joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001af90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1402a6208]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001affd
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x14001aff2
mov rdx, qword [0x1402a61f8]
shl rdx, 4
mov r8d, dword [rax + rdx + 8]
cmp r8d, dword [0x1402a6200]
jne 0x14001aff2
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14001b047
mov dword [rsi], ecx
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402a6208]
call fcn.14017b2bc
cmp dword [0x1402a6208], 0xffffffff
jne 0x14001afb9
mov qword [0x1402a6200], 0
lea rcx, [0x1402a61f8]
mov qword [0x1402a61f8], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a6208]
call fcn.14017b25c
jmp 0x14001afb9
mov ecx, dword [rax]
jmp 0x14001aff2

Function at 0x14001b050
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [rcx + 0x10], 0
je 0x14001b080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14017e7b0
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x10], eax
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.14001af90
mov eax, dword [rdi]
mov dword [rsi + 0x14], eax
mov eax, dword [0x1402a61f0]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001b104
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x14001b0f8
mov rdx, qword [0x1402a61e0]
shl rdx, 4
mov r8d, dword [rax + rdx + 8]
cmp r8d, dword [0x1402a61e8]
jne 0x14001b0f8
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14001b100
mov dword [rsi + 0x18], ecx
jmp 0x14001b06b
mov ecx, dword [rax]
jmp 0x14001b0f8
lea rcx, [0x1402a61f0]
call fcn.14017b2bc
cmp dword [0x1402a61f0], 0xffffffff
jne 0x14001b0bf
mov qword [0x1402a61e8], 0
lea rcx, [0x1402a61e0]
mov qword [0x1402a61e0], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a61f0]
call fcn.14017b25c
jmp 0x14001b0bf
Function at 0x14001c480
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14017e750
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401808d0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c541
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14001c545
lea rdi, [rsp + 0x840]
mov rcx, rdi
call fcn.14017bd98
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14001c5a0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14017e7b0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14001c522
cmp eax, 2
jne 0x14001c590
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401808d0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14001c597
lea rdi, [rsp + 0x40]
jmp 0x14001c50a
mov edi, 0x3f4
jmp 0x14001c522
mov edi, 0xea
jmp 0x14001c522

Function at 0x14001e690
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x14001e6dc
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14001e6e7
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14001e6ca
mov qword [rdi], rsi
call fcn.140105b90
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140105b90
mov r14, qword [rdi]
cmp qword [0x1402a45d0], 0
je 0x14001e718
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401e7f70.0]
mov qword [rdi], 0
jmp 0x14001e6b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14027d081]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001e759
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14001e753
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
call fcn.140005a10
jmp 0x14001e6f9
xor ecx, ecx
mov dl, 1
jmp 0x14001e74c
xor ecx, ecx
jmp 0x14001e74a
Function at 0x14001e760
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xb0]
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x48], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14017b1d8
mov rsi, rax
mov qword [rax], r15
test r14, r14
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x1400c8130]
xor ecx, ecx
mov rdx, rbx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14001e7ef
test r14, r14
je 0x14001e85f
mov qword [r14], rdi
jmp 0x14001e868
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14001e88c
mov ebp, eax
cmp eax, 0x5af
je 0x14001e88c
cmp ebp, 0xe
je 0x14001e88c
mov eax, dword [0x1402a270c]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001e894
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, ebp
call fcn.1400c7110
cmp byte [rbx + 0x17], 0
jns 0x14001e850
mov rcx, qword [rsp + 0x30]
call fcn.14017b254
test rsi, rsi
je 0x14001e868
mov rcx, rsi
call fcn.14017b254
jmp 0x14001e868
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017e7b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rbx
call fcn.1401eaa70
lea rcx, [0x1402a270c]
call fcn.14017b2bc
cmp dword [0x1402a270c], 0xffffffff
jne 0x14001e831
lea rcx, [0x1402a270c]
