joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dfbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x128
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rcx + 8]
test r14, r14
je 0x1400dfd21
add r14, 0xffffffffffffffff
cmp r14, r8
jae 0x1400dfd77
mov rsi, qword [rdx + 8]
cmp rsi, 1
je 0x1400dfd2a
test rsi, rsi
je 0x1400dfd01
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea rdi, [rsi - 1]
mov edx, esi
and edx, 3
cmp rdi, 3
jae 0x1400dfc96
xor edi, edi
jmp 0x1400dfcd0
and rsi, 0xfffffffffffffffc
xor edi, edi
nop dword [rax]
movzx ebx, byte [rax + rdi]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 1]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 2]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 3]
mov byte [rsp + rbx + 0x20], 1
add rdi, 4
cmp rsi, rdi
jne 0x1400dfca0
test rdx, rdx
je 0x1400dfcec
add rax, rdi
xor edi, edi
movzx esi, byte [rax + rdi]
mov byte [rsp + rsi + 0x20], 1
add rdi, 1
cmp rdx, rdi
jne 0x1400dfcda
mov rcx, qword [rcx]
movzx eax, byte [rcx + r14]
cmp byte [rsp + rax + 0x20], 0
jne 0x1400dfd5c
mov rax, r14
mov r14, rax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140106510
mov rax, r14
add rsp, 0x128
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, 0xffffffffffffffff
jmp 0x1400dfd01
mov rax, qword [rdx]
mov al, byte [rax]
mov rdi, qword [rcx]
inc r14
mov rdx, r14
mov cl, byte [rdi + rdx - 1]
lea r14, [rdx - 1]
cmp cl, al
jne 0x1400dfd4d
cmp rdx, 1
mov rdx, r14
jne 0x1400dfd38
cmp cl, al
mov rax, 0xffffffffffffffff
cmove r14, rax
jmp 0x1400dfd01
mov rax, r14
sub rax, 1
jb 0x1400dfd7f
movzx edx, byte [rcx + r14 - 1]
cmp byte [rsp + rdx + 0x20], 0
mov r14, rax
je 0x1400dfcfe
jmp 0x1400dfd5f
mov r14, r8
jmp 0x1400dfbf8
mov rax, 0xffffffffffffffff
jmp 0x1400dfcfe
Function at 0x1400e19b0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x18], 0
je 0x1400e1a71
mov eax, dword [0x14020b220]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e1b0b
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [0x14020b220]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e1b4e
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e1a65
movsxd rcx, dword [0x14020b218]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14020b21c]
movsxd rdx, dword [0x14020b218]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
jne 0x1400e1ad3
mov rdi, qword [rsi]
test rdi, rdi
jne 0x1400e1a91
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140106510
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, qword [rsi + 8]
mov rcx, rdi
cmp r14, rdi
je 0x1400e1ac8
mov rbx, r14
add r14, 0xffffffffffffffc8
lea rcx, [rbx - 0x10]
call fcn.1400eaff0
mov rcx, qword [rbx - 0x38]
test rcx, rcx
je 0x1400e1ac0
lock dec dword [rcx + 8]
je 0x1400e1b91
cmp rdi, r14
jne 0x1400e1a9d
mov rcx, qword [rsi]
mov qword [rsi + 8], rdi
call fcn.1401039b0
jmp 0x1400e1a79
lea r14, [rsp + 0x28]
mov r9, qword [rbx + 0x30]
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rbx + 0x28], 0
mov rax, qword [rcx]
lea rdx, [rbx + 8]
mov r8, r14
call qword [rax]
add rbx, 0x38
cmp rbx, rdi
je 0x1400e1a71
jmp 0x1400e1ad8
lea rcx, [0x14020b220]
call fcn.1401044f8
cmp dword [0x14020b220], 0xffffffff
jne 0x1400e19fa
mov qword [0x14020b218], 0
lea rcx, [0x14020b218]
xor edx, edx
call fcn.140001360
lea rcx, [0x14020b220]
call fcn.140103fa4
jmp 0x1400e19fa
lea rcx, [0x14020b220]
call fcn.1401044f8
cmp dword [0x14020b220], 0xffffffff
jne 0x1400e1a2b
mov qword [0x14020b218], 0
lea rcx, [0x14020b218]
xor edx, edx
call fcn.140001360
lea rcx, [0x14020b220]
call fcn.140103fa4
jmp 0x1400e1a2b
add rcx, 8
add rcx, 0xfffffffffffffff8
call fcn.1400ee000
jmp 0x1400e1ac0
Function at 0x1400e5000
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140207068]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400e5057
jnp 0x1400e50bc
ucomisd xmm0, xmm6
jne 0x1400e5063
jnp 0x1400e51e6
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1401d3a60]
subpd xmm1, xmmword [0x1401d3a70]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1401dbf48]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140106510
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140207078]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e51ed
mov eax, dword [0x140207088]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e5227
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x140207080]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1401d3a60]
subpd xmm1, xmmword [0x1401d3a70]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1401dbf40]
ucomisd xmm2, xmm1
ja 0x1400e5057
shl r15, 0x20
or r14, r15
sub r14, qword [0x140207070]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1401d3a60]
subpd xmm0, xmmword [0x1401d3a70]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x140207068], xmm0
jmp 0x1400e5057
xor eax, eax
jmp 0x1400e5095
lea rcx, [0x140207078]
call fcn.1401044f8
cmp dword [0x140207078], 0xffffffff
jne 0x1400e5106
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140207070], rdx
lea rcx, [0x140207078]
call fcn.140103fa4
jmp 0x1400e5106
lea rcx, [0x140207088]
call fcn.1401044f8
cmp dword [0x140207088], 0xffffffff
jne 0x1400e512b
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x140207080], rax
lea rcx, [0x140207088]
call fcn.140103fa4
jmp 0x1400e512b
Function at 0x1400e5b70
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1400e5bb9
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
add rax, 1
cmp rax, 2
jae 0x1400e5bc2
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400e5ba9
mov qword [rdi], rsi
call fcn.1400c8a40
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400c8a40
mov rcx, qword [rdi]
call fcn.1400e5be0
mov qword [rdi], 0
jmp 0x1400e5b97
Function at 0x1400ef940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm4, r8d
pxor xmm4, xmm0
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1400efa75
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1401d8ee0]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm4, xmmword [rcx]
pxor xmm4, xmm6
pxor xmm4, xmm0
movdqu xmm3, xmmword [rcx + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [rcx + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [rcx + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x1400ef9d0
movabs rax, 0x1751997d0
movq xmm0, rax
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1401d8ef0]
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm2
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
cmp rdx, 0x10
jb 0x1400efb04
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x1400efada
movdqa xmm0, xmmword [0x1401d8ef0]
pclmulqdq xmm0, xmm4, 1
psrldq xmm4, 8
pxor xmm4, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm4, 3
psrldq xmm4, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm4
pxor xmm1, xmm1
pblendw xmm1, xmm2, 3
pclmulqdq xmm1, xmmword [0x1401d8f00], 0x10
pblendw xmm1, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm1, 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x1400f6160
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x140208d48]
cmp rbx, 1
jbe 0x1400f61b4
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400f61fa
movsxd rcx, dword [rbx]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rbx + 4]
movsxd rdx, dword [rbx]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140208d48]
call fcn.14000d860
test al, al
je 0x1400f6206
mov qword [0x140208d50], 0
lea r14, [0x140208d48]
lea rbx, [0x140208d50]
mov rcx, rbx
xor edx, edx
call fcn.140001360
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r14
call fcn.14000d840
jmp 0x1400f617c
test rdi, rdi
je 0x1400f61a7
call fcn.1400014c0
jmp 0x1400f618e
mov rbx, qword [0x140208d48]
jmp 0x1400f617c

