joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a09a0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
cmp rdx, 1
je 0x1400a0b26
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x1400a09cd
mov rcx, rdi
call fcn.14007182e
mov rdi, rax
mov rbx, qword [r14 + 8]
cmp rdi, rbx
jbe 0x1400a0b39
mov rax, rdi
shr rax, 0x3d
jne 0x1400a0b4f
lea rcx, [rdi*8]
call fcn.1400c9cbc
mov rcx, qword [r14]
mov qword [r14], rax
test rcx, rcx
je 0x1400a0a04
call fcn.1400c9cac
mov qword [r14 + 8], rdi
xor eax, eax
mov rcx, qword [r14]
mov qword [rcx + rax*8], 0
inc rax
cmp rdi, rax
jne 0x1400a0a0a
mov rbx, qword [r14 + 0x10]
test rbx, rbx
je 0x1400a0c61
lea rcx, [r14 + 0x10]
mov r8, qword [rbx + 8]
mov rax, rdi
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, rdi
sub rax, rdx
movabs rdx, 0x3333333333333333
mov rsi, rax
and rsi, rdx
shr rax, 2
and rax, rdx
add rax, rsi
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs r9, 0x101010101010101
imul r9, rax
shr r9, 0x38
cmp r9, 1
jbe 0x1400a0b54
cmp r8, rdi
jb 0x1400a0aa8
mov rax, r8
xor edx, edx
div rdi
mov r8, rdx
mov rax, qword [r14]
mov qword [rax + r8*8], rcx
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a0c61
mov rax, qword [rcx + 8]
cmp r9d, 1
jbe 0x1400a0b30
cmp rax, rdi
jb 0x1400a0ad2
xor edx, edx
div rdi
mov rax, rdx
cmp rax, r8
je 0x1400a0b21
mov rsi, qword [r14]
cmp qword [rsi + rax*8], 0
mov rdx, rcx
jne 0x1400a0af0
mov qword [rsi + rax*8], rbx
mov rbx, rcx
mov r8, rax
jmp 0x1400a0aaf
mov r10, rdx
mov rdx, qword [rdx]
test rdx, rdx
je 0x1400a0b05
mov rsi, qword [rcx + 0x10]
cmp rsi, qword [rdx + 0x10]
je 0x1400a0af0
mov qword [rbx], rdx
mov rdx, qword [r14]
mov rdx, qword [rdx + rax*8]
mov rdx, qword [rdx]
mov qword [r10], rdx
mov rdx, qword [r14]
mov rax, qword [rdx + rax*8]
mov qword [rax], rcx
jmp 0x1400a0aaf
mov rbx, rcx
jmp 0x1400a0aaf
mov edi, 2
jmp 0x1400a09cd
lea rdx, [rdi - 1]
and rax, rdx
jmp 0x1400a0ad2
jae 0x1400a0c61
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x1400a0b60
cvtsi2ss xmm0, rax
jmp 0x1400a0b75
call fcn.1400c9fe0
lea rax, [rdi - 1]
and r8, rax
jmp 0x1400a0aa8
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.1400e55e4
cvttss2si rcx, xmm0
movss xmm1, dword [0x1402450f8]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rbx, 3
jb 0x1400a0c28
mov rcx, rbx
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rsi, rbx
sub rsi, rdx
movabs rdx, 0x3333333333333333
mov rcx, rsi
shr rcx, 2
and rsi, rdx
and rcx, rdx
add rcx, rsi
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x1400a0c28
cmp rax, 2
jb 0x1400a0c30
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400a0c30
mov rcx, rax
call fcn.14007182e
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jae 0x1400a0c61
test rdi, rdi
jne 0x1400a09da
mov rcx, qword [r14]
mov qword [r14], 0
test rcx, rcx
je 0x1400a0c59
call fcn.1400c9cac
mov qword [r14 + 8], 0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400a41c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14029ba28]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400a4225
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a4261
movsxd rcx, dword [0x14029ba20]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14029ba24]
movsxd rdx, dword [0x14029ba20]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x14029ba28]
call fcn.1400c9d58
cmp dword [0x14029ba28], 0xffffffff
jne 0x1400a41e9
mov qword [0x14029ba20], 0
lea rcx, [0x14029ba20]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029ba28]
call fcn.1400c9cf8
jmp 0x1400a41e9
test rsi, rsi
je 0x1400a421f
call fcn.140008460
jmp 0x1400a41fb
Function at 0x1400a8ee0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400a8f31
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ccfe0
mov rax, rsi
add rsp, 0x30
pop rsi
ret
int3
Function at 0x1400ae080
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140299978]
cmp rsi, 1
jbe 0x1400ae0c9
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400ae0c2
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140299978]
call fcn.14008f690
test al, al
je 0x1400ae10f
mov qword [0x140299980], 0
lea rdi, [0x140299978]
lea rsi, [0x140299980]
mov rcx, rsi
xor edx, edx
call fcn.1400721e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008f670
jmp 0x1400ae093
mov rsi, qword [0x140299978]
jmp 0x1400ae093
Function at 0x1400ae6e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm4, r8d
pxor xmm4, xmm0
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1400ae815
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x140257eb0]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm4, xmmword [rcx]
pxor xmm4, xmm6
pxor xmm4, xmm0
movdqu xmm3, xmmword [rcx + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [rcx + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [rcx + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x1400ae770
movabs rax, 0x1751997d0
movq xmm0, rax
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x140257ec0]
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm2
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
cmp rdx, 0x10
jb 0x1400ae8a4
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x1400ae87a
movdqa xmm0, xmmword [0x140257ec0]
pclmulqdq xmm0, xmm4, 1
psrldq xmm4, 8
pxor xmm4, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm4, 3
psrldq xmm4, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm4
pxor xmm1, xmm1
pblendw xmm1, xmm2, 3
pclmulqdq xmm1, xmmword [0x140257ed0], 0x10
pblendw xmm1, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm1, 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x1400ae960
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov eax, dword [0x14029ba08]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ae9cf
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x1400ae9c3
movsxd rdx, dword [0x14029ba00]
shl rdx, 4
mov esi, dword [rax + rdx + 8]
cmp esi, dword [0x14029ba04]
jne 0x1400ae9c3
mov rax, qword [rax + rdx]
test rax, rax
je 0x1400ae9c3
mov ecx, dword [rax]
mov dword [rdi], ecx
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14029ba08]
call fcn.1400c9d58
cmp dword [0x14029ba08], 0xffffffff
jne 0x1400ae98a
mov qword [0x14029ba00], 0
lea rcx, [0x14029ba00]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029ba08]
call fcn.1400c9cf8
jmp 0x1400ae98a

