joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401225c0
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx ebp, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov r15, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r15
mov r14d, eax
movzx r13d, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call r15
mov word [rsp + 0x3e], ax
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.140173760
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.140122860
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401226c6
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1401226c6
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x1401226c6
dec r8d
mov rcx, rsi
call fcn.1401228f0
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.140173760
movzx eax, r14w
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.140122860
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140122747
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140122747
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140122692
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140173760
mov qword [rsp + 0x30], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.140122860
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401227cb
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1401227cb
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140122692
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140173760
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.140122860
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140122850
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140122850
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140122692
xor esi, esi
jmp 0x1401226a0
Function at 0x140123060
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov esi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x60]
mov qword [r15 + 0x50], rax
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, [0x14030a131]
lea r8, str....._base_files_file_util_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x44c
call fcn.14004f270
xor edi, edi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.1400cd290
cmp byte [r14 + 0x17], 0
jns 0x1401230f9
mov r14, qword [r14]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, r14
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140123150
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp r14, 0xffffffffffffffff
je 0x1401231f8
call fcn.1400412c0
mov rdi, r14
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, 0xffffffff
test esi, esi
js 0x1401231a0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1401231a0
lea r14, [rsp + 0x40]
mov dword [r14], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [r14]
xor edx, edx
cmp eax, 1
sbb edx, edx
cmp ecx, esi
mov ebp, 0xffffffff
cmove ebp, ecx
or ebp, edx
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1401231ca
call fcn.1400412c0
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x1401231ff
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
lea rcx, [rsp + 0x60]
call fcn.1400cd300
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140171860
mov eax, ebp
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor edi, edi
jmp 0x140123148
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x1401231bb
Function at 0x140126ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140126efd
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [case.0x140211850.0]
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rcx, qword [r9 + 0x30]
lock inc dword [rcx + 8]
lea rax, [0x140351d80]
mov qword [rbp - 0x20], rax
lea rax, [0x1401ffdd0]
mov qword [rbp - 0x18], rax
mov rax, qword [0x140351d80]
cmp rax, 0xffffffffffffffff
jne 0x140127037
movsxd rax, dword [0x140351d88]
lea rdx, [rax - 1]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
sub r8, r9
sar r8, 3
cmp r8, rdx
jbe 0x14012702e
mov r14, qword [r9 + rax*8 - 8]
test r14, r14
je 0x14012702e
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
je 0x140127069
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [case.0x140211850.0]
mov al, byte [rbx + 0x17]
test al, al
mov rcx, qword [rbx]
mov r14, rbx
cmovs r14, rcx
mov rdx, rbx
test al, al
cmovs rdx, rcx
js 0x140126ffc
movzx eax, al
add rdx, rax
cmp r14, rdx
je 0x140126ff4
test rdi, rdi
je 0x14012702a
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140127012
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
inc r14
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
