joyce8/EMBER2024-capa huggingface dataset:
Function at 0x380b02420
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x380b08064]
mov rbx, rcx
test esi, esi
jle 0x380b02550
mov rax, qword [0x380b08068]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x380b0246b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x380b024f5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x380b02450
mov rcx, rbx
call fcn.380b02c90
mov rdi, rax
test rax, rax
je 0x380b02572
mov rax, qword [0x380b08068]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.380b02dd0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x380b08068]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x380b02557
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x380b024ee
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x380b02500
add dword [0x380b08064], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x380b08068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x380b024ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.initializer_for_moduleeJmsoYUKPYavOXmp
mov edx, eax
call fcn.380b023b0
nop dword [rax]
xor esi, esi
jmp 0x380b02478
mov rax, qword [0x380b08068]
mov edx, dword [rdi + 8]
lea rcx, str.queue_int__jobs_STqskSGpMSGiP__Receive_packet_Pn
mov r8, qword [rax + rbx + 0x18]
call fcn.380b023b0
mov rdx, rbx
lea rcx, str._End_session__they__Connect_DB_
call fcn.380b023b0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x380b02900
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x380b080a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x380b08080]
test rbx, rbx
je 0x380b0295c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x380b02953
test eax, eax
jne 0x380b02953
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x380b02938
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x380b02c90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x380b05210]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x380b02cb0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x380b02cb8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x380b02cb0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x380b02d0d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x380b02d04
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x380b02cb0
add rax, 0x28
cmp rax, r9
jne 0x380b02cf0
xor eax, eax
ret

Function at 0x380b02d10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x380b05210]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x380b02d2f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x380b02d38
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x380b02d2f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x380b02dd0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x380b05210]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x380b02def
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x380b02df8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001dc0
Capabilities:
Check for debugger via api
Check for process debug object
Check processdebugflags
Check processdebugport

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
call fcn.1400274e0
mov r14, rax
mov edi, edx
mov ecx, 0x23
call fcn.14002a5e0
call fcn.1400274e0
mov rsi, rax
mov ebx, edx
mov r8, qword [0x142a5c0e8]
test r8, r8
jne 0x140001e23
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call sub.KERNEL32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14000205a
mov r8, qword [rsp + 0x38]
mov qword [0x142a5c0e8], r8
test r8, r8
je 0x14000205f
cmp r8, 0x3b9aca00
ja 0x140001e38
mov eax, 0x3b9aca00
xor edx, edx
div r8d
jmp 0x140001e3a
xor eax, eax
lea ecx, [rax - 0x3b9aca00]
xor edx, edx
cmp r8, 2
cmovae ecx, eax
setb al
xor r9d, r9d
cmp r14, rsi
setne r9b
mov r8d, 0xff
cmovae r8d, r9d
test r8b, r8b
jne 0x140001e71
cmp edi, ebx
setne r8b
jb 0x140001f10
cmp r8b, 1
jne 0x140001f10
mov r8, r14
sub r8, rsi
jb 0x14000205f
cmp edi, ebx
jae 0x140001eac
test r8, r8
je 0x14000205f
dec r8
lea r9d, [rdi + 0x3b9aca00]
sub r9d, ebx
cmp r9d, 0x3b9aca00
jae 0x140001ebb
jmp 0x140001ee0
mov r9d, edi
sub r9d, ebx
cmp r9d, 0x3b9aca00
jb 0x140001ee0
mov r10d, r9d
shr r10d, 9
imul r10, r10, 0x44b83
shr r10, 0x27
add r8, r10
jb 0x14000205f
imul r10d, r10d, 0x3b9aca00
sub r9d, r10d
mov dl, al
xor eax, eax
cmp r8, rdx
setne al
mov edx, 0xff
cmovb eax, edx
xor r8d, r8d
cmp r9d, ecx
setne r8b
cmovb r8d, edx
test al, al
