joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400010a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
lea eax, [rcx + rcx*4 - 5]
mov dword [rdx], 1
mov rbx, rdx
movsxd rcx, eax
add rcx, qword [0x140142820]
call fcn.140005c70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400010d6
mov dword [rbx], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140001660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.140005c70
lea r8, [0x1400a86a0]
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.14002c3e4
test eax, eax
jne 0x1400016fc
mov rcx, qword [rsp + 0x48]
lea edx, [rax + 4]
xor r8d, r8d
call fcn.14002c27c
mov r9, qword [rsp + 0x48]
mov edx, 1
lea r8d, [rdx + 3]
mov rcx, rdi
call fcn.14002c1a8
mov r9, qword [rsp + 0x48]
mov edx, 1
lea r8d, [rdx + 3]
mov rcx, rbx
call fcn.14002c1a8
mov eax, dword [0x1400ceea4]
mov ecx, dword [rbx]
mov r11d, dword [rdi]
cmp eax, r11d
cmovle eax, r11d
mov dword [0x1400ceea4], eax
mov eax, dword [0x1400ceea8]
cmp eax, ecx
cmovle eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [0x1400ceea8], eax
call fcn.14002be60
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002f80
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x20
jne 0x140002f9c
mov rcx, rbx
call fcn.14002c53c
add rsp, 0x20
pop rbx
ret

Function at 0x140002fb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
movsxd rax, dword [rcx]
xor ebp, ebp
mov rdi, r9
mov rsi, rdx
mov dword [rsp + 0x40], ebp
cmp eax, 1
jl 0x140003026
cmp eax, 0x64
jg 0x140003026
mov qword [rsp + 0x48], rbx
lea rbx, [0x1400d2620]
mov rbx, qword [rbx + rax*8 - 8]
mov eax, dword [r8]
cmp eax, 0xffffffff
mov edx, eax
cmove edx, ebp
cmp eax, 0xfffffffe
je 0x140003008
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rdi]
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140003040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
movsxd rax, dword [rcx]
xor ebp, ebp
mov rdi, r9
mov rsi, rdx
mov dword [rsp + 0x40], ebp
cmp eax, 1
jl 0x1400030b6
cmp eax, 0x64
jg 0x1400030b6
mov qword [rsp + 0x48], rbx
lea rbx, [0x1400d2620]
mov rbx, qword [rbx + rax*8 - 8]
mov eax, dword [r8]
cmp eax, 0xffffffff
mov edx, eax
cmove edx, ebp
cmp eax, 0xfffffffe
je 0x140003098
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rdi]
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140003390
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140005c70
mov rcx, rax
mov rbx, rax
call fcn.1400030d0
mov dword [rsp + 0x40], eax
test eax, eax
je 0x1400033b8
lea rcx, [rsp + 0x40]
call fcn.140002f20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x20
jne 0x1400033ce
mov rcx, rbx
call fcn.14002c53c
add rsp, 0x20
pop rbx
ret
Function at 0x140005d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r11d, r11d
mov r10, rcx
mov rbx, r8
lea rcx, [0x1400a9608]
lea rsi, [0x1400fcce0]
mov edx, r11d
nop dword [rax]
movzx eax, word [rdx + rcx]
add rdx, 2
mov word [rdx + rsi - 2], ax
test ax, ax
jne 0x140005db0
mov r8, qword [0x140142818]
mov edx, r11d
lea rdi, [0x1400fc2a0]
lea r9, [r8 + 0xadc]
cmp dword [r9], edx
jle 0x140005e08
mov rcx, rdi
sub r8, rdi
nop word [rax + rax]
movzx eax, word [r8 + rcx + 0x8d8]
inc edx
add rcx, 2
mov word [rcx - 2], ax
cmp edx, dword [r9]
jl 0x140005df0
movsxd rax, dword [r9]
movsx ecx, byte [r10]
mov word [rdi + rax*2], cx
movsx eax, byte [r10]
mov word [0x1400fccf4], ax
movsxd rax, dword [r9]
movsx ecx, byte [r10 + 1]
mov word [rdi + rax*2 + 2], cx
movsx eax, byte [r10 + 1]
mov word [0x1400fccf6], ax
movsxd rax, dword [r9]
movsx ecx, byte [r10 + 2]
mov word [rdi + rax*2 + 4], cx
movsx eax, byte [r10 + 2]
mov word [0x1400fccf8], ax
movsxd rax, dword [r9]
movsx ecx, byte [r10 + 3]
mov word [rdi + rax*2 + 6], cx
movsx eax, byte [r10 + 3]