jmp 0x140126fb6
mov qword [rsi], rdi
jmp 0x140126eed
add rdx, qword [rbp - 0x18]
cmp r14, rdx
jne 0x140126fcc
mov qword [rsi], rdi
call fcn.14016eccc
jmp 0x140126eed
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [case.0x140211850.0]
cmp eax, 0xffffffff
jne 0x140126fe8
xor edi, edi
jmp 0x140126fe8
mov qword [rbp - 8], rcx
call fcn.1401c8d43
mov qword [rbp - 8], rcx
lea rax, [rbp - 0x20]
lea rcx, [rbp - 0x30]
mov qword [rcx], rax
lea rdx, [rbp - 0x28]
mov qword [rdx], rcx
lea rcx, [0x140351d80]
lea r8, [0x1400a53e0]
call fcn.14006e3ba
mov rcx, qword [rbp - 8]
jmp 0x140126f2c
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140211850.0]
jmp 0x140126f6f
Function at 0x140129a80
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x60]
mov qword [r15 + 0x50], rax
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, [0x14030a128]
lea r8, str....._base_files_file_util_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x439
call fcn.14004f270
xor esi, esi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.1400cd290
cmp byte [r14 + 0x17], 0
jns 0x140129b19
mov r14, qword [r14]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0x80000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140129b69
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp r14, 0xffffffffffffffff
jne 0x140129bb4
xor esi, esi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, 0xffffffff
test edi, edi
js 0x140129b7c
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140129bbe
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140129bf3
lea rcx, [rsp + 0x60]
call fcn.1400cd300
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140171860
mov eax, ebp
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400412c0
mov rsi, r14
jmp 0x140129b61
lea r9, [rsp + 0x40]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140129c18
mov ebp, dword [rsp + 0x40]
test ebp, ebp
jns 0x140129b7c
int3
call fcn.1400412c0
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x140129c22
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [case.0x140211850.0]
jmp 0x140129b86
mov ebp, 0xffffffff
jmp 0x140129b7c
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x140129c04

Function at 0x140129ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.HasValue
lea r8, str....._basewin_registry.cc
lea rcx, [rsp + 0x38]
mov r9d, 0x100
call fcn.14004f270
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140171860
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140129f30
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.DeleteValue
lea r8, str....._basewin_registry.cc
lea rcx, [rsp + 0x20]
mov r9d, 0x152
call fcn.14004f270
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14012a0a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rcx]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14012a1c2
mov rdi, rcx
cmp dword [rcx + 8], 1
jne 0x14012a1c6
mov qword [rdi], 0
call fcn.1400412c0
test rsi, rsi
je 0x14012a0ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400412c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x38]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 5
mov rcx, rax
mov rdx, rsi
mov r8, rax
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, eax
test eax, eax
je 0x14012a180
mov r15, qword [rsp + 0x38]
cmp qword [rdi], r15
je 0x14012a179
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14012a1c9
lea rax, [r15 + 1]
cmp rax, 2
jb 0x14012a171
mov qword [rdi], r15
call fcn.1400412c0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rdi + 8], 0
test ebx, ebx
setne dil
call fcn.1400412c0
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14012a1f8
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [case.0x140211850.0]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140171860
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
jmp 0x14012a1a6
int3
call fcn.1400412c0
mov r14, qword [rdi]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14012a206
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x140211850.0]
mov qword [rdi], 0
jmp 0x14012a15f
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14012a197
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14012a1dd
Function at 0x14012d780
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movabs rax, 0xffffffff00000000
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14012d906
cmp dword [rsi + 0x10], 0
jne 0x14012d8f4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x10], eax