call fcn.14017b25c
jmp 0x14001e831
Function at 0x140021210
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x14002123c
call fcn.140105b90
mov qword [rsi], 0
test r15, r15
je 0x140021272
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400212a2
cmp r12, 2
jb 0x14002126a
mov qword [rsi], r15
call fcn.140105b90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.1401567f0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140105b90
mov r14, qword [rsi]
cmp qword [0x1402a45d0], 0
je 0x1400212d3
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401e7f70.0]
mov qword [rsi], 0
jmp 0x14002125c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14027d081]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140021314
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14002130e
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
call fcn.140005a10
jmp 0x1400212b4
xor ecx, ecx
mov dl, 1
jmp 0x140021307
xor ecx, ecx
jmp 0x140021305
Function at 0x140023410
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
call qword [case.0x1401e7f70.0]
mov byte [rsi + 0x429], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [case.0x1401e7f70.0]
test rax, rax
je 0x1400234a4
mov eax, dword [0x1402a44f8]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400234aa
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400234f4
mov rcx, qword [0x1402a44e8]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1402a44f0]
mov rdx, qword [0x1402a44e8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402a44f8]
call fcn.14017b2bc
cmp dword [0x1402a44f8], 0xffffffff
jne 0x14002346e
mov qword [0x1402a44f0], 0
lea rcx, [0x1402a44e8]
mov qword [0x1402a44e8], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a44f8]
call fcn.14017b25c
jmp 0x14002346e
test rsi, rsi
je 0x1400234a4
call fcn.140002990
jmp 0x140023480
Function at 0x140026eb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r15, r8
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x160]
mov qword [rcx + 0x180], 0
xorps xmm0, xmm0
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x40], xmm0
cmp r9, 0xc
jne 0x140026f30
mov eax, dword [r15 + 8]
mov dword [rsi + 8], eax
mov rax, qword [r15]
mov qword [rsi], rax
mov byte [rsi + 0xf], 1
mov ebx, 2
mov rax, qword [rsi + 0x170]
lea rdx, [rsi + 0x20]
mov rcx, rsi
mov r8, rdi
call qword [case.0x1401e7f70.0]
bswap ebx
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, r9
cmp r9, 0x10
jb 0x140026fd5
lea r12, [rsi + 0x60]
mov r13, r14
mov al, byte [r15]
xor byte [rsi], al
mov al, byte [r15 + 1]
xor byte [rsi + 1], al
mov al, byte [r15 + 2]
xor byte [rsi + 2], al
mov al, byte [r15 + 3]
xor byte [rsi + 3], al
mov al, byte [r15 + 4]
xor byte [rsi + 4], al
mov al, byte [r15 + 5]
xor byte [rsi + 5], al
mov al, byte [r15 + 6]
xor byte [rsi + 6], al
mov al, byte [r15 + 7]
xor byte [rsi + 7], al
mov al, byte [r15 + 8]
xor byte [rsi + 8], al
mov al, byte [r15 + 9]
xor byte [rsi + 9], al
mov al, byte [r15 + 0xa]
xor byte [rsi + 0xa], al
mov al, byte [r15 + 0xb]
xor byte [rsi + 0xb], al
mov al, byte [r15 + 0xc]
xor byte [rsi + 0xc], al
mov al, byte [r15 + 0xd]
xor byte [rsi + 0xd], al
mov al, byte [r15 + 0xe]
xor byte [rsi + 0xe], al
mov al, byte [r15 + 0xf]
xor byte [rsi + 0xf], al
mov rcx, rsi
mov rdx, r12
mov rax, rbx
call qword [case.0x1401e7f70.0]
add r15, 0x10
add r13, 0xfffffffffffffff0
cmp r13, 0xf
ja 0x140026f44
jmp 0x140026fd8
mov r13, r14
test r13, r13
je 0x140026ffe
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsi + rax], cl
inc rax
cmp r13, rax
jne 0x140026fdf
lea rdx, [rsi + 0x60]
mov rcx, rsi
mov rax, rbx
call qword [case.0x1401e7f70.0]
shl r14, 3
bswap r14
xor qword [rsi + 8], r14
lea rdx, [rsi + 0x60]
mov rcx, rsi
mov rax, rbx
call qword [case.0x1401e7f70.0]
mov ebx, dword [rsi + 0xc]
bswap ebx
inc ebx
jmp 0x140026f04
Function at 0x14002b310
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, qword [0x1402a0c90]
test rdi, rdi
jne 0x14002b414
mov ecx, 0x50
call fcn.14017b1d8
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.14017b1d8
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14002b439
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x1402a0c90], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14002b43c
mov rcx, rax
call fcn.14017bd98
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14002b450
mov rcx, qword [0x1402a0c90]
xor eax, eax
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x10], rax
xorps xmm0, xmm0
movaps xmmword [rsi], xmm0
lea r8, [rsp + 0x58]
mov qword [r8], rsi
mov qword [r8 + 8], rax
lea rax, [0x140275190]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 0xa
