joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402171c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x14041eed0]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x1402172c4
mov rsi, rcx
lea r14, [0x1403e6aa0]
movabs r15, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1403df810]
lea rbx, [rsp + 0x20]
xor r12d, r12d
mov rax, r12
shl rax, 4
mov qword [rsp + 0x30], r15
movaps xmmword [rsp + 0x20], xmm6
mov rdx, qword [rax + r14]
mov r8, qword [rax + r14 + 8]
mov rcx, rbx
call fcn.1401f2e50
movzx eax, byte [rsp + 0x37]
mov rcx, qword [rsp + 0x20]
mov r8, rbx
mov rdx, rax
test al, al
jns 0x14021725a
mov rdx, qword [rsp + 0x28]
mov r8, rcx
mov r9, qword [rsi + 8]
cmp r9, rdx
mov r10, rdx
cmovb r10, r9
test r10, r10
js 0x1402172ea
cmp rdx, r9
jbe 0x140217276
xor ebp, ebp
jmp 0x14021729f
mov bpl, 1
test rdx, rdx
je 0x14021729d
mov r9, qword [rsi]
xor r10d, r10d
movzx r11d, word [r9 + r10*2]
cmp r11w, word [r8 + r10*2]
jne 0x140217272
inc r10
cmp rdx, r10
jne 0x140217284
mov rdi, rdx
jmp 0x14021729f
xor edi, edi
test al, al
jns 0x1402172a8
call fcn.1403336f4
test bpl, bpl
jne 0x1402172c6
inc r12
movzx eax, byte [0x14041eed0]
xor rax, 3
cmp r12, rax
jb 0x14021721c
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140334bf0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
Function at 0x140219870
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdx, qword [0x14041eef8]
test rdx, rdx
jne 0x140219987
mov ecx, 0x18
call fcn.1403336b8
mov rbx, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [0x14041eef8], rax
mov ecx, 0x18
call fcn.1403336b8
mov r14, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], r15
mov qword [0x14041ef00], rax
call fcn.14021b4e0
mov rax, qword [rax + 8]
mov r15, qword [rax + 0x10]
lea rdx, str.user_data_dir
lea r12, [rsp + 0x38]
mov rcx, r12
call fcn.14036ecf0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r13, [rsp + 0x20]
mov rcx, r13
mov rdx, rax
call fcn.14036ecf0
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.14021a730
mov rcx, rbp
mov rdx, r15
mov r8, rbx
mov r9, r14
call fcn.1402191c0
mov ebx, eax
cmp byte [rbp + 0x17], 0
jns 0x140219956
mov rcx, qword [rsp + 0x50]
call fcn.1403336f4
cmp byte [rsp + 0x37], 0
jns 0x140219967
mov rcx, qword [rsp + 0x20]
call fcn.1403336f4
cmp byte [rsp + 0x4f], 0
jns 0x140219978
mov rcx, qword [rsp + 0x38]
call fcn.1403336f4
test bl, bl
je 0x140219a5f
mov rdx, qword [0x14041eef8]
cmp rdx, rdi
je 0x1402199b2
cmp byte [rdi + 0x17], 0
movzx r8d, byte [rdx + 0x17]
js 0x140219a30
test r8b, r8b
jns 0x140219a10
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rdi
mov rdx, rax
call fcn.140202a00
mov dil, 1
test rsi, rsi
je 0x1402199e8
mov rdx, qword [0x14041ef00]
cmp rdx, rsi
je 0x1402199e8
cmp byte [rsi + 0x17], 0
movzx r8d, byte [rdx + 0x17]
js 0x140219a49
test r8b, r8b
jns 0x140219a20
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, rax
call fcn.140202a00
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140334bf0
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdx + 0x10]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rdi], xmm0
jmp 0x1402199b2
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x1402199e8
test r8b, r8b
jns 0x140219a3c
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
mov rcx, rdi
call fcn.140202910
jmp 0x1402199b2
test r8b, r8b
jns 0x140219a55
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
mov rcx, rsi
call fcn.140202910
jmp 0x1402199e8
xor edi, edi
jmp 0x1402199e8
Function at 0x140219fa0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1403369a0
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14021a035
mov eax, eax
inc rax
cmp rax, 1
je 0x14021a035
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x14021a001
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14021a022
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.14034faa8
test eax, eax
je 0x14021a114
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14021a096
mov eax, eax
inc rax
cmp rax, 1
je 0x14021a096
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x14021a062
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14021a083
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.14034faa8
test eax, eax
je 0x14021a13e
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14021a0f3
mov eax, eax
inc rax
cmp rax, 1
je 0x14021a0f3
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x14021a0c3
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14021a0e4
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.14034faa8
test eax, eax
je 0x14021a168
xor ebx, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14021a120
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x14021a0f5
mov rcx, rsi
mov rdx, r14
call fcn.140380c90
cmp word [rax], 0x5c
jne 0x14021a035
jmp 0x14021a0f5
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14021a14a
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x14021a0f5
mov rcx, rsi
mov rdx, r14
call fcn.140380c90
cmp word [rax], 0x5c
jne 0x14021a096
jmp 0x14021a0f5
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14021a174
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x14021a0f5
mov rcx, rsi
mov rdx, r14
call fcn.140380c90
cmp word [rax], 0x5c
jne 0x14021a0f3
jmp 0x14021a0f5