mov eax, dword [0x14035d320]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14012d81e
lea rcx, [0x14035d320]
call fcn.14016f8b4
cmp dword [0x14035d320], 0xffffffff
jne 0x14012d81e
xorps xmm0, xmm0
movups xmmword [0x14035d310], xmm0
lea rcx, [0x14035d310]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035d320]
call fcn.14016ef8c
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x14012d85b
mov rdx, qword [0x14035d310]
shl rdx, 4
mov r8d, dword [rax + rdx + 8]
cmp r8d, dword [0x14035d318]
jne 0x14012d85b
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14012d913
mov dword [rsi + 0x14], ecx
mov eax, dword [0x14035d308]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14012d8b8
lea rcx, [0x14035d308]
call fcn.14016f8b4
cmp dword [0x14035d308], 0xffffffff
jne 0x14012d8b8
xorps xmm0, xmm0
movups xmmword [0x14035d2f8], xmm0
lea rcx, [0x14035d2f8]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035d308]
call fcn.14016ef8c
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x14012d8f1
mov rdx, qword [0x14035d2f8]
shl rdx, 4
mov r8d, dword [rax + rdx + 8]
cmp r8d, dword [0x14035d300]
jne 0x14012d8f1
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14012d91a
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rax, rsi
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
call fcn.140047ff0
jmp 0x14012d7b1
mov ecx, dword [rax]
jmp 0x14012d85b
mov ecx, dword [rax]
jmp 0x14012d8f1

Function at 0x14012f5e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403411e0]
cmp ecx, 0xffffffff
je 0x14012f605
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14012f600
Function at 0x14012f610
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14035ab10]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14012f66f
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14012f66b
mov rcx, qword [0x14035ab00]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035ab08]
jne 0x14012f66b
cmp qword [rax + rcx], 0
setne al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14012f666
lea rcx, [0x14035ab10]
call fcn.14016f8b4
cmp dword [0x14035ab10], 0xffffffff
jne 0x14012f635
xorps xmm0, xmm0
movups xmmword [0x14035ab00], xmm0
lea rcx, [0x14035ab00]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035ab10]
call fcn.14016ef8c
jmp 0x14012f635

Function at 0x14013004a
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140130081
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140130081
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140130081
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x140130080

Function at 0x140130b80
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
cmp dword [rcx + 0xb78], 0x8000
jne 0x140130c4f
mov rsi, rcx
cmp dword [rcx + 0x3f8], 0x200
jne 0x140130c52
lea rcx, [0x140342940]
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140130c55
cmp byte [0x1403590a8], 0
je 0x140130c66
lea rcx, [0x140342940]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg qword [0x1403590b0], rsi
jne 0x140130ca1
lea rax, [0x140130cb0]
mov qword [0x14035bdd8], rax
add rsi, 0x48
xor eax, eax
lea rcx, [0x140359060]
cmp qword [rsi], 0
je 0x140130c4b
mov edx, dword [rsi + 0x18]
cmp edx, 0x81
jb 0x140130c41
cmp edx, 0x101
jb 0x140130c3d
cmp edx, 0x201
setb dl
shl dl, 4
add dl, 0x10
mov byte [rax + rcx], dl
inc rax
add rsi, 0x28
cmp rax, 0x48
jne 0x140130c03
jmp 0x140130c45
mov dl, 0x40
jmp 0x140130c2b
mov dl, 0x80
jmp 0x140130c2b
add rsp, 0x20
pop rsi
ret
xor edx, edx
jmp 0x140130c2b
int3
int3
lea rcx, [0x140342940]
call fcn.14004f6b0
jmp 0x140130bbd
cmp qword [0x14035bdc8], 0
jne 0x140130ca4
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140130ca7
mov dword [0x140359058], eax
mov dword [0x14035bdd0], eax
lea rax, [0x14006e010]
mov qword [0x14035bdc8], rax
mov byte [0x1403590a8], 1
jmp 0x140130bca
int3
int3
int3
Function at 0x140133940
Capabilities:
Allocate thread local storage

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x14013396c
mov rcx, rsi
call fcn.14004f6b0
cmp byte [rdi + 0x1470], 0
je 0x14013398c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
call fcn.1400db6b0
cmp byte [rbx], 1
sete byte [rdi + 4]
cmp byte [rbx + 3], 1
sete byte [rdi + 5]
mov al, byte [rbx + 4]
cmp al, 1
sete byte [rdi + 6]
cmp byte [rbx + 5], 1
sete byte [rdi + 7]
jne 0x1401339bb
cmp al, 1
jne 0x140133b2f
cmp byte [rbx + 6], 1
jne 0x1401339e1
cmp qword [0x1403428d0], 0xffffffffffffffff
setne byte [rdi + 8]
je 0x1401339e5
cmp al, 1
je 0x140133b38