call fcn.14002bff0
cmp byte [rsi + 0x17], 0
js 0x14002b43f
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14017e7b0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
int3
int3
mov rcx, qword [rsp + 0x40]
call fcn.14017b254
jmp 0x14002b414
Function at 0x140030400
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1402a0d88]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003046b
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400304b5
mov rcx, qword [0x1402a0d78]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402a0d80]
jne 0x1400304b5
mov rax, qword [rax + rcx]
test rax, rax
je 0x1400304b5
mov rcx, qword [rax + 0x10]
sub rcx, qword [rax + 8]
cmp rcx, 9
setae al
add rsp, 0x28
ret
lea rcx, [0x1402a0d88]
call fcn.14017b2bc
cmp dword [0x1402a0d88], 0xffffffff
jne 0x140030425
mov qword [0x1402a0d80], 0
lea rcx, [0x1402a0d78]
mov qword [0x1402a0d78], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a0d88]
call fcn.14017b25c
jmp 0x140030425
xor eax, eax
jmp 0x140030466
Function at 0x140032860
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x140032875
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov eax, dword [0x1402a0e38]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140032945
lea rdi, [rsi + 8]
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400329e1
mov rcx, qword [0x1402a0e28]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x1402a0e30]
mov rdx, qword [0x1402a0e28]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x1402a4570]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140032993
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400329f4
mov rcx, qword [0x1402a4560]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1402a4568]
mov rdx, qword [0x1402a4560]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402a0e38]
call fcn.14017b2bc
cmp dword [0x1402a0e38], 0xffffffff
jne 0x14003289e
mov qword [0x1402a0e30], 0
lea rcx, [0x1402a0e28]
mov qword [0x1402a0e28], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a0e38]
call fcn.14017b25c
jmp 0x14003289e
lea rcx, [0x1402a4570]
call fcn.14017b2bc
cmp dword [0x1402a4570], 0xffffffff
jne 0x140032901
mov qword [0x1402a4568], 0
lea rcx, [0x1402a4560]
mov qword [0x1402a4560], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a4570]
call fcn.14017b25c
jmp 0x140032901
test rdi, rdi
je 0x1400328dc
call fcn.140002990
jmp 0x1400328b8
test rsi, rsi
je 0x14003293b
call fcn.140002990
jmp 0x140032917
Function at 0x1400334d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.140033680
test al, al
jne 0x1400335ab
call fcn.1400335c0
movzx edx, al
mov ecx, esi
call fcn.140033740
mov eax, dword [0x1402a45c8]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140033556
movsxd rsi, esi
inc rsi
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003359f
mov rcx, qword [0x1402a45b8]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1402a45c0]
mov rdx, qword [0x1402a45b8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402a45c8]
call fcn.14017b2bc
cmp dword [0x1402a45c8], 0xffffffff
jne 0x140033514
mov qword [0x1402a45b8], 0xffffffffffffffff
lea rcx, [0x1402a45b8]
mov dword [0x1402a45c0], 0
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a45c8]
call fcn.14017b25c
jmp 0x140033514
test rsi, rsi
je 0x140033550
call fcn.140002990
jmp 0x14003352c
mov edx, 3
jmp 0x1400334ec

Function at 0x1400335c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1402a44f8]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140033627
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140033623
mov rcx, qword [0x1402a44e8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402a44f0]
jne 0x140033623
mov rax, qword [rax + rcx]
test rax, rax
je 0x140033623
cmp dword [rax + 0x38], 1
sete al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14003361e
lea rcx, [0x1402a44f8]
call fcn.14017b2bc
cmp dword [0x1402a44f8], 0xffffffff
jne 0x1400335e5
mov qword [0x1402a44f0], 0
lea rcx, [0x1402a44e8]
mov qword [0x1402a44e8], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a44f8]
call fcn.14017b25c
jmp 0x1400335e5

Function at 0x140033680
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1402a44f8]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400336e7
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400336d7
mov rcx, qword [0x1402a44e8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402a44f0]
jne 0x1400336d7
mov rax, qword [rax + rcx]
test rax, rax
jne 0x1400336de
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x38], 3
sete al
jmp 0x1400336d9
lea rcx, [0x1402a44f8]
call fcn.14017b2bc
cmp dword [0x1402a44f8], 0xffffffff