cmovne r8d, eax
cmp r8b, 1
jne 0x140002055
cmp rsi, r14
jb 0x140002055
sub rsi, r14
cmp ebx, edi
jae 0x140001f32
test rsi, rsi
je 0x140002055
dec rsi
add ebx, 0x3b9aca00
sub ebx, edi
cmp ebx, 0x3b9aca00
jb 0x140001f53
shr ebx, 9
imul rax, rbx, 0x44b83
shr rax, 0x27
add rsi, rax
jb 0x14000205f
cmp rsi, 0x19
jb 0x140002055
lea rcx, [rsp + 0x38]
call fcn.14004e3b0
cmp byte [rsp + 0x38], 0x12
jne 0x14000205f
call fcn.140036e60
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x2c], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 0x1f
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0x2c], 0
jne 0x140002055
cmp qword [rsp + 0x30], 0
jne 0x140002055
cmp dword [rsp + 0x28], 0
je 0x140002055
cmp qword [rsp + 0x38], 0
jne 0x140002055
mov ecx, 0x80000001
call sub.KERNEL32.dll_SetThreadExecutionState
call fcn.140002070
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14002aeb0
call sub.KERNEL32.dll_GetLastError
ud2
Function at 0x140009230
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x428
mov r15d, dword [rdx + 0x58]
lea r12d, [r15 - 1]
cmp r12, r9
jae 0x14000935c
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rdx, r12
shl rdx, 0xa
add rdx, r8
lea rcx, [rsp + 0x28]
mov r8d, 0x400
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx + 0x44]
cmp rax, 2
jb 0x14000933c
add r14, 0x30
lea ecx, [r15*2 - 1]
mov edx, 1
nop word cs:[rax + rax]
mov r8d, r15d
imul r8d, edx
add r8d, r12d
cmp r8, rdi
jae 0x14000935c
mov r8d, ecx
shl r8, 0xa
add r8, r14
inc rdx
xor r9d, r9d
nop word cs:[rax + rax]
movups xmm0, xmmword [r8 + r9*8 - 0x30]
movups xmm1, xmmword [r8 + r9*8 - 0x20]
movups xmm2, xmmword [rsp + r9*8 + 0x28]
xorps xmm2, xmm0
movups xmm0, xmmword [rsp + r9*8 + 0x38]
xorps xmm0, xmm1
movups xmm1, xmmword [rsp + r9*8 + 0x48]
movups xmm3, xmmword [rsp + r9*8 + 0x58]
movups xmmword [rsp + r9*8 + 0x28], xmm2
movups xmmword [rsp + r9*8 + 0x38], xmm0
movups xmm0, xmmword [r8 + r9*8 - 0x10]
xorps xmm0, xmm1
movups xmm1, xmmword [r8 + r9*8]
xorps xmm1, xmm3
movups xmmword [rsp + r9*8 + 0x48], xmm0
movups xmmword [rsp + r9*8 + 0x58], xmm1
add r9, 8
cmp r9, 0x80
jne 0x1400092d0
add ecx, r15d
cmp rdx, rax
jne 0x1400092a0
mov edi, dword [rbx + 0x40]
test rdi, rdi
je 0x14000935e
mov ecx, 8
mov rdx, rdi
call fcn.140025a60
mov rcx, rax
mov rax, rdi
test rcx, rcx
jne 0x140009365
ud2
xor eax, eax
mov ecx, 1
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdi
lea r8, [rsp + 0x28]
mov r9d, 0x400
mov rdx, rdi
call fcn.140007970
nop
add rsp, 0x428
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140016120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x820
mov ecx, dword [0x140057018]
test ecx, ecx
je 0x14001614a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140016163
add rax, 8
jmp 0x140016325
lea rcx, section..data
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140016141
je 0x140016323
mov rax, qword [0x142a5c030]
cmp rax, 3
jne 0x140016330
mov rsi, qword [0x142a5c038]
lock inc qword [rsi]
jle 0x140016346
mov eax, 0x60
movups xmm0, xmmword [0x142a55848]
movups xmm1, xmmword [0x142a55838]
nop
movups xmmword [rsp + rax - 0x30], xmm0
movups xmmword [rsp + rax - 0x40], xmm1
movups xmmword [rsp + rax - 0x20], xmm1
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax], xmm1
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax + 0x20], xmm1
movups xmmword [rsp + rax + 0x30], xmm0
sub rax, 0xffffffffffffff80
cmp rax, 0x860
jne 0x1400161a0
movzx eax, byte [0x142a5c108]
mov edx, 0x980
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140016346
mov rbx, rax
and rbx, 0xffffffffffffff80
lea rdi, [rbx + 0x80]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], rsi
lea rcx, [rbx + 0x90]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
call sub.msvcrt.dll_memcpy
xorps xmm0, xmm0
movaps xmmword [rbx + 0x890], xmm0
mov qword [rbx + 0x8a0], 1
mov qword [rbx + 0x8a8], 0
mov qword [rbx + 0x900], 0
mov rcx, qword [0x142a5c038]
mov rax, qword [rcx + 0x200]
nop word cs:[rax + rax]
mov qword [rdi], rax
lock cmpxchg qword [rcx + 0x200], rdi
jne 0x140016270
movzx eax, byte [0x142a5c108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140016346
mov rbx, rax
mov rsi, rax
lea rax, section..data
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140057018]
test ecx, ecx
je 0x140016348
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057018]
test ecx, ecx
je 0x14001635b
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14001631e
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 0x820]
lea rdx, [rax - 1]
mov qword [rcx + 0x820], rdx
cmp qword [rcx + 0x818], 0
jne 0x14001630d
cmp rax, 1
je 0x14001636e
mov rcx, qword [0x142a5c058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x140016325
xor eax, eax
add rsp, 0x820
pop rbx
pop rdi
pop rsi
ret
call fcn.140015c30
mov rsi, qword [0x142a5c038]
lock inc qword [rsi]
jg 0x14001618b
ud2
lea rcx, section..data
call fcn.140027e30
mov ecx, eax
jmp 0x1400162be
lea rcx, section..data
call fcn.140027e30
mov ecx, eax
jmp 0x1400162d6
call fcn.140015b20
jmp 0x14001630d
Function at 0x14001f610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140057080]
test ecx, ecx
je 0x14001f63a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14001f653
add rax, 8
jmp 0x14001f6ea
lea rcx, [0x140057068]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14001f631
je 0x14001f66f
test rsi, rsi
je 0x14001f673
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x14001f675
mov rdi, qword [rsi + 8]
jmp 0x14001f675
xor eax, eax
jmp 0x14001f6ea
xor edi, edi
movzx eax, byte [0x142a5c108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x14001f712
mov rbx, rax
mov rsi, rax
lea rax, [0x140057068]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140057080]
test ecx, ecx
je 0x14001f6f2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057080]
test ecx, ecx
je 0x14001f702
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14001f6e7
mov rcx, qword [0x142a5c058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140057068]
call fcn.140027e30
mov ecx, eax
jmp 0x14001f6b1
lea rcx, [0x140057068]
call fcn.140027e30
mov ecx, eax
jmp 0x14001f6c5
ud2
Function at 0x1400225b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140057060]
test ecx, ecx
je 0x1400225da
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400225f3
add rax, 8
jmp 0x14002268a
lea rcx, [0x140057048]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400225d1
je 0x140022688
test rsi, rsi
je 0x14002260f
cmp dword [rsi], 0
mov dword [rsi], 0
je 0x14002260f
mov rdi, qword [rsi + 4]
jmp 0x140022611
xor edi, edi
movzx eax, byte [0x142a5c108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x1400226b2
mov rbx, rax
mov rsi, rax
lea rax, [0x140057048]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140057060]
test ecx, ecx
je 0x140022692
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057060]
test ecx, ecx
je 0x1400226a2
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140022683
mov rcx, qword [0x142a5c058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x14002268a
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140057048]
call fcn.140027e30
mov ecx, eax
jmp 0x14002264d
lea rcx, [0x140057048]
call fcn.140027e30
mov ecx, eax
jmp 0x140022661
ud2

Function at 0x1400256c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ecx, dword [0x140057100]
test ecx, ecx
je 0x1400256e7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140025700
add rax, 8
jmp 0x14002579b
lea rcx, [0x1400570e8]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400256de
je 0x140025799
movzx eax, byte [0x142a5c108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x1400257c3
mov rbx, rax
mov rsi, rax
lea rax, [0x1400570e8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140057100]
test ecx, ecx
je 0x1400257a3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057100]
test ecx, ecx
je 0x1400257b3
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140025794
mov rax, qword [rdi + 8]
test rax, rax
je 0x140025783
lock dec qword [rax]
jne 0x140025783
mov rcx, qword [rdi + 8]
call fcn.140023b20
mov rcx, qword [0x142a5c058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x14002579b
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400570e8]
call fcn.140027e30
mov ecx, eax
jmp 0x140025746
lea rcx, [0x1400570e8]
call fcn.140027e30
mov ecx, eax
jmp 0x14002575a
ud2
Function at 0x1400257d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400570e0]
test ecx, ecx
je 0x1400257fa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140025813
add rax, 8
jmp 0x1400258c8
lea rcx, [0x1400570c8]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400257f1
je 0x14002582f
test rsi, rsi
je 0x140025836
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x140025838
mov rdi, qword [rsi + 8]
jmp 0x140025838
xor eax, eax
jmp 0x1400258c8
xor edi, edi
movzx eax, byte [0x142a5c108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x1400258f0
mov rbx, rax
mov rsi, rax
lea rax, [0x1400570c8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x1400570e0]
test ecx, ecx
je 0x1400258d0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1400570e0]
test ecx, ecx
je 0x1400258e0
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x1400258c5
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400258b4
lock dec qword [rax]
jne 0x1400258b4
mov rcx, rdi
add rcx, 8
call fcn.1400350a0
mov rcx, qword [0x142a5c058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400570c8]
call fcn.140027e30
mov ecx, eax
jmp 0x140025874
lea rcx, [0x1400570c8]
call fcn.140027e30
mov ecx, eax
jmp 0x140025888
ud2
Function at 0x1400261c0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov edi, 0xffffffff
xor ebx, ebx
xor r15d, r15d
cmp r8, 0x201
jae 0x140026260
jmp 0x14002623f
jae 0x14002630a
cmp r8, 0x201
jae 0x140026260
mov esi, 0x200
lea r12, [rsp + 0x98]
mov r13, r8
jmp 0x14002628b
sub r8, r15
sub rbx, r15
cmp rbx, r8
jb 0x1400262e9
cmp r14, rdi
mov r15d, 0xffffffff
cmovb r15, r14
mov qword [rsp + 0x40], r15
mov rbx, r14
mov rsi, r15
mov r12, qword [rsp + 0x48]
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r12
mov edx, r13d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400262b0
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400263a3
mov r8d, ebp
cmp r13, r8
jne 0x140026230
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14002645c
add r13, r13
cmp r13, rdi
cmovae r13, rdi
mov r8, r13
cmp r8, 0x201
jb 0x14002623f
jmp 0x140026260
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.14004a5c0
mov r14, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
jmp 0x14002626b
cmp rsi, r8
jb 0x14002645c
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, r12
call fcn.140032400
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r14
call fcn.140033180
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x140026358
lea rdx, [0x142a55ef8]
lea rcx, [rsp + 0x60]
mov r8d, 3
call case.0x1400336cb.43
movabs rdi, 0x8000000000000000
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.1400273b0
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
cmp rsi, rdi
jne 0x1400263cc
mov rcx, rdi
mov rdx, rbx
call fcn.140030bd0
mov rax, qword [rsp + 0x28]
mov qword [rax], rdi
jmp 0x140026411
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rcx], rax
jmp 0x14002642c
mov r14, qword [rsp + 0x90]
mov rcx, rbx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1400263f3
mov rax, qword [rsp + 0x28]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
jmp 0x140026411
mov rax, qword [rsp + 0x28]
mov qword [rax], rdi
test rsi, rsi
je 0x140026411
mov rcx, qword [0x142a5c058]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x60], 0
je 0x14002642c
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x142a5c058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x30], 0
je 0x140026447
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x142a5c058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140027e30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x140027eb5
mov rax, qword [0x142a5f038]
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x140027eec
cmp dword [rsp + 0x2c], 0
je 0x140027edd
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140027eee
mov edi, eax
mov rax, qword [0x142a5c068]
nop dword [rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x142a5c068], rsi
jne 0x140027e90
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140027ee2
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140027eec
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x140027ee2
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x140027ee2
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2

Function at 0x1400287b0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x142a55ae0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x14002881a
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14002884d
test eax, eax
js 0x14002882e
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x142a55b40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.14002bc10
mov rcx, rax
call fcn.140028720
mov ecx, 7
int 0x29
ud2