Function at 0x1400f6220
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400f6254
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400f6254
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1400f624e
Function at 0x1400f6ae0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x140207000]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f6b43
mov rax, qword [0x140206ff8]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140106510
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140207000]
call fcn.1401044f8
cmp dword [0x140207000], 0xffffffff
jne 0x1400f6b1d
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140108da0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401039c0
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140207038]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f6bfc
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r8d, edi
call fcn.140026020
mov qword [0x140206ff8], rsi
lea rcx, [0x140207000]
call fcn.140103fa4
jmp 0x1400f6b1d
lea rcx, [0x140207038]
call fcn.1401044f8
cmp dword [0x140207038], 0xffffffff
jne 0x1400f6bd4
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x140207028], xmm2
movups xmmword [0x140207018], xmm1
movups xmmword [0x140207008], xmm0
lea rcx, [0x140207038]
call fcn.140103fa4
jmp 0x1400f6bd4
Function at 0x1400f7110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
test r8, r8
je 0x1400f721b
mov r11, qword [rcx + 8]
movsxd rcx, dword [r11 + 0x3c]
cmp dword [r11 + rcx + 0x84], 0
je 0x1400f721b
add rcx, r11
xor eax, eax
cmp word [rcx + 0x14], 0x78
jb 0x1400f7243
add rcx, 0x88
je 0x1400f7243
mov r10d, dword [rcx]
test r10, r10
je 0x1400f721b
add r10, r11
je 0x1400f721b
cmp rdx, 0xffff
jbe 0x1400f723d
mov eax, dword [r10 + 0x18]
mov ecx, dword [r10 + 0x20]
lea r9, [r11 + rcx]
test rcx, rcx
cmove r9, rcx
lea rcx, [rax*4]
test rcx, rcx
je 0x1400f721b
lea rax, [r9 + rax*4]
mov r14b, byte [rdx]
inc rdx
mov rsi, r9
mov rdi, rax
sub rdi, rsi
mov rcx, rdi
sar rcx, 2
shr rdi, 0x3f
add rdi, rcx
and rdi, 0xfffffffffffffffe
mov ecx, dword [rsi + rdi*2]
lea rbx, [r11 + rcx]
test rcx, rcx
cmove rbx, rcx
test r14b, r14b
je 0x1400f71f3
mov rcx, rdx
mov ebp, r14d
nop dword [rax]
cmp bpl, byte [rbx]
jne 0x1400f71f5
inc rbx
mov bpl, byte [rcx]
inc rcx
test bpl, bpl
jne 0x1400f71e0
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ecx, bpl
movzx ebx, byte [rbx]
mov ebp, ecx
sub ebp, ebx
lea r15, [rdi + 4]
test ebp, ebp
cmovg rsi, r15
cmp ecx, ebx
cmovs rax, rdi
je 0x1400f721f
cmp rsi, rax
jne 0x1400f71a8
xor eax, eax
jmp 0x1400f7243
mov eax, dword [r10 + 0x24]
add r11, rax
test rax, rax
cmove r11, rax
sub rdi, r9
sar rdi, 1
movzx edx, word [r11 + rdi]
add dx, word [r10 + 0x10]
mov word [r8], dx
mov al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400f8450
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14020ac00]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f84b5
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400f84f1
movsxd rcx, dword [0x14020abf8]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14020abfc]
movsxd rdx, dword [0x14020abf8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14020ac00]
call fcn.1401044f8
cmp dword [0x14020ac00], 0xffffffff
jne 0x1400f8479
mov qword [0x14020abf8], 0
lea rcx, [0x14020abf8]
xor edx, edx
call fcn.140001360
lea rcx, [0x14020ac00]
call fcn.140103fa4
jmp 0x1400f8479
test rsi, rsi
je 0x1400f84af
call fcn.1400014c0
jmp 0x1400f848b
Function at 0x1400f9470
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140208d48]
cmp rsi, 1
jbe 0x1400f94b9
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400f94b2
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140208d48]
call fcn.14000d860
test al, al
je 0x1400f94ff
mov qword [0x140208d50], 0
lea rdi, [0x140208d48]
lea rsi, [0x140208d50]
mov rcx, rsi
xor edx, edx
call fcn.140001360
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14000d840
jmp 0x1400f9483
mov rsi, qword [0x140208d48]
jmp 0x1400f9483

