joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400db100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400db15a

Function at 0x1400db17a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400db150
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x1400db210
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400db26a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400db260
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x1400e8040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400e8160
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400e80a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400e80a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400e80a0
Function at 0x1400f5540
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov al, 1
xchg byte [rcx + 0x68], al
test al, 1
jne 0x1400f559d
mov edi, edx
mov rbx, rcx
xor eax, eax
xchg qword [rcx + 0x48], rax
mov qword [rcx + 0x60], rax
lock inc qword [rcx + 0x58]
call fcn.1400f55f0
mov rsi, rax
mov rcx, rax
mov rdx, rbx
call fcn.1400f5700
cmp edi, 1
jne 0x1400f55b3
call fcn.1400f6400
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
call fcn.1400f64f0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14010e4a0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.1400f6b70
test rsi, rsi
je 0x1400f559d
mov rcx, rsi
call fcn.1400f7790
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14010e4a0
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.1400f7ab0

Function at 0x1400f55f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.1400f7db0
mov byte [rsp + 0x2f], 0xaa
cmp byte [0x140170d61], 0
je 0x1400f5654
mov esi, dword [0x140178ca0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test edi, edi
jne 0x1400f56a7
test rsi, rsi
je 0x1400f56b1
inc qword [rsi + 0x298]
inc qword [rsi + 0x2b8]
inc qword [rsi + 0x2a8]
mov byte [rsp + 0x2f], 0
lea rcx, [0x140170d68]
call fcn.1400a5910
mov rdi, qword [0x140171518]
mov rsi, qword [rdi]
test rsi, rsi
je 0x1400f56d3
mov byte [rsp + 0x2f], 0
mov rcx, qword [rsi]
call fcn.14010bcbc
mov qword [rdi], rax
inc word [rdi + 0x18]
lea rcx, [0x140170d68]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010e4a0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400f5635
mov byte [0x140170d61], 0
lea rcx, [0x140170d60]
call fcn.140105f20
mov rsi, rax
mov byte [0x140170d61], 1
jmp 0x1400f563a
lea rax, [rsp + 0x2f]
mov qword [rsp + 0x20], rax
lea rcx, [0x140171518]
lea rdx, [0x140170d60]
mov r9d, 0x458
xor r8d, r8d
call fcn.1400f4c40
mov rsi, rax
jmp 0x1400f5683
Function at 0x1400f8930
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], r9
test rdx, rdx
jne 0x1400f89a9
xor edi, edi
mov qword [rsi], rdi
shl rbx, 4
add rbx, rdi
mov qword [rsi + 0x10], rbx
mov qword [rsi + 8], rbx
shl r15, 4
add r15, rdi
mov qword [rsi + 0x18], r15
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010e4a0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400f7db0
mov r14, r15
shl r14, 4
mov eax, 0x40
mov ecx, 0x40
je 0x1400f89c9
bsr rcx, r14
xor rcx, 0x3f
sub rax, rcx
lea rcx, [0x140147e80]
mov cl, byte [rax + rcx]
mov rdx, r14
shr rdx, cl
and edx, 7
lea rcx, [0x140147ed0]
mov rcx, qword [rcx + rax*8]
and rcx, r14
lea rax, [rdx + rax*8]
cmp rcx, 1
sbb rax, 0xffffffffffffffff
lea rcx, [0x1401480d8]
movzx r12d, word [rcx + rax*2 + 0x400]
mov byte [rsp + 0x3f], 0xaa
cmp byte [0x140170d61], 0
je 0x1400f8a86
mov ebp, dword [0x140178ca0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r13, rax
test edi, edi
jne 0x1400f8a8c
test r13, r13
je 0x1400f8a96
inc qword [r13 + 0x298]
cmp r12w, 0x29
jae 0x1400f8ab5
mov rbp, r12
shl rbp, 4
mov rdx, r12
lea r12, [rbp + 8]
add r12, r13
mov rdi, qword [r12]