Function at 0x1400b4dc0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140297978]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400b4e1c
movzx eax, word [0x140297948]
cmp ax, 9
jne 0x1400b4e7e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140297978]
call fcn.1400c9d58
cmp dword [0x140297978], 0xffffffff
jne 0x1400b4df5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x140297968], xmm2
movups xmmword [0x140297958], xmm1
movups xmmword [0x140297948], xmm0
lea rcx, [0x140297978]
call fcn.1400c9cf8
jmp 0x1400b4df5
cmp ax, 5
jg 0x1400b4e9f
xor esi, esi
test ax, ax
je 0x1400b4e07
cmp ax, 5
jne 0x1400b4ebf
mov esi, 3
jmp 0x1400b4e07
cmp ax, 6
jne 0x1400b4eaf
mov esi, 2
jmp 0x1400b4e07
cmp ax, 0xc
jne 0x1400b4ebf
mov esi, 4
jmp 0x1400b4e07
mov esi, 5
jmp 0x1400b4e07
Function at 0x1400b9b50
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jae 0x1400b9bcd
cmp qword [rsi], rbx
je 0x1400b9ba7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400b9bd4
cmp rbp, 2
jb 0x1400b9b9e
mov qword [rsi], rbx
call fcn.140071760
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400b9c07
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140071760
jmp 0x1400b9b76
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400b9bf9
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400b9b90
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1400b9be8
call fcn.140071760
mov rbx, qword [rdi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400b9c2c
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rdi], 0
jmp 0x1400b9bbd
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1400b9c1b

Function at 0x1400bb9d0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x1400bb9fb
call fcn.140071760
mov qword [rsi], 0
test rbx, rbx
je 0x1400bba33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400bba5d
cmp rbp, 2
jb 0x1400bba2a
mov qword [rsi], rbx
call fcn.140071760
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
xor eax, eax
mov byte [rsi + 9], al
mov byte [rdi + 8], al
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400bba90
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400bba82
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x1400bba1c
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1400bba71
call fcn.140071760
mov rbx, qword [rdi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400bbab5
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rdi], 0
jmp 0x1400bba4d
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1400bbaa4
Function at 0x1400bdb78
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x1400bdbc4
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400bdbcf
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400bdbb2
mov qword [rdi], rsi
call fcn.140071760
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140071760
mov r14, qword [rdi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1400bdbf4
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rdi], 0
jmp 0x1400bdba0
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1400bdbe3

Function at 0x1400c0fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x1400c106f
mov rax, r8
shr rax, 2
mov rdx, r9
not rdx
add rdx, r10
jne 0x1400c1007
xor edx, edx
jmp 0x1400c104c
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x140263af0]
nop word [rax + rax]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x1400c1020
test r8b, 1
je 0x1400c1069
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x140263af0]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1400c1069

Function at 0x1400c1d10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
mov rdi, qword [0x140295ff8]
cmp rdi, 1
jbe 0x1400c1d60
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c1da6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140295ff8]
call fcn.14008f690
test al, al
je 0x1400c1db2
mov qword [0x140296000], 0
lea rbx, [0x140295ff8]
lea rdi, [0x140296000]
mov rcx, rdi
xor edx, edx
call fcn.1400721e0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008f670
jmp 0x1400c1d2a
test rsi, rsi
je 0x1400c1d55
call fcn.140008460
jmp 0x1400c1d3c
mov rdi, qword [0x140295ff8]
jmp 0x1400c1d2a
Function at 0x1400c1dc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140297820]
cmp rsi, 1
jbe 0x1400c1e04
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c1e53
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400c1e53
cmp qword [rax + rcx], 0
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140297820]
call fcn.14008f690
test al, al
je 0x1400c1e4a
mov qword [0x140297828], 0
lea rdi, [0x140297820]
lea rsi, [0x140297828]
mov rcx, rsi
xor edx, edx
call fcn.1400721e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008f670
jmp 0x1400c1dd3
mov rsi, qword [0x140297820]
jmp 0x1400c1dd3
xor eax, eax
jmp 0x1400c1dfd

Function at 0x1400c20b0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov esi, r9d
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x50], r13
movaps xmm6, xmmword [0x140257270]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3e
call fcn.14007e2d0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008e970
test esi, esi
js 0x1400c2222
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x3c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c220c
mov esi, dword [rsp + 0x3c]
test byte [0x140291180], 0x19
jne 0x1400c21ca
lea rcx, [rsp + 0x60]
call fcn.14007d180
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x140291180]
lea r9, [0x14025c94b]
mov rcx, rdi
mov dl, 0x45
call fcn.140086650
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400c2193
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400c2193
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400c218a
mov esi, 0xffffffff
jmp 0x1400c218a
Function at 0x1400c2230
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0xc0], xmm6
mov r14d, r9d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xb0], r15
movaps xmm6, xmmword [0x140257270]
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea rbp, [rsp + 0x40]
mov rcx, rbp
mov r9d, 0x73
call fcn.14007e2d0
lea rcx, [rsp + 0x60]
mov rdx, rbp
xor r8d, r8d
call fcn.14008e970
xorps xmm7, xmm7
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm7
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x3c]
mov rdx, rdi
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov esi, dword [rsp + 0x3c]
test byte [0x140291180], 0x19
jne 0x1400c235b
test edi, edi
je 0x1400c239a
lea rcx, [rsp + 0x60]
call fcn.14007d180
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xc0]
movaps xmm7, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], r15
movaps xmmword [rbx], xmm6
movups xmmword [rsp + 0x20], xmm7
mov byte [rsp + 0x30], 0
lea r8, [0x140291180]
lea r9, [0x14025c94b]
mov rcx, rbx
mov dl, 0x45
call fcn.140086650
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400c231b
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400c231b
mov esi, 0xffffffff
jmp 0x1400c231f
Function at 0x1400c23b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov edi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x50], r13
movaps xmm6, xmmword [0x140257270]
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x88
call fcn.14007e2d0
xor esi, esi
mov rcx, rbx
mov rdx, r12
xor r8d, r8d
call fcn.14008e970
test edi, edi
js 0x1400c24fa
lea rbx, [rsp + 0x40]
mov dword [rbx], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, edi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rbx]
test byte [0x140291180], 0x19
jne 0x1400c24b8
lea rcx, [rsp + 0x60]
call fcn.14007d180
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x140291180]
lea r9, [0x14025c94b]
mov rcx, rdi
mov dl, 0x45
call fcn.140086650
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400c2481
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400c2481
mov esi, 0xffffffff
jmp 0x1400c2478
Function at 0x1400c5740
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, 1
lock xadd dword [0x14029ba0c], eax
mov dword [rcx + 4], eax
mov eax, dword [0x14029ba08]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400c5829
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c58af
movsxd rcx, dword [0x14029ba00]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14029ba04]
movsxd rdx, dword [0x14029ba00]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x14029ba18]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400c586c
lea rdi, [rsi + 4]
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c58c2
movsxd rcx, dword [0x14029ba10]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x14029ba14]
movsxd rdx, dword [0x14029ba10]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14029ba08]
call fcn.1400c9d58
cmp dword [0x14029ba08], 0xffffffff
jne 0x1400c5782
mov qword [0x14029ba00], 0
lea rcx, [0x14029ba00]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029ba08]
call fcn.1400c9cf8
jmp 0x1400c5782
lea rcx, [0x14029ba18]
call fcn.1400c9d58
cmp dword [0x14029ba18], 0xffffffff
jne 0x1400c57e1
mov qword [0x14029ba10], 0
lea rcx, [0x14029ba10]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029ba18]
call fcn.1400c9cf8
jmp 0x1400c57e1
test rsi, rsi
je 0x1400c57bc
call fcn.140008460
jmp 0x1400c5798
test rdi, rdi
je 0x1400c581f
call fcn.140008460
jmp 0x1400c57fb

Function at 0x1400c58e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x140299ab8]
cmp rdi, 1
jbe 0x1400c592f
mov ecx, dword [0x1402910c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c5975
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140299ab8]
call fcn.14008f690
test al, al
je 0x1400c5981
mov qword [0x140299ac0], 0
lea rbx, [0x140299ab8]
lea rdi, [0x140299ac0]
mov rcx, rdi
xor edx, edx
call fcn.1400721e0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008f670
jmp 0x1400c58f9
test rsi, rsi
je 0x1400c5924
call fcn.140008460
jmp 0x1400c590b
mov rdi, qword [0x140299ab8]
jmp 0x1400c58f9