfffffffffffffff8
test r14, r14
je 0x1400e30f9
mov rcx, qword [r14]
test rcx, rcx
je 0x1400e3083
lock dec dword [rcx + 8]
je 0x1400e3125
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x1400e3068
test rdi, rdi
je 0x1400e30b2
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014c3ec
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
jmp 0x1400e308f
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x1400e2ffd
call fcn.1401663e0
call fcn.140189a80
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.14018a2b0
mov edx, 1
call fcn.1400e9020
jmp 0x1400e3083
Function at 0x1400e49b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1400e4980]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14024b3d0]
lea rdx, [0x1400e4800]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400e4ab9
cmp dword [0x14024b3d8], 0
jne 0x1400e4ac6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x14024b3dc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x1400e4a6d
mov ecx, 0x28
call fcn.140132e70
test rax, rax
je 0x1400e4ac6
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x20], 0
mov ecx, dword [0x14024b3dc]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400e4abe
lea r15, [0x14024b3e0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x14024b3f0]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014ced0
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1401663e0
mov rcx, r14
call fcn.140132eb0
mov rcx, rsi
mov rax, rdi
call qword [case.0x1401b58f0.0]
xor esi, esi
jmp 0x1400e4a9d

Function at 0x1400e4ae0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400e4b1c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400e4b26
add rdi, rbx
sub rsi, rbx
jne 0x1400e4afa
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401663e0
int3

Function at 0x1400e60a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x30
mov rax, rcx
mov rcx, qword [0x14022f038]
xor rcx, rsp
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400e6123
cmp byte [rax + 0x90], 0
jne 0x1400e6123
mov sil, 1
cmp byte [rax + 0x91], 0
jne 0x1400e610e
lea rdx, [rsp + 0x27]
mov byte [rdx], 0xaa
mov r8d, 1
mov r9d, 2
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x1400e6123
cmp esi, 0xffffffff
setne cl
cmp eax, 0x2733
sete sil
or sil, cl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014ced0
mov eax, esi
add rsp, 0x30
pop rsi
ret
xor esi, esi
jmp 0x1400e610e
Function at 0x1400e6130
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
lea rbx, [rsp + 0x28]
mov r8d, SysAllocStringByteLen
mov rcx, rbx
mov dl, 0xaa
call fcn.14014fe30
mov rcx, rbx
call fcn.1400e6570
lea r8, [rsp + 0xa8]
mov rdx, qword [r8 + 8]
mov rcx, qword [rdi + 8]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400e61ca
mov r8d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rcx, rsi
call fcn.1400b8750
xor ecx, ecx
test al, al
mov esi, 0xffffff94
cmovne esi, ecx
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14014ced0
mov eax, esi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400e6630
mov esi, eax
jmp 0x1400e61ad
Function at 0x1400e7020
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor ecx, ecx
xor eax, eax
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x1400e7142
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x1400e7178
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr r10b, 3
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x1400e7180
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test edi, edi
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x1400e7184
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x1400e718a
pop rdi
pop rsi
ret
xor r10d, r10d
jmp 0x1400e707c
xor eax, eax
jmp 0x1400e7111
mov dl, byte [r8 + 0x19]
jmp 0x1400e7171
cmp byte [r8 + 0x1a], 0
je 0x1400e7175
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x1400e7175
cmp ecx, 0x666f736f
jne 0x1400e7175
cmp edx, 0x76482074
jne 0x1400e7175
mov byte [r8 + 0x19], 1
jmp 0x1400e7175

Function at 0x1400e82a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x14024b520]
mov ecx, dword [0x14023ece4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e8321
lea rcx, [0x14024b510]
call fcn.1400a7360
test rax, rax
jne 0x1400e830e
mov ecx, 4
call fcn.14014c3b0
mov rdi, rax
mov dword [rax], 0
lea rbx, [0x14024b510]
mov rcx, rbx
call fcn.1400a7360
mov rsi, rax
mov rcx, rbx
mov rdx, rdi
call fcn.14010cc90
test rsi, rsi
jne 0x1400e8364
lea rcx, [0x14024b510]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400a7360
lea rcx, [0x14024b520]
call fcn.14014c510
cmp dword [0x14024b520], 0xffffffff
jne 0x1400e82c8
xorps xmm0, xmm0
movups xmmword [0x14024b510], xmm0
lea rcx, [0x14024b510]
lea rdx, [0x140041c90]
call fcn.1400a7400
lea rcx, [0x14024b520]
call fcn.14014c5a8
jmp 0x1400e82c8
mov rcx, rsi
call fcn.14014c3ec
jmp 0x1400e830e
Function at 0x1400ea120
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400ea15c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400ea166
add rdi, rbx
sub rsi, rbx
jne 0x1400ea13a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x1400eecf0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x1400eee43
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x1400eee3c
cmp r14, rax
ja 0x1400eee48
lea rcx, [r14*8]
call fcn.14014c3b0
shl rbx, 3
add rbx, rax
je 0x1400eee4d
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rbx], rcx
mov qword [rdi], 0
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x1400eee11
mov r8, qword [rdx - 8]
mov qword [rbx - 8], r8
mov qword [rdx - 8], 0
lea r8, [rdx - 8]
add rbx, 0xfffffffffffffff8
mov rdx, r8
cmp r8, rdi
jne 0x1400eed9b
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x1400eee1c
add r14, 0xfffffffffffffff8
test r14, r14
je 0x1400eee79
mov rcx, qword [r14]
mov rax, qword [0x1402329e0]
and rax, rcx
cmp rax, qword [0x1402329c8]
je 0x1400eee0a
mov qword [r14], 0
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x1400eedd6
jmp 0x1400eee1c
call fcn.140102a20
jmp 0x1400eedf5
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
jne 0x1400eee2b
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014c3ec
xor eax, eax
jmp 0x1400eed6d
call fcn.1401663e0
call fcn.140189a80
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.14018a2b0
int3

Function at 0x1400ef060
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1400ef0a8
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400ef0b1
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400ef098
mov qword [rdi], rsi
call fcn.140100430
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140100430
mov rcx, qword [rdi]
call fcn.140112e70
mov qword [rdi], 0
jmp 0x1400ef086
Function at 0x1400f5ae0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1402401e0]
cmp rsi, 1
jbe 0x1400f5b01
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400a7360
lea rcx, [0x1402401e0]
call fcn.14009b320
test al, al
je 0x1400f5b46
xorps xmm0, xmm0
movups xmmword [0x1402401e8], xmm0
lea rdi, [0x1402401e0]
lea rsi, [0x1402401e8]
mov rcx, rsi
xor edx, edx
call fcn.1400a7400
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14009b3e0
jmp 0x1400f5af3
mov rsi, qword [0x1402401e0]
jmp 0x1400f5af3

Function at 0x1400f5ce0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov rsi, rcx
mov r12, qword [rsp + 0x90]
cmp r12, 8
jb 0x1400f5e54
mov r14, r9
mov r13d, dword [r9 + 4]
cmp r13, r12
ja 0x1400f5e54
mov qword [rsp + 0x20], rsi
cmp dword [r14], 0x100000
ja 0x1400f5e58
mov r15, rdx
lea rbp, [r14 + r13]
sub r12, r13
mov ecx, 0x88
call fcn.14014c3b0
mov rbx, rax
mov rsi, qword [rdi]
mov qword [rdi], 0
lea rdx, [0x14020d938]
mov rcx, rax
call fcn.140121e00
lea rax, fcn.1400f5fc0
mov qword [rbx], rax
mov qword [rbx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rbx + 0x18], xmm0
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x30], rsi
mov word [rbx + 0x38], 0x100
mov byte [rbx + 0x3a], 1
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x48], r13
mov qword [rbx + 0x50], rbp
mov qword [rbx + 0x58], r12
movups xmmword [rbx + 0x60], xmm0
mov qword [rbx + 0x70], 0
movups xmm0, xmmword [0x1402185e0]
movups xmmword [rbx + 0x78], xmm0
mov eax, dword [0x140240208]
mov ecx, dword [0x14023ece4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f5dff
lock inc dword [0x1402401fc]
mov rsi, qword [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, qword [rdi]
mov qword [rdi], 0
test rcx, rcx
jne 0x1400f5e5f
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140240208]
call fcn.14014c510
cmp dword [0x140240208], 0xffffffff
jne 0x1400f5dcd
lea rax, [0x140209b98]
mov qword [0x140240200], rax
lea r14, [0x140240200]
call fcn.1400b40d0
lea r8, str.MojoMessages
mov rcx, rax
mov rdx, r14
xor r9d, r9d
call fcn.1400b4180
lea rcx, [0x140240208]
call fcn.14014c5a8
jmp 0x1400f5dcd
xor ebx, ebx
jmp 0x1400f5dd9
xor ebx, ebx
jmp 0x1400f5dd4
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x1401b58f0.0]
jmp 0x1400f5deb
Function at 0x1401022f0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14010231b
call fcn.140100430
cmp qword [rsi], r14
je 0x14010234a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140102369
cmp r15, 2
jb 0x140102342
mov qword [rsi], r14
call fcn.140100430
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x140102334

Function at 0x14010cc90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140231378]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14010ccce
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14010ccc7
call fcn.1400a7150
jmp 0x14010ccae

Function at 0x1401128f0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140112937
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140112951
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14011292f
mov qword [rsi], rdi
call fcn.140100430
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140112967
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x14011291d
int3

Function at 0x140112970
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jae 0x1401129e9
cmp qword [rsi], r14
je 0x1401129c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1401129f0
cmp r15, 2
jb 0x1401129bc
mov qword [rsi], r14
call fcn.140100430
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140112a06
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140100430
jmp 0x140112995
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x1401129ae
call fcn.140100430
mov rcx, qword [rdi]
call fcn.140112e70
mov qword [rdi], 0
jmp 0x1401129da
Function at 0x140112c00
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140112c9a
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140112c84
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140112c61
mov qword [rsi], rdi
call fcn.140100430
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x140112c9e
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x140112c4f
mov byte [rsi + 8], 1
int3

Function at 0x140112ea0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140243dd8]
mov ecx, dword [0x14023ece4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140112f00
lea rsi, [0x140243dd0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140243dd8]
call fcn.14014c510
cmp dword [0x140243dd8], 0xffffffff
jne 0x140112edc
lea rsi, [rsp + 0x34]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14014fe30
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14014c3b0
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140243e20]
mov ecx, dword [0x14023ece4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140112fc0
lea r8, [0x140243df0]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r9d, edi
call fcn.1400b16e0
mov qword [0x140243dd0], rsi
lea rcx, [0x140243dd8]
call fcn.14014c5a8
jmp 0x140112edc
lea rcx, [0x140243e20]
call fcn.14014c510
cmp dword [0x140243e20], 0xffffffff
jne 0x140112f91
xorps xmm0, xmm0
movups xmmword [0x140243e10], xmm0
movups xmmword [0x140243e00], xmm0
movups xmmword [0x140243df0], xmm0
lea rcx, [0x140243df0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140243e20]
call fcn.14014c5a8
jmp 0x140112f91
Function at 0x140113010
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140243dd8]
mov ecx, dword [0x14023ece4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140113070
mov rsi, qword [0x140243dd0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140243dd8]
call fcn.14014c510
cmp dword [0x140243dd8], 0xffffffff
jne 0x14011304c
lea rsi, [rsp + 0x34]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14014fe30
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14014c3b0
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140243e20]
mov ecx, dword [0x14023ece4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140113130
lea r8, [0x140243df0]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r9d, edi
call fcn.1400b16e0
mov qword [0x140243dd0], rsi
lea rcx, [0x140243dd8]
call fcn.14014c5a8
jmp 0x14011304c
lea rcx, [0x140243e20]
call fcn.14014c510
cmp dword [0x140243e20], 0xffffffff
jne 0x140113101
xorps xmm0, xmm0
movups xmmword [0x140243e10], xmm0
movups xmmword [0x140243e00], xmm0
movups xmmword [0x140243df0], xmm0
lea rcx, [0x140243df0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140243e20]
call fcn.14014c5a8
jmp 0x140113101

Function at 0x140113360
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r9
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r12, qword [rdx]
mov qword [rdx], rax
lea r13, [r12 + 1]
cmp r13, 2
jb 0x140113397
call fcn.140100430
mov r15, qword [rsp + 0x90]
cmp qword [rsi], r12
je 0x1401133d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1401133ff
cmp r13, 2
jb 0x1401133c7
mov qword [rsi], r12
call fcn.140100430
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 8], ebp
mov qword [rsi + 0x10], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140113415
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x1401133b9
call fcn.140100430
mov rcx, qword [rdi]
call fcn.140112e70
mov qword [rdi], 0
jmp 0x1401133eb