Function at 0x1400faf10
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jae 0x1400faf89
cmp qword [rsi], rbx
je 0x1400faf65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400faf90
cmp rbp, 2
jb 0x1400faf5c
mov qword [rsi], rbx
call fcn.1400c8a40
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400fafa6
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400c8a40
jmp 0x1400faf34
call fcn.1400c8a40
mov rcx, qword [rsi]
call fcn.1400e5be0
mov qword [rsi], 0
jmp 0x1400faf4e
call fcn.1400c8a40
mov rcx, qword [rdi]
call fcn.1400e5be0
mov qword [rdi], 0
jmp 0x1400faf7b

Function at 0x1400fafc0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400fb007
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400fb021
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400fafff
mov qword [rsi], rdi
call fcn.1400c8a40
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400fb037
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400c8a40
mov rcx, qword [rsi]
call fcn.1400e5be0
mov qword [rsi], 0
jmp 0x1400fafed
int3
Function at 0x140100230
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x14020a3fc]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14010025d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140100253

Function at 0x1401010b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x14020abe4], eax
mov dword [rcx + 4], eax
mov eax, dword [0x14020abe0]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140101199
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14010121f
movsxd rcx, dword [0x14020abd8]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14020abdc]
movsxd rdx, dword [0x14020abd8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14020abf0]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401011dc
lea rdi, [rsi + 4]
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140101232
movsxd rcx, dword [0x14020abe8]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x14020abec]
movsxd rdx, dword [0x14020abe8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14020abe0]
call fcn.1401044f8
cmp dword [0x14020abe0], 0xffffffff
jne 0x1401010f2
mov qword [0x14020abd8], 0
lea rcx, [0x14020abd8]
xor edx, edx
call fcn.140001360
lea rcx, [0x14020abe0]
call fcn.140103fa4
jmp 0x1401010f2
lea rcx, [0x14020abf0]
call fcn.1401044f8
cmp dword [0x14020abf0], 0xffffffff
jne 0x140101151
mov qword [0x14020abe8], 0
lea rcx, [0x14020abe8]
xor edx, edx
call fcn.140001360
lea rcx, [0x14020abf0]
call fcn.140103fa4
jmp 0x140101151
test rsi, rsi
je 0x14010112c
call fcn.1400014c0
jmp 0x140101108
test rdi, rdi
je 0x14010118f
call fcn.1400014c0
jmp 0x14010116b

Function at 0x140101250
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x140208e88]
cmp rdi, 1
jbe 0x14010129f
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1401012e5
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140208e88]
call fcn.14000d860
test al, al
je 0x1401012f1
mov qword [0x140208e90], 0
lea rbx, [0x140208e88]
lea rdi, [0x140208e90]
mov rcx, rdi
xor edx, edx
call fcn.140001360
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14000d840
jmp 0x140101269
test rsi, rsi
je 0x140101294
call fcn.1400014c0
jmp 0x14010127b
mov rdi, qword [0x140208e88]
jmp 0x140101269