jne 0x1400336a5
mov qword [0x1402a44f0], 0
lea rcx, [0x1402a44e8]
mov qword [0x1402a44e8], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a44f8]
call fcn.14017b25c
jmp 0x1400336a5
Function at 0x1400395c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x1400395ef
test r8d, r8d
jne 0x1400395e8
lea rcx, [0x1402a5060]
lea rdx, [0x1400d3090]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.140039600
Function at 0x14003ca90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rax, [0x14026c090]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1402a6220]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003cb42
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003cbda
mov rcx, qword [0x1402a6210]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402a6218]
jne 0x14003cbda
mov rax, qword [rax + rcx]
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x14003cbe7
mov eax, dword [0x1402a6220]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003cb90
lea rcx, [0x1402a6210]
mov rdx, rsi
call fcn.1400fca60
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402a6220]
call fcn.14017b2bc
cmp dword [0x1402a6220], 0xffffffff
jne 0x14003cac7
mov qword [0x1402a6218], 0
lea rcx, [0x1402a6210]
mov qword [0x1402a6210], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a6220]
call fcn.14017b25c
jmp 0x14003cac7
lea rcx, [0x1402a6220]
call fcn.14017b2bc
cmp dword [0x1402a6220], 0xffffffff
jne 0x14003cb2a
mov qword [0x1402a6218], 0
lea rcx, [0x1402a6210]
mov qword [0x1402a6210], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a6220]
call fcn.14017b25c
jmp 0x14003cb2a
mov qword [rsi + 0x10], 0
jmp 0x14003cb09
xor ecx, ecx
call fcn.14003d620
jmp 0x14003cb09
Function at 0x14003d2d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, edx
mov rsi, rcx
mov eax, dword [0x1402a0d88]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003d3ef
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003d48e
mov rcx, qword [0x1402a0d78]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402a0d80]
jne 0x14003d48e
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov dword [rsi + 0x10], edi
mov dword [rsi + 0x14], 0
mov byte [rsi + 0x18], 1
mov eax, dword [0x1402a4570]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003d43d
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003d48b
mov rcx, qword [0x1402a4560]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402a4568]
jne 0x14003d48b
mov rax, qword [rax + rcx]
test rax, rax
je 0x14003d48b
mov rax, qword [rax]
mov qword [rsi + 0x20], rax
test rax, rax
je 0x14003d3b9
lock inc dword [rax + 8]
mov ecx, 8
call fcn.14017b1d8
mov dword [rax], 0
mov byte [rax + 4], 0
mov qword [rsi + 0x28], rax
test rax, rax
je 0x14003d3d9
lock inc dword [rax]
mov qword [rsi + 0x30], rsi
mov qword [rsi + 8], 0
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1402a0d88]
call fcn.14017b2bc
cmp dword [0x1402a0d88], 0xffffffff
jne 0x14003d300
mov qword [0x1402a0d80], 0
lea rcx, [0x1402a0d78]
mov qword [0x1402a0d78], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a0d88]
call fcn.14017b25c
jmp 0x14003d300
lea rcx, [0x1402a4570]
call fcn.14017b2bc
cmp dword [0x1402a4570], 0xffffffff
jne 0x14003d36b
mov qword [0x1402a4568], 0
lea rcx, [0x1402a4560]
mov qword [0x1402a4560], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a4570]
call fcn.14017b25c
jmp 0x14003d36b
int3
xor eax, eax
jmp 0x14003d335

Function at 0x14003d4a0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
lea rax, str.P:_a_
mov qword [rcx], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x14003d510
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14003d51b
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14003d508
mov qword [rsi + 0x18], rdi
call fcn.140105b90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140105b90
mov rcx, qword [rsi + 0x18]
call fcn.1401651a0
mov qword [rsi + 0x18], 0
jmp 0x14003d4f5
Function at 0x14003d620
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1402a6220]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003d685
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003d6cf
mov rcx, qword [0x1402a6210]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1402a6218]
mov rdx, qword [0x1402a6210]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402a6220]
call fcn.14017b2bc
cmp dword [0x1402a6220], 0xffffffff
jne 0x14003d649
mov qword [0x1402a6218], 0
lea rcx, [0x1402a6210]
mov qword [0x1402a6210], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a6220]
call fcn.14017b25c
jmp 0x14003d649
test rsi, rsi
je 0x14003d67f
call fcn.140002990
jmp 0x14003d65b