mov word [0x1400fccfc], r11w
mov word [0x1400fccfa], ax
movsxd rax, dword [r9]
mov word [rdi + rax*2 + 8], r11w
cmp dword [rbx], r11d
jne 0x140005ea0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005e95
mov rcx, rdi
call fcn.14002c53c
mov rdx, rdi
mov rcx, rsi
call fcn.14002d1c0
cmp dword [rbx], 1
jne 0x140005eb0
mov rdx, rsi
mov rcx, rdi
call fcn.14002d1c0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140005ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [0x140142818]
xor ebx, ebx
cmp dword [r8 + 0xae0], 1
jne 0x140005f68
movsx edx, byte [rcx]
movsxd rax, dword [r8 + 0xad8]
mov word [r8 + rax*2 + 0x6d8], dx
movsx r8d, byte [rcx + 1]
mov rdx, qword [0x140142818]
movsxd rax, dword [rdx + 0xad8]
mov word [rdx + rax*2 + 0x6da], r8w
movsx r8d, byte [rcx + 2]
mov rdx, qword [0x140142818]
movsxd rax, dword [rdx + 0xad8]
mov word [rdx + rax*2 + 0x6dc], r8w
movsx edx, byte [rcx + 3]
mov rcx, qword [0x140142818]
movsxd rax, dword [rcx + 0xad8]
mov word [rcx + rax*2 + 0x6de], dx
mov rdx, qword [0x140142818]
movsxd rcx, dword [rdx + 0xad8]
mov word [rdx + rcx*2 + 0x6e0], bx
mov rcx, qword [0x140142818]
add rcx, 0x6d8
jmp 0x140005fc2
mov rdx, rbx
lea r9, [0x1400a9608]
lea r8, [0x1400fc2a0]
nop dword [rax]
movzx eax, word [rdx + r9]
add rdx, 2
mov word [rdx + r8 - 2], ax
test ax, ax
jne 0x140005f80
movsx eax, byte [rcx]
mov word [0x1400fc2b4], ax
movsx eax, byte [rcx + 1]
mov word [0x1400fc2b6], ax
movsx eax, byte [rcx + 2]
mov word [0x1400fc2b8], ax
movsx eax, byte [rcx + 3]
mov rcx, r8
mov word [0x1400fc2ba], ax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14002c50c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002c522
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002c524
xor eax, eax
test eax, eax
je 0x14002c534
mov ecx, eax
call fcn.14002e6d4
or eax, 0xffffffff
jmp 0x14002c536
xor eax, eax
add rsp, 0x28
ret
jmp 0x14002c50c

Function at 0x14002c53c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002c522
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002c524
xor eax, eax
test eax, eax
je 0x14002c534
mov ecx, eax
call fcn.14002e6d4
or eax, 0xffffffff
jmp 0x14002c536
xor eax, eax
add rsp, 0x28
ret
jmp 0x14002c50c

Function at 0x14002c8a4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14002c714

Function at 0x14002c8b0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp fcn.14002c714

Function at 0x14002d1c0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14002d1d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002d1d8
xor eax, eax
test eax, eax
je 0x14002d1e8
mov ecx, eax
call fcn.14002e6d4
or eax, 0xffffffff
jmp 0x14002d1ea
xor eax, eax
add rsp, 0x28
ret

Function at 0x140032343
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400cada8]
jne 0x14002cdda
rol rcx, 0x10
test cx, 0xffff
jne 0x14002cdd6
repz ret
ror rcx, 0x10
jmp 0x14003229c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400e4360]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400e4458]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140032321
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400e4360]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140032343
mov rax, qword [rsp + 0x88]
mov qword [0x1400e4458], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400e43f8], rax
mov rax, qword [0x1400e4458]
mov qword [0x1400e42d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400e43e0], rax
mov dword [0x1400e42c0], 0xc0000409
mov dword [0x1400e42c4], 1
mov rax, qword [0x1400cada8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400cadb0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400e4358], eax
mov ecx, 1
call fcn.140039cd4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400afca0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400e4358], 0