Function at 0x14021aba0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14021acb8
mov ebx, eax
mov r15d, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [rsp + 0x20], xmm0
cmp ebx, 0xb
jae 0x14021acc8
lea r14, [rsp + 0x20]
mov byte [r14 + 0x17], bl
lea r8, [r15 + r15]
mov rcx, r14
xor edx, edx
call fcn.1403369a0
mov word [r14 + r15*2], 0
cmp byte [rsp + 0x37], 0
jns 0x14021ac2d
mov rdx, qword [rsp + 0x20]
jmp 0x14021ac32
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14021aca8
mov edx, eax
movzx eax, byte [rsp + 0x37]
test al, al
jns 0x14021ac52
mov rax, qword [rsp + 0x28]
cmp rax, rdx
jbe 0x14021aca8
lea rdi, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.140309970
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
xorps xmm0, xmm0
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
cmp byte [rsp + 0x37], 0
js 0x14021ad00
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140334bf0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x14021ac83
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x14021ac8a
mov r12, r15
or r12, 7
lea rcx, [r12*2 + 2]
call fcn.1403336b8
mov r14, rax
mov qword [rsp + 0x20], rax
movabs rax, 0x8000000000000001
add rax, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
jmp 0x14021ac0a
mov rcx, qword [rsp + 0x20]
call fcn.1403336f4
jmp 0x14021ac8a
Function at 0x14021b0a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x17], 0
mov rsi, rcx
jns 0x14021b0c8
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14021b0fb
test al, 0x10
jne 0x14021b18e
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14021b280
xor edi, edi
jmp 0x14021b1a7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
movzx r9d, byte [rdi + 0x17]
mov rax, rdi
test r9b, r9b
jns 0x14021b120
mov rax, qword [rdi]
mov r9, qword [rdi + 8]
add r9, r9
test r9, r9
je 0x14021b142
movzx ecx, word [rax + r9 - 2]
add r9, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x14021b13c
cmp ecx, 0x2f
jne 0x14021b123
cmp r9, 0xfffffffffffffffe
jne 0x14021b1c1
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14021b17b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
je 0x14021b223
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.14021b280
xor edi, edi
cmp byte [rsp + 0x57], 0
jns 0x14021b1a7
mov rcx, qword [rsp + 0x40]
call fcn.1403336f4
jmp 0x14021b1a7
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14021b280
mov dil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140334bf0
mov eax, edi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
sar r9, 1
lea rax, [rsp + 0x67]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x28]
mov rdx, rdi
xor r8d, r8d
call fcn.1402027d0
cmp byte [rsp + 0x57], 0
jns 0x14021b1ef
mov rcx, qword [rsp + 0x40]
call fcn.1403336f4
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rcx], xmm0
call fcn.14021b0a0
test al, al
jne 0x14021b142
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.14021b280
jmp 0x14021b179
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rsi
call fcn.14036ecf0
cmp byte [r14 + 0x17], 0
jns 0x14021b23f
mov r14, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
setne al
and ebp, 0x10
shr ebp, 4
and bpl, al
cmp byte [rsp + 0x3f], 0
jns 0x14021b26a
mov rcx, qword [rsp + 0x28]
call fcn.1403336f4
test bpl, bpl
je 0x14021b167
jmp 0x14021b17b
Function at 0x14021b280
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.1402ffc30
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x14041ef10]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.140337be4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140334bf0
nop
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14021dae0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test r9, r9
jne 0x14021dc50
lea rdi, [rsp + 0x70]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r15, [rsp + 0x60]
lea rbx, [rsi + 0x108]
lea r12, [rsi + 0xf8]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov r8, rsi
call qword [case.0x1403339d6.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r15
mov r8, rsi
call qword [case.0x1403339d6.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [case.0x1403339d6.0]
xor eax, eax
mov cl, byte [r14 + rax]
xor byte [rsp + rax + 0x50], cl
inc rax
cmp rax, 0x30
jne 0x14021dbc6
mov eax, dword [0x14041f744]
lea rcx, [rsp + 0x50]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x14021dc90
call fcn.140035320
lea rax, [0x140033e20]
test r12, r12
je 0x14021dc10
lea rcx, [0x1400330c0]
mov qword [r12], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140334bf0
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor edi, edi
cmp r9, 0x30
ja 0x14021dc2d
movups xmm1, xmmword [r14]
movups xmm2, xmmword [r14 + 0x10]
movups xmm3, xmmword [r14 + 0x20]
lea r14, [rsp + 0x20]
movaps xmmword [r14 + 0x20], xmm3
movaps xmmword [r14 + 0x10], xmm2
movaps xmmword [r14], xmm1
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r9, rax
jne 0x14021dc7b
jmp 0x14021db27
bt eax, 9
jae 0x14021dcb7
call fcn.140036410
lea rax, [0x1400368e0]
test r12, r12
je 0x14021dc10
lea rcx, [0x1400365e0]
jmp 0x14021dc0c
call fcn.14038ed40
lea rax, [0x14038f270]
test r12, r12
je 0x14021dc10
lea rcx, [0x14038ec00]
jmp 0x14021dc0c
Function at 0x14021e5f0
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x14021e809
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x14040e870], rax