test rdi, rdi
je 0x1400f8b1e
inc qword [r13 + 0x2a0]
mov rcx, qword [rdi]
call fcn.14010bcbc
dec byte [r13 + rbp + 0x10]
mov qword [r12], rax
jmp 0x1400f896b
lea r12, [r12 + r12*4]
jmp 0x1400f8ad6
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400f8a34
mov byte [0x140170d61], 0
lea rcx, [0x140170d60]
call fcn.140105f20
mov r13, rax
mov byte [0x140170d61], 1
jmp 0x1400f8a39
mov qword [rsp + 0x30], r12
inc qword [r13 + 0x2b8]
inc qword [r13 + 0x2a8]
mov byte [rsp + 0x3f], 0
mov rax, qword [rsp + 0x30]
lea r12, [rax + rax*4]
lea r13, [0x140170d60]
lea rcx, [0x140170d68]
call fcn.1400a5910
mov rbp, qword [r13 + r12*8 + 0x10]
mov rdi, qword [rbp]
test rdi, rdi
je 0x1400f8b57
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
call fcn.14010bcbc
mov qword [rbp], rax
inc word [rbp + 0x18]
lea rcx, [0x140170d68]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x1400f896b
movdqu xmm0, xmmword [r13 + 0x2a8]
pcmpeqd xmm1, xmm1
psubq xmm0, xmm1
movdqu xmmword [r13 + 0x2a8], xmm0
mov rcx, r13
mov qword [rsp + 0x30], rdx
call fcn.1401060c0
mov rdi, qword [r12]
test rdi, rdi
jne 0x1400f8a70
jmp 0x1400f8ac8
lea rcx, [r12*8 + 0x10]
add rcx, r13
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x20], rax
lea rdx, [0x140170d60]
xor r8d, r8d
mov r9, r14
call fcn.1400f4c40
mov rdi, rax
jmp 0x1400f8b0c
Function at 0x1400f9006
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rdi, [rsp + 0x50]
mov r8d, 0xa0
mov rcx, rdi
mov dl, 0xaa
call fcn.140110bf0
mov rcx, rdi
call fcn.1400998f0
mov byte [rdi + 0x21], 1
lea rcx, [rsp + 0x58]
call fcn.1401000d0
movaps xmm0, xmmword [0x140146a10]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.14003e5a0
mov rax, qword [rsi]
inc rax
cmp rax, 1
jbe 0x1400f913d
lea r12, [rsp + 0x38]
mov qword [r12], 0
mov rcx, r14
call fcn.140100300
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140100300
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x101000
mov rcx, rax
mov rdx, rdi
mov r8, rbx
mov r9, r12
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400f9148
mov rdi, qword [rsp + 0x38]
cmp qword [r15], rdi
je 0x1400f9164
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [r15]
inc rax
cmp rax, 2
jb 0x1400f9121
call fcn.1400068d0
mov r14, qword [r15]
mov rcx, qword [0x140173f80]
test rcx, rcx
je 0x1400f91bd
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [r15], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400f9133
mov qword [r15], rdi
call fcn.1400068d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400f9164
cmp byte [rsp + 0x48], 0
jne 0x1400f9089
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov rax, qword [rsp + 0x40]
inc rax
cmp rax, 2
jb 0x1400f9190
call fcn.1400068d0
mov rdi, qword [rsp + 0x40]
mov rcx, qword [0x140173f80]
test rcx, rcx
je 0x1400f91ce
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
lea rcx, [rsp + 0x50]
call fcn.140099960
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140048130
mov rcx, qword [0x140173f80]
jmp 0x1400f9112
call fcn.140048130
mov rcx, qword [0x140173f80]
jmp 0x1400f9188
Function at 0x1400ff800
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r12, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [0x140173a28]
test rdi, rdi
je 0x1400ff909
lea r14, [0x14014fe21]
mov rcx, rdi
mov rdx, r14
call fcn.140053f90
test al, al
jne 0x1400ff85c
lea rdx, str.vmodule
mov rcx, rdi
call fcn.140053f90
test al, al
je 0x1400ff909
cmp qword [0x140173a30], 0
jne 0x1400ff9da
mov rax, qword [0x140173a38]
mov qword [0x140173a30], rax
mov ecx, 0x20
call fcn.14010b888
mov rbx, rax
lea rax, str.vmodule
lea r8, [rsp + 0x48]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea r15, [rsp + 0x58]
mov rcx, rdi
mov rdx, r15