jne 0x1400323ca
mov ecx, 1
call fcn.140039cd4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14003b134
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400cada8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400313a0
xor ebx, ebx
cmp qword [0x1400e4a78], rbx
mov rdi, rax
jne 0x14003b247
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14003b31e
lea rdx, [0x1400b0290]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003b31e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400e4a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400e4a80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400e4a88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400e4a98], rax
test rax, rax
je 0x14003b23e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400e4a90], rax
jmp 0x14003b24e
mov rax, qword [0x1400e4a90]
jmp 0x14003b255
mov rax, qword [0x1400e4a90]
mov r11, qword [0x1400e4a98]
cmp rax, rdi
je 0x14003b2bc
cmp r11, rdi
je 0x14003b2bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400e4a98]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14003b2bc
test rax, rax
je 0x14003b2bc
call rsi
test rax, rax
je 0x14003b2b6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003b2b6
test byte [rsp + 0x40], 1
jne 0x14003b2bc
bts ebp, 0x15
jmp 0x14003b2fc
mov rcx, qword [0x1400e4a80]
cmp rcx, rdi
je 0x14003b2fc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14003b2fc
call rax
mov rbx, rax
test rax, rax
je 0x14003b2fc
mov rcx, qword [0x1400e4a88]
cmp rcx, rdi
je 0x14003b2fc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14003b2fc
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400e4a78]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14003b31e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14003b320
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002cdc0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140069100
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x20]
lea rax, [0x1400ec740]
mov rcx, rax
call fcn.14007a450
mov dword [rbp + 0x2c], eax
mov eax, dword [0x1400ec744]
mov dword [rbp + 0x30], eax
mov eax, dword [rbp + 0x30]
test eax, eax
jne 0x140069194
mov dword [rbp + 0x28], 1
mov eax, dword [rbp + 0x28]
mov dword [0x1400ec744], eax
lea rax, str.FORT0
mov rcx, rax
call fcn.14003fb28
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x140069194
call fcn.14002e91c
mov qword [rbp], rax
mov rax, qword [rbp + 0x20]
lea rdx, [0x1400b9478]
mov ecx, 0x60
add rcx, qword [rbp]
mov qword [rbp + 0x10], rcx
mov rcx, rax
mov rax, qword [rbp + 0x10]
mov r8, rax
call fcn.1400a6d80
mov qword [rbp + 8], rax
mov dword [rbp + 0x34], 0
mov eax, dword [rbp + 0x34]
mov dword [0x1400ec740], eax
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x1400768b0
Capabilities:
Query environment variable

Disassembly:
push r14
push r15
sub rsp, 0x38
xor r15d, r15d
test rcx, rcx
je 0x140076951
call fcn.14003fb28
mov r14, rax
test r14, r14
je 0x14007690e
movsx ecx, byte [r14]
test ecx, ecx
je 0x14007690e
call fcn.140037adc
movsx rdx, al
cmp edx, 0x74
je 0x140076949
cmp edx, 0x79
je 0x140076949
mov rax, r14
mov qword [rsp + 0x20], rbx
mov rbx, rax
jmp 0x1400768fc
inc rbx
movsx ecx, byte [rbx]
test ecx, ecx
je 0x140076921
call fcn.14003a9b8
test eax, eax
je 0x14007691a
jmp 0x1400768f9
mov eax, r15d
add rsp, 0x38
pop r15
pop r14
ret
mov rbx, qword [rsp + 0x20]
jmp 0x14007690e
mov rcx, r14
lea rdx, [0x1400bb160]
mov rbx, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], 0
call fcn.14002e05c
cmp dword [rsp + 0x28], 0
je 0x14007690e
mov r15d, 1
jmp 0x14007690e
xor eax, eax
add rsp, 0x38
pop r15
pop r14
ret
Function at 0x140079730
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x38
mov r12, r9
mov rbx, qword [rsp + 0xb0]
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
xor r14d, r14d
mov qword [r12], 0
cmp dword [0x1400fc280], 0
je 0x140079837
cmp rbx, 2
je 0x140079778
cmp rbx, 1
jne 0x14007978e
mov eax, 0xffffffff
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r13d, dword [rsp + 0xa0]
test r13d, r13d
je 0x1400797a5
cmp rbx, 0xfffffffffffffffa
je 0x140079925
test rbx, rbx
je 0x140079933
test r13d, r13d
je 0x1400797d0
cmp dword [rsp + 0xa8], 0
je 0x1400797d0
mov r13d, r15d
mov ecx, r13d
call fcn.1400a7740
mov ecx, r13d
call fcn.1400a7760
test r14d, r14d
je 0x140079837
mov rcx, rsi
mov edx, edi
mov r8d, r15d
call fcn.1400a7740
movsxd rbp, eax
cmp eax, 0xffffffff
mov qword [r12], rbp
jne 0x140079801
xor eax, eax
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, [0x1400bc36c]
mov edx, 2
mov r8d, r15d
xor r9d, r9d
call fcn.1400a7740
mov byte [rbp + rsi], 0xa
mov eax, 1
inc qword [r12]
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsp + 0xb8]
test r14, r14
mov qword [r12], 0
je 0x140079860
mov rax, qword [r14 + 0x210]
test rax, rax
jne 0x140079865
mov eax, 0x20000
cmp rdi, rax
jbe 0x1400798ee
test rbx, rbx
je 0x1400798ee
test r14, r14
je 0x140079884
mov rbx, qword [r14 + 0x210]
test rbx, rbx
jne 0x140079889
mov ebx, 0x20000
mov r13, rbx
mov rcx, rbp
mov rdx, rsi
mov r8d, ebx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400798d9
movsxd rdx, dword [rsp + 0x30]
add rsi, rdx
add qword [r12], rdx
sub rdi, rdx
test r14, r14
je 0x1400798cd
mov rdx, qword [r14 + 0x210]
test rdx, rdx
jne 0x1400798d2
mov edx, 0x20000
cmp rdi, rdx
cmovbe rbx, rdi
test rdi, rdi
je 0x140079914
movsxd rdx, dword [rsp + 0x30]
cmp rdx, r13
jne 0x140079914
test eax, eax
jne 0x140079889
jmp 0x140079914
mov rcx, rbp
mov rdx, rsi
mov r8d, edi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rdx, dword [rsp + 0x30]
mov qword [r12], rdx
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r14d, 1
mov r15, rbp
jmp 0x1400797b3
mov r14d, 1
call fcn.1400a7760
movsxd r15, eax
cmp dword [0x1400fc280], 0
jne 0x1400797ae
jmp 0x1400797d5
Function at 0x140079f00
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push r15
push rbp
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x28], 0
mov ebp, 1
lea rdx, [0x1400f4894]
mov eax, 1
xchg dword [rdx], eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140079f91
mov eax, 0x51eb851f
mov ecx, ebp
imul ebp
mov r9d, ebp
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
imul r8d, edx, 0x64
sub r9d, r8d
jne 0x140079f91
xor ecx, ecx
cmp ebp, 0x15f90
jl 0x140079f8b
cmp ebp, 0x1d4c0
jge 0x140079f69
mov ecx, Ordinal_52
jmp 0x140079f8b
cmp ebp, 0x2bf20
jge 0x140079f78
mov ecx, 0x64
jmp 0x140079f8b
mov eax, 0x1482
mov ecx, 0xfa
cmp ebp, 0x57d78
cmovl ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140079fa7
inc ebp
cmp ebp, 0x57e40
jl 0x140079f19
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140079fc1
mov dword [rsp + 0x20], 0x98
lea rcx, [rsp + 0x20]
call fcn.140079c10
mov eax, dword [0x1400f4898]
test eax, eax
jne 0x140079ff4
cmp dword [0x1400ce448], 1
je 0x14007a085
cmp dword [0x1400f4890], 0
je 0x14007a03d
mov dword [0x1400f4898], 1
cmp dword [0x1400ce448], 1
je 0x14007a021
mov ecx, dword [0x1400f488c]
mov dword [0x1400f4894], 0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007a0ae
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbp
pop r15
pop rbx
ret
mov ecx, 2
mov rdx, r15
call fcn.140030e60
mov ecx, 0x16
mov rdx, rbp
call fcn.140030e60
jmp 0x140079ff4
mov dword [0x1400f4890], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400f488c], eax
cmp eax, 0xffffffff
jne 0x14007a068
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140079fe1
lea rcx, [0x140079ee0]
call fcn.14003183c
lea rcx, [0x140079ea0]
call fcn.14003183c
jmp 0x140079fe1
mov ecx, 2
mov edx, 1
call fcn.140030e60
mov r15, rax
mov ecx, 0x16
mov edx, 1
call fcn.140030e60
mov rbp, rax
jmp 0x140079fd8
mov ecx, 0x80
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
call fcn.140071900
test eax, eax
je 0x14007a0d8
mov qword [rbx], 0
add rsp, 0x30
pop rbp
pop r15
pop rbx
ret
mov rax, qword [rsp + 0x28]
mov edx, 0x80
lea rcx, [0x140000000]
mov r8, rcx
mov r10, rcx
mov r15, rcx
mov rbp, qword [rcx + rdx + 0xce378]
mov qword [rax + rdx - 8], rbp
mov r9, qword [r8 + rdx + 0xce370]
mov qword [rax + rdx - 0x10], r9
mov r11, qword [r10 + rdx + 0xce368]
mov qword [rax + rdx - 0x18], r11
mov rcx, qword [r15 + rdx + 0xce360]
mov qword [rax + rdx - 0x20], rcx
sub rdx, 0x20
jne 0x14007a0e2
mov ecx, dword [0x1400f488c]
mov rdx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [rsp + 0x28]
jmp 0x14007a013
Function at 0x14007a150
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push r15
push rbp
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x28], 0
mov ebp, 1
lea rdx, [0x1400f4894]
mov eax, 1
xchg dword [rdx], eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x14007a1e1
mov eax, 0x51eb851f
mov ecx, ebp
imul ebp
mov r9d, ebp
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
imul r8d, edx, 0x64
sub r9d, r8d
jne 0x14007a1e1
xor ecx, ecx
cmp ebp, 0x15f90
jl 0x14007a1db
cmp ebp, 0x1d4c0
jge 0x14007a1b9
mov ecx, Ordinal_52
jmp 0x14007a1db
cmp ebp, 0x2bf20
jge 0x14007a1c8
mov ecx, 0x64
jmp 0x14007a1db
mov eax, 0x1482
mov ecx, 0xfa
cmp ebp, 0x57d78
cmovl ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x14007a1f7
inc ebp
cmp ebp, 0x57e40
jl 0x14007a169
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x14007a211
mov dword [rsp + 0x20], 0x98
lea rcx, [rsp + 0x20]
call fcn.140079c10
mov eax, dword [0x1400f4898]
test eax, eax
jne 0x14007a244
cmp dword [0x1400ce448], 1
je 0x14007a2ea
cmp dword [0x1400f4890], 0
je 0x14007a2a2
mov dword [0x1400f4898], 1
cmp dword [0x1400ce448], 1
je 0x14007a286
mov ecx, dword [0x1400f488c]
mov dword [0x1400f4894], 0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov qword [rsp + 0x28], rbp
test rbp, rbp
je 0x14007a33e
mov qword [rbx], rbp
cmp dword [0x1400ce448], 1
je 0x14007a313
xor eax, eax
add rsp, 0x30
pop rbp
pop r15
pop rbx
ret
mov ecx, 2
mov rdx, r15
call fcn.140030e60
mov ecx, 0x16
mov rdx, rbp
call fcn.140030e60
jmp 0x14007a244
mov dword [0x1400f4890], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400f488c], eax
cmp eax, 0xffffffff
jne 0x14007a2cd
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14007a231
lea rcx, [0x140079ee0]
call fcn.14003183c
lea rcx, [0x140079ea0]
call fcn.14003183c
jmp 0x14007a231
mov ecx, 2
mov edx, 1
call fcn.140030e60
mov r15, rax
mov ecx, 0x16
mov edx, 1
call fcn.140030e60
mov rbp, rax
jmp 0x14007a228
mov ecx, 2
mov edx, 1
call fcn.140030e60
mov ecx, 0x16
mov edx, 1
mov qword [rbp + 0x68], rax
call fcn.140030e60
mov qword [rbp + 0x70], rax
jmp 0x14007a27b
mov ecx, 0x80
xor edx, edx
lea r8, [rsp + 0x28]
call fcn.140071900
test eax, eax
je 0x14007a363
mov qword [rbx], 0
add rsp, 0x30
pop rbp
pop r15
pop rbx
ret
mov rax, qword [rsp + 0x28]
mov edx, 0x80
lea rcx, [0x140000000]
mov r8, rcx
mov r10, rcx
mov r15, rcx
mov rbp, qword [rcx + rdx + 0xce378]
mov qword [rax + rdx - 8], rbp
mov r9, qword [r8 + rdx + 0xce370]
mov qword [rax + rdx - 0x10], r9
mov r11, qword [r10 + rdx + 0xce368]
mov qword [rax + rdx - 0x18], r11
mov rcx, qword [r15 + rdx + 0xce360]
mov qword [rax + rdx - 0x20], rcx
sub rdx, 0x20
jne 0x14007a36d
mov ecx, dword [0x1400f488c]
mov rdx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbp, qword [rsp + 0x28]
jmp 0x14007a26b