jne 0x14021e80c
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.140317ab0
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14021e7cb
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x14021e764
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14021e75d
lea rdx, [rsi + 0x48]
bswap rcx
mov r14d, dword [rdx + r12*8 + 0x18]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x14021e7d8
mov edx, ecx
and edx, 0x1fc000
je 0x14021e7d8
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.14031b710
mov ecx, dword [0x14041f758]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x14041b3b4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x150], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140334bf0
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x14021e6be
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.140325f10
test rax, rax
je 0x14021e80f
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x14021e6d8
mov rcx, rbx
call fcn.14031c380
jmp 0x14021e66e
movaps xmm0, xmmword [0x1403df810]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.14038ce40
mov rcx, rsi
call fcn.1401f1190
mov rcx, r14
call fcn.14021e830
int3
int3
xor edi, edi
jmp 0x14021e702
Function at 0x14021fb70
Capabilities:
Initialize winsock library

Disassembly:
push rsi
sub rsp, 0x1c0
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov rax, qword [0x14041f7d0]
cmp rax, 1
jbe 0x14021fbb1
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140334bf0
nop
add rsp, 0x1c0
pop rsi
ret
lea rcx, [0x14041f7d0]
call fcn.140214260
test al, al
je 0x14021fc08
lea rsi, [rsp + 0x20]
mov r8d, 0x198
mov rcx, rsi
mov dl, 0xaa
call fcn.1403369a0
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14021fbed
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x14041f7d8]
lea rcx, [0x14041f7d0]
xor r8d, r8d
mov r9, rcx
call fcn.140214320
jmp 0x14021fb97
mov rax, qword [0x14041f7d0]
jmp 0x14021fb97
Function at 0x1402221f0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x14041f880]
test rax, rax
jne 0x140222234
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x14041f880]
test rax, rax
je 0x140222221
cmp eax, 2
jne 0x140222282
mov ecx, 2
call fcn.140317c40
test al, al
je 0x1402222db
lea rdx, str........._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8e
mov r9d, 2
call fcn.140212ee0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x14022233d
mov eax, 1
lock xadd qword [0x14041f8b8], rax
test rax, rax
jle 0x1402222a2
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14041f838], eax
mov qword [0x14041f830], rsi
mov rcx, qword [0x14041a908]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140317c40
test al, al
jne 0x14022230b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140334bf0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
lea rdx, str........._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xba
mov r9d, 2
call fcn.140212ee0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.14036f000
mov rcx, rsi
call fcn.1402133d0
jmp 0x1402222db
Function at 0x14022c2b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14041af00]
cmp ecx, 0xffffffff
je 0x14022c2d2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14022c2d7
call fcn.14022c3f0
mov eax, dword [0x1404246b0]
mov ecx, dword [0x14041b3b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14022c387
mov rbx, qword [0x1404246a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14022c3cd
mov rax, qword [0x140422e90]
inc rax
xor ecx, ecx
lea rdx, [0x140422ea0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14022c3da
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1404246a0]
inc ecx
mov dword [0x1404246a0], ecx
mov dword [rax + 0x14], ecx
mov qword [0x140422e90], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14022c3ec
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1404246b0]
call fcn.1403338a0
cmp dword [0x1404246b0], 0xffffffff
jne 0x14022c2fc
mov ecx, 8
call fcn.1403336b8
mov rbx, rax
mov rcx, rax
call fcn.14030c2e0
mov qword [0x1404246a8], rbx
lea rcx, [0x1404246b0]
call fcn.140333938
jmp 0x14022c2fc
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14022c314
inc rcx
cmp rcx, 0x100
jne 0x14022c327
jmp 0x14022c36d
int3

Function at 0x14022c3f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.140334b80
sub rsp, rax
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x14041af00]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x14022c48c
lea rcx, [rsp + 0x2c]
call fcn.14023fb50
test al, al
je 0x14022c507
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x14022c46e
lea rcx, [rsp + 0x2c]
call fcn.14023fb50
test al, al
je 0x14022c50a
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14022c50a
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x14041af00], ecx
je 0x14022c48c
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14041af00]
mov dword [rsp + 0x2c], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14022c504
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1403369a0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14033372c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140336540
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140334bf0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
int3
int3
int3