call fcn.140095ca0
lea r8, [rsp + 0x20]
mov qword [r8], r14
mov qword [r8 + 8], 1
lea rsi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rsi
call fcn.140095ca0
lea r9, [0x140173a40]
mov rcx, rbx
mov rdx, rsi
mov r8, r15
call fcn.14009f950
mov qword [0x140173a38], rbx
cmp byte [rsi + 0x17], 0
jns 0x1400ff8f8
mov rcx, qword [rsp + 0x30]
call fcn.14010b880
cmp byte [rsp + 0x6f], 0
jns 0x1400ff909
mov rcx, qword [rsp + 0x58]
call fcn.14010b880
mov eax, dword [r12]
mov dword [0x14016df30], eax
mov bl, 1
test al, 1
je 0x1400ff9bd
mov rcx, qword [0x140173a50]
test rcx, rcx
je 0x1400ff94f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140173a50], 0
mov rdi, qword [0x140173a48]
test rdi, rdi
jne 0x1400ff97d
and byte [0x14016df30], 0xfe
jmp 0x1400ff95b
mov rdi, qword [0x140173a48]
test rdi, rdi
jne 0x1400ff97d
mov ecx, 0x18
call fcn.14010b888
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140173a48], rax
mov rsi, qword [r12 + 8]
mov rcx, rsi
call fcn.14010b924
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14001d2fe
cmp dword [r12 + 0x14], 0
jne 0x1400ff9b6
mov rcx, qword [0x140173a48]
cmp byte [rcx + 0x17], 0
jns 0x1400ff9b0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1400ff9e0
mov ebx, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010e4a0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
Function at 0x1400ff9e0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140173a50], 0
jne 0x1400ffbfa
mov rcx, qword [0x140173a48]
test rcx, rcx
je 0x1400ffaf0
test byte [0x14016df30], 1
je 0x1400ffbfa
cmp byte [rcx + 0x17], 0
jns 0x1400ffa37
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140173a50], rax
inc rax
cmp rax, 1
ja 0x1400ffbfa
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140110bf0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400ffbf8
cmp eax, 0x104
ja 0x1400ffbf8
mov rdi, qword [0x140173a48]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.14010b924
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.14001d2fe
mov rcx, qword [0x140173a48]
movzx eax, byte [rcx + 0x17]
test al, al
js 0x1400ffc1b
mov rdx, rcx
jmp 0x1400ffc22
movabs r14, 0x7fffffffffffffef
mov ecx, 0x18
call fcn.14010b888
mov rsi, rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140110bf0
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, rdi
call fcn.14010b924
cmp rax, r14
ja 0x1400ffcb6
mov rdi, rax
cmp rax, 0xb
jae 0x1400ffb63
mov byte [rsi + 0x17], dil
mov r15, rsi
test rdi, rdi
jne 0x1400ffb89
jmp 0x1400ffb9c
lea rbx, [rdi + 8]
and rbx, 0xfffffffffffffff8
lea rcx, [rbx + rbx]
call fcn.14010b888
mov r15, rax
mov qword [rsi], rax
add r14, 0x11
or r14, rbx
mov qword [rsi + 0x10], r14
mov qword [rsi + 8], rdi
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1401107e0
mov word [r15 + rdi*2], 0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ffbb1
mov r8, qword [rsi + 8]
mov rcx, rsi
mov dx, 0x5c
call fcn.14001d574
cmp rax, 0xffffffffffffffff
je 0x1400ffbd8
inc rax
mov rcx, rsi
mov rdx, rax
mov r8, 0xffffffffffffffff
call fcn.14001e834
lea rdx, [0x14014d340]
mov r8d, 9
mov rcx, rsi
call fcn.14001df60
mov qword [0x140173a48], 0
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1400ffc43
lea rdx, [0x14014d33c]
mov r8d, 1
call fcn.14001df60
mov rcx, qword [0x140173a48]
lea rdx, [0x14014d340]
mov r8d, 9
call fcn.14001df60
mov rcx, qword [0x140173a48]
cmp byte [rcx + 0x17], 0
jns 0x1400ffc65
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140173a50], rax
inc rax
cmp rax, 1
ja 0x1400ffbfa
mov qword [0x140173a50], 0
jmp 0x1400ffbf8
mov rcx, rsi
call fcn.1400786f8
int3
Function at 0x1401000d0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140110bf0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x140100180
lea rdi, [rsp + 0x20]
mov qword [rdi], rbx
mov rcx, rbx
call fcn.14010b924
mov qword [rdi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.1400473f0
lea rdi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rdi
call fcn.140054090
mov rcx, r14
mov rdx, rdi
call fcn.140019760
cmp byte [rdi + 0x17], 0
jns 0x14010016f
mov rcx, qword [rsp + 0x48]
call fcn.14010b880
cmp byte [rsp + 0x47], 0
jns 0x140100180
mov rcx, qword [rsp + 0x30]
call fcn.14010b880
cmp esi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14010e4a0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1401001b0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140110bf0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140100229
cmp word [rsp + 0x70], 0
je 0x140100229
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14010b924
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400473f0
jmp 0x140100288
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.1401000d0
test al, al
jne 0x140100277
lea rax, [0x14014d47a]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1400473f0
cmp byte [rsp + 0x57], 0
jns 0x140100288
mov rcx, qword [rsp + 0x40]
call fcn.14010b880
jmp 0x140100288
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14010e4a0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret

Function at 0x140105bd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov esi, dword [0x140178ca0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test ebx, ebx
jne 0x140105c61
lea rcx, [0x140178ca8]
call fcn.1400a5910
mov rax, qword [rdi + 8]
test rax, rax
je 0x140105c26
cmp rax, rsi
je 0x140105c1d
mov ecx, dword [rax]
test ecx, ecx
jne 0x140105c1d
mov dword [rax], 1
mov rax, qword [rax + 0x300]
jmp 0x140105c07
lea rcx, [0x140178ca8]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test rsi, rsi
je 0x140105c59
mov edi, 8
lea rdx, [rsi + rdi]
mov rcx, rsi
xor r8d, r8d
call fcn.1401061c0
add rdi, 0x10
cmp rdi, 0x298
jne 0x140105c3d
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140105bf7
Function at 0x140105f20
Capabilities:
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x1401060b1
mov rsi, rcx
mov byte [rsp + 0x2f], 0xaa
lea r14, [rcx + 8]
mov rcx, r14
call fcn.1400a5910
mov rbx, qword [rsi + 0x718]
mov rdi, qword [rbx]
test rdi, rdi
je 0x140106081
mov byte [rsp + 0x2f], 0
mov rcx, qword [rdi]
call fcn.14010bcbc
mov qword [rbx], rax
inc word [rbx + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [rdi], 0
lea rcx, [rdi + 8]
mov r8d, 0x2e8
xor edx, edx
call fcn.140110bf0
mov qword [rdi + 0x2f0], rsi
lea rcx, [0x140178ca8]
mov qword [rdi + 0x2f8], rcx
xorps xmm0, xmm0
movups xmmword [rdi + 0x300], xmm0
call fcn.1400a5910
mov qword [rdi + 0x308], 0
mov rax, qword [0x140178cb0]
mov qword [0x140178cb0], rdi
mov qword [rdi + 0x300], rax
test rax, rax
je 0x140105fec
mov qword [rax + 0x308], rdi
lea rcx, [0x140178ca8]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add rsi, 0x10
mov eax, 0x12
cmp qword [rsi], 0
je 0x14010602a
mov ecx, dword [rsi + 0x18]
cmp ecx, 0x10000
jae 0x1401060ae
mov word [rdi + rax], cx
cmp ecx, 0x80
ja 0x140106034
mov byte [rdi + rax - 1], 0x80
jmp 0x140106048
mov dword [rdi + rax - 2], 0
jmp 0x140106048
cmp ecx, 0x100
ja 0x140106043
mov byte [rdi + rax - 1], 0x40
jmp 0x140106048
mov byte [rdi + rax - 1], 0x20
add rax, 0x10
add rsi, 0x28
cmp rax, 0x2a2
jne 0x140106002
mov ecx, dword [0x140178ca0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010e4a0
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsi + 0x718]
lea rax, [rsp + 0x2f]
mov qword [rsp + 0x20], rax
mov r9d, 0x310
mov rdx, rsi
mov r8d, 2
call fcn.1400f4c40
mov rdi, rax
jmp 0x140105f7c
int3
int3