mov qword [rdi + 0xc], 0
jmp 0x1401339f8
mov byte [rdi + 8], 0
mov qword [rdi + 0xc], 0
cmp al, 1
jne 0x1401339f8
mov dword [rdi + 0xc], 4
cmp byte [rbx + 2], 0
setne byte [rdi]
xorps xmm0, xmm0
movups xmmword [rdi + 0x1448], xmm0
movups xmmword [rdi + 0x1458], xmm0
mov qword [rdi + 0x1468], 0
call fcn.1400432a0
mov qword [rdi + 0x1448], rax
mov rax, rdi
not rax
mov qword [rdi + 0x1920], rax
lea r14, [rdi + 0x48]
mov edx, 0x10
xor r15d, r15d
lea r12, [0x140308e80]
mov rcx, r14
call fcn.140043180
mov rdx, qword [r12 + r15*8 + 8]
inc r15
add r14, 0x28
cmp rdx, 1
jne 0x140133a47
cmp r15, 0x7f
ja 0x140133a8b
dec r15
mov rcx, r14
mov edx, 1
call fcn.140043180
mov qword [r14], 0
inc r15
add r14, 0x28
cmp r15, 0x7f
jb 0x140133a6a
lea rcx, [0x140342940]
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x140133aa8
lea rcx, [0x140342940]
call fcn.14004f6b0
cmp byte [0x1403590a8], 0
jne 0x140133ae7
cmp qword [0x14035bdc8], 0
jne 0x140133b32
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140133b35
mov dword [0x140359058], eax
mov dword [0x14035bdd0], eax
lea rax, [0x14006e010]
mov qword [0x14035bdc8], rax
mov byte [0x1403590a8], 1
lea rcx, [0x140342940]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp byte [rbx + 1], 1
sete byte [rdi + 3]
jne 0x140133b06
mov rcx, rdi
call fcn.140130b80
mov bl, 1
mov byte [rdi + 0x1470], bl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg byte [0x140359054], bl
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
int3
int3
int3
Function at 0x140135540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 1
call fcn.140135590
movzx edx, bl
mov rcx, qword [rax]
mov r8, qword [rcx + 0x28]
lea rcx, [0x1400ab550]
cmp r8, rcx
jne 0x14013557b
mov rcx, qword [rax + 0x18]
mov r8d, 1
add rsp, 0x20
pop rbx
jmp fcn.1400a0920
mov r9, qword [case.0x140211850.0]
mov rcx, rax
mov rax, r8
add rsp, 0x20
pop rbx
jmp r9
mov edx, ecx
lea rcx, str.Microsoft.WatsonUploader.DeviceTicketResult
jmp 0x140135540

Function at 0x140136f00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rcx, qword [rcx + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
lea rdx, [0x1401370c0]
cmp rax, rdx
jne 0x1401370a1
cmp qword [rsi + 0x48], 0
jne 0x140137013
mov eax, dword [0x14035c0b0]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14013701d
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140136f93
mov rcx, qword [0x14035c0a0]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035c0a8]
jne 0x140136f93
mov rax, qword [rax + rcx]
test rax, rax
je 0x140136f93
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x70], rcx
mov eax, dword [rax + 8]
mov dword [rsi + 0x68], eax
mov eax, dword [0x14035c080]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14013705f
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140137013
mov rcx, qword [0x14035c070]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035c078]
jne 0x140137013
mov rax, qword [rax + rcx]
test rax, rax
je 0x140137013
mov rcx, qword [rax + 0x20]
mov qword [rsi + 0x48], rcx
movups xmm0, xmmword [rax + 0x48]
mov rcx, qword [rax + 0x58]
mov qword [rsi + 0x60], rcx
movups xmmword [rsi + 0x50], xmm0
cmp byte [rax + 0x7c], 0
jne 0x140137019
cmp qword [rax + 0x60], 0
setne al
mov byte [rsi + 0x7c], al
add rsp, 0x20
pop rsi
ret
mov al, 1
jmp 0x140137010
lea rcx, [0x14035c0b0]
call fcn.14016f8b4
cmp dword [0x14035c0b0], 0xffffffff
jne 0x140136f53
xorps xmm0, xmm0
movups xmmword [0x14035c0a0], xmm0
lea rcx, [0x14035c0a0]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035c0b0]
call fcn.14016ef8c
jmp 0x140136f53
lea rcx, [0x14035c080]
call fcn.14016f8b4
cmp dword [0x14035c080], 0xffffffff
jne 0x140136fb8
xorps xmm0, xmm0
movups xmmword [0x14035c070], xmm0
lea rcx, [0x14035c070]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035c080]
call fcn.14016ef8c
jmp 0x140136fb8
mov r8, qword [case.0x140211850.0]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp r8
Function at 0x140143310
Capabilities:
Get file size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], r15
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xae
call fcn.14004f270
xor ebx, ebx
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.1400cd290
mov qword [r14], r15
mov rcx, qword [rdi]
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rbx, rbx
or rbx, qword [rdi]
mov rcx, rsi
call fcn.1400cd300
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140171860
mov rax, rbx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret