joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f0e0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140314be8], 0
jne 0x14007f314
mov rcx, qword [0x140314bd0]
test rcx, rcx
je 0x14007f1df
test byte [0x14030f308], 1
je 0x14007f314
cmp byte [rcx + 0x17], 0
jns 0x14007f137
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140314be8], rax
inc rax
cmp rax, 1
ja 0x14007f314
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140117f60
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14007f312
cmp eax, 0x104
ja 0x14007f312
mov rcx, qword [0x140314bd0]
lea rdx, [rsp + 0x40]
int3
movabs r14, 0x7fffffffffffffef
mov ecx, 0x18
int3
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140080f5b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x548
movaps xmmword [rsp + 0x530], xmm6
mov r12, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x528], rax
movzx eax, byte [rcx + 0x17]
mov rcx, rax
test al, al
jns 0x140080f98
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14008100b
mov rcx, r12
test al, al
jns 0x140080fa8
mov rcx, qword [r12]
xor eax, eax
movabs r8, 0x400000001003
xor edi, edi
mov rbx, rcx
movzx esi, word [rbx]
mov edx, esi
add edx, 0xffffffd2
cmp dx, 0x2e
ja 0x140080fea
movzx edx, dx
bt r8, rdx
jae 0x140080fea
cmp si, 0x2e
jne 0x140080fe6
cmp rbx, rcx
jbe 0x140080fe6
cmp word [rbx - 2], 0x2e
mov edx, edi
jne 0x140080ff1
jmp 0x14008100b
mov edx, edi
jmp 0x140080ff1
mov dl, 1
test si, si
je 0x140081001
cmp si, 0x3a
movzx edi, dl
cmove edi, eax
add rbx, 2
jmp 0x140080fb9
test dil, 1
jne 0x140081104
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x1400810d7
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x260]
mov r8d, 0x69
mov r9d, 2
int3
xor edi, edi
mov rcx, qword [rsp + 0x528]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
movaps xmm6, xmmword [rsp + 0x530]
add rsp, 0x548
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008118d
test al, 0x10
jne 0x140081223
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x1400810d7
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x260]
mov r8d, 0x7b
mov r9d, 2
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dil, 1
cmp eax, 2
je 0x1400810d9
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x1400810d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x260]
mov r8d, 0x74
mov r9d, 2
int3
lea rdi, [rsp + 0x260]
mov r8d, 0x2c8
mov rcx, rdi
mov dl, 0xaa
call fcn.140117f60
mov rcx, rdi
mov rdx, r12
xor r8d, r8d
mov r9d, 1
int3
Function at 0x1400940d0
Capabilities:
Acquire debug privileges

Disassembly:
push rsi
push rbx
sub rsp, 0x198
mov ebx, ecx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rsi, [rsp + 0x178]
mov qword [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400941cf
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14009421f
lea r8, [rsp + 0x180]
mov dword [r8], 1
mov rax, qword [rsp + 0x30]
mov qword [r8 + 4], rax
movzx eax, bl
add eax, eax
mov dword [r8 + 0xc], eax
mov rcx, qword [rsp + 0x178]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140094276
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140094276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_process_terminator_work_item.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x77
mov r9d, 1
int3
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140094276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_process_terminator_work_item.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x66
mov r9d, 1
int3
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140094276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_process_terminator_work_item.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x6c
mov r9d, 1
int3
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140115e50
nop
add rsp, 0x198
pop rbx
pop rsi
ret

Function at 0x140098274
Capabilities:
Delete service

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x190
mov rbx, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x14009837b
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
jne 0x14009835e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140098353
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x48]
mov r8d, 0x283
mov r9d, 1
int3
cmp r14d, 0x430
sete dil
cmp qword [rsi], 0
je 0x14009837d
call fcn.1400bb620
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsi], 0
jmp 0x14009837d
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
add rsp, 0x190
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140098d8e
Capabilities:
Modify service

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b8
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x28]
xor ebx, ebx
cmp rax, qword [rdx + 0x30]
cmovne rbx, rax
cmp byte [rdx + 0x27], 0
jns 0x140098dc9
mov rdi, qword [rdx + 0x10]
jmp 0x140098dcd
lea rdi, [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov eax, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [rsi + 0xe8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rbx
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x50], 0
mov edx, eax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x140098ea8
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140098ea8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x70]
mov r8d, 0x275
mov r9d, 1
int3
test edi, edi
setne bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400b0ea0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, r8
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov r13b, byte [0x14030fd30]
test r13b, 0x19
jne 0x1400b109f
xor r14d, r14d
mov r15, r12
cmp qword [rsi + 0x38], 0
jne 0x1400b0fe6
mov eax, dword [0x140314cf0]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400b1019
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400b0f59
movsxd rcx, dword [0x140314ce8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140314cec]
jne 0x1400b0f59
mov rax, qword [rax + rcx]
test rax, rax
je 0x1400b0f59
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x60], rcx
mov eax, dword [rax + 8]
mov dword [rsi + 0x58], eax
mov eax, dword [0x140314ce0]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400b105c
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400b0fe6
movsxd rcx, dword [0x140314cd8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140314cdc]
jne 0x1400b0fe6
mov rax, qword [rax + rcx]
test rax, rax
je 0x1400b0fe6
cmp dword [rax + 0x68], 0xf00dbaad
je 0x1400b1171
mov rcx, qword [rax + 0x20]
mov qword [rsi + 0x38], rcx
movups xmm0, xmmword [rax + 0x38]
mov rcx, qword [rax + 0x48]
mov qword [rsi + 0x50], rcx
movups xmmword [rsi + 0x40], xmm0
cmp byte [rax + 0x6c], 0
jne 0x1400b1015
cmp qword [rax + 0x50], 0
setne al
mov byte [rsi + 0x6c], al
test r13b, 0x19
jne 0x1400b1154
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140115e50
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 1
jmp 0x1400b0fe3
lea rcx, [0x140314cf0]
int3
lea rcx, [0x140314ce0]
int3
mov rbx, r9
mov rdi, rdx
mov eax, dword [rsi + 0x68]
shl rax, 0x20
mov r14d, ecx
or r14, rax
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rsp + 0x54], eax
lea r15, [rsp + 0x58]
mov qword [r15], r12
mov rcx, r15
int3
cmp byte [r14], 0
je 0x1400b0ff0
mov rcx, r14
mov rdx, r12
mov r8, r15
call fcn.14010a7c0
jmp 0x1400b0ff0
cmp qword [rax + 8], 0
je 0x1400b1183
cmp qword [rax + 0x10], 0
jne 0x1400b0fbd
cmp qword [rax + 0x20], 0
jne 0x1400b0fbd
jmp 0x1400b0fe6
Function at 0x1400b11a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movapd xmmword [rsp + 0x120], xmm10
movapd xmmword [rsp + 0x110], xmm9
movaps xmmword [rsp + 0x100], xmm8
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0xd8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
test byte [0x14030f3f0], 0x19
jne 0x1400b198c
mov rcx, qword [rsi + 0x60]
test rcx, rcx
jne 0x1400b1e16
mov rcx, qword [rsi + 0x48]
mov rdx, rsi
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x14030f358]
lea r14, [0x14007fec0]
cmp rax, r14
jne 0x1400b1d21
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x1400b1ad1
imul rax, rax, 0xf4240
cqo
idiv qword [0x140314ed0]
jmp 0x1400b1af3
mov rcx, qword [0x140314ed0]
cqo
idiv rcx
imul rbp, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbp
mov qword [rsp + 0x90], rax
lea rbp, [rsp + 0x90]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x40], 0
lea rdx, [0x14030f3f0]
lea r8, str.WorkerThread_born
mov cl, 0x49
xor r9d, r9d
call fcn.1400b4710
test byte [0x14030f3f0], 0x19
je 0x1400b120c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x14030f358]
cmp rax, r14
jne 0x1400b1d30
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x1400b1ba6
imul rax, rax, 0xf4240
cqo
idiv qword [0x140314ed0]
jmp 0x1400b1bc8
mov rcx, qword [0x140314ed0]
cqo
idiv rcx
imul rbx, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x14030f3f0]
lea r8, str.WorkerThread_active
mov cl, 0x42
xor r9d, r9d
call fcn.1400b4710
jmp 0x1400b120c
lea rcx, [rsp + 0x90]
call rax
jmp 0x1400b1afb
lea rcx, [rsp + 0x90]
call rax
jmp 0x1400b1bd0
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400b1219
Function at 0x1400bc1a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140314cf8]
cmp rdi, 1
jbe 0x1400bc1fd
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bc1e6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400bc1f5
lock sub dword [rcx + 8], 1
je 0x1400bc252
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140314cf8]
int3
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400bc0a0

Function at 0x1400bc4f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x1400bc506
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov rdi, qword [0x140314cf8]
cmp rdi, 1
jbe 0x1400bc595
lea rbx, [rsi + 8]
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bc62b
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rbx
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [0x140314d08]
cmp rdi, 1
jbe 0x1400bc5e2
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bc63e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140314cf8]
int3
lea rcx, [0x140314d08]
int3
test rbx, rbx
je 0x1400bc54a
call fcn.1400086f0
jmp 0x1400bc531
test rsi, rsi
je 0x1400bc58a
call fcn.1400086f0
jmp 0x1400bc571

Function at 0x1400bd250
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14031c750]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400bd2b2
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400bd2ee
movsxd rcx, dword [0x14031c748]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14031c74c]
jne 0x1400bd2ee
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14031c750]
int3
xor eax, eax
jmp 0x1400bd2a6
Function at 0x1400c1c20
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, rdx
mov rsi, rcx
call fcn.1400c1dd0
mov rdi, qword [r15]
mov qword [r15], 0
lea rbx, [rdi + 1]
cmp rbx, 2
jb 0x1400c1c50
call fcn.1400bb620
cmp qword [rsi], rdi
je 0x1400c1c83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400c1d50
cmp rbx, 2
jb 0x1400c1c7b
mov qword [rsi], rdi
call fcn.1400bb620
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rsi, r15
je 0x1400c1d1b
lea rdx, [r15 + 8]
lea rbx, [rsi + 8]
cmp byte [rbx + 0x17], 0
mov al, byte [rdx + 0x17]
js 0x1400c1d78
test al, al
jns 0x1400c1d40
mov r14, qword [r15 + 8]
mov rdi, qword [r15 + 0x10]
cmp rdi, 0xa
jbe 0x1400c1da2
lea rax, [rdi - 0xa]
movabs rcx, 0x7fffffffffffffe5
cmp rax, rcx
jae 0x1400c1dc3
cmp rdi, 0x14
mov ebp, 0x14
cmova rbp, rdi
add rbp, 8
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
int3
mov word [rbx + rdi*2], 0
mov eax, dword [r15 + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [r15 + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [r15 + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rdx + 0x10]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rbx], xmm0
jmp 0x1400c1d1b
call fcn.1400bb620
mov r14, qword [rsi]
mov rcx, qword [0x1403198a0]
test rcx, rcx
je 0x1400c1d94
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400c1c6d
test al, al
jns 0x1400c1d86
mov r8, qword [r15 + 0x10]
mov rdx, qword [r15 + 8]
jmp 0x1400c1d8a
movzx r8d, al
mov rcx, rbx
int3
int3
mov byte [rbx + 0x17], dil
test rdi, rdi
je 0x1400c1d15
lea r8, [rdi + rdi]
mov rcx, rbx
mov rdx, r14
call fcn.1401178b0
jmp 0x1400c1d15
mov rcx, rbx
int3
Function at 0x1400c1f20
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r12, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x1400c1f4d
call fcn.1400bb620
mov qword [rsi], 0
test rbx, rbx
je 0x1400c1f89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400c203f
cmp rbp, 2
jb 0x1400c1f80
mov qword [rsi], rbx
call fcn.1400bb620
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
cmp byte [r12 + 0x1f], 0
jns 0x1400c2024
mov r14, qword [r12 + 8]
mov rbp, qword [r12 + 0x10]
cmp rbp, 0xa
jbe 0x1400c2039
movabs rbx, 0x7fffffffffffffef
cmp rbp, rbx
ja 0x1400c2075
lea rdi, [rbp + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
int3
lea r8, [rbp + 2]
add r8, rbp
mov rdx, r14
call fcn.1401178b0
mov eax, dword [r12 + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [r12 + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [r12 + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [r12 + 8]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
jmp 0x1400c1ffa
mov byte [rcx + 0x17], bpl
jmp 0x1400c1fe7
call fcn.1400bb620
mov r14, qword [rsi]
mov rcx, qword [0x1403198a0]
test rcx, rcx
je 0x1400c2067
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400c1f72
int3
int3
Function at 0x1400ce630
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x18], 0
je 0x1400ce6f1
mov eax, dword [0x14031e5c0]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ce755
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [0x14031e5c0]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ce798
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400ce6e5
movsxd rcx, dword [0x14031e5b8]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14031e5bc]
movsxd rdx, dword [0x14031e5b8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
jne 0x1400ce70f
cmp qword [rsi], 0
jne 0x1400ce743
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140115e50
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r14, [rsp + 0x28]
mov r9, qword [rbx + 0x30]
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rbx + 0x28], 0
mov rax, qword [rcx]
lea rdx, [rbx + 8]
mov r8, r14
call qword [rax]
add rbx, 0x38
cmp rbx, rdi
je 0x1400ce6f1
jmp 0x1400ce714
mov rcx, rsi
int3
lea rcx, [0x14031e5c0]
int3
lea rcx, [0x14031e5c0]
int3

Function at 0x1400d1090
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1400d1ef0
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x1400d12b5
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x28], rbx
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x1400d12eb
lea rdx, [0x1402bbc5a]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d12fe
mov rbx, rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call rax
mov r12, rax
movsxd rbp, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test rbp, rbp
je 0x1400d1306
test ebp, ebp
js 0x1400d130d
shl rbp, 3
lea rsi, [rbp*2]
add rsi, rbp
mov rcx, rsi
int3
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
int3
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140115e50
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1400d1148
xor r12d, r12d
jmp 0x1400d114b
xor ebx, ebx
jmp 0x1400d124c
lea rcx, [rsp + 0x30]
int3
Function at 0x1400e1370
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e13a4
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400e13a4
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1400e139e

Function at 0x1400e18c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e18fe
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400e18f7
call fcn.1400086f0
jmp 0x1400e18de

Function at 0x1400e3340
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140314cf8]
cmp rsi, 1
jbe 0x1400e3384
mov ecx, dword [0x140310d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e33d3
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400e33d3
cmp qword [rax + rcx], 0
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140314cf8]
call fcn.1400c4120
test al, al
je 0x1400e33ca
mov qword [0x140314d00], 0
lea rdi, [0x140314cf8]
lea rsi, [0x140314d00]
mov rcx, rsi
xor edx, edx
call fcn.1400bc270
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400c4100
jmp 0x1400e3353
mov rsi, qword [0x140314cf8]
jmp 0x1400e3353
xor eax, eax
jmp 0x1400e337d