joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a260
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
movzx edi, cl
lea rax, [rdi - 0x60]
cmp rax, 9
ja 0x14001a2e5
sub rdi, 0x30
mov rbx, rdi
test rdi, rdi
je 0x14001a2d7
cmp rdi, 0x11
je 0x14001a2a1
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001a2a1
mov rbx, rdi
bts rbx, 0xd
cmp rbx, 0x10
je 0x14001a2bc
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001a2bc
bts rbx, 0xf
cmp rbx, 0x12
je 0x14001a2d7
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001a2d7
bts rbx, 0xe
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rdi, 0x6d
jne 0x14001a2f4
mov edi, 0xbd
mov ebx, edi
jmp 0x14001a289
cmp rdi, 0x6e
jne 0x14001a303
mov edi, 0xbe
mov ebx, edi
jmp 0x14001a289
cmp rdi, 0x6f
jne 0x14001a315
mov edi, 0xbf
mov ebx, edi
jmp 0x14001a289
lea rax, [0x1400480e0]
mov rax, qword [rax + rdi*8]
cmp word [rax], 0
jne 0x14001a27b
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14001ce70
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14001cf25
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14001cef1
lea rcx, [0x14004b1c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14001cf09
lea rdx, [0x14004b1e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14001cf09
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14001cf09
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14005b618], 0
jne 0x14001cf70
lea rcx, [0x14004b1c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001cf60
lea rdx, [0x14004b220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005b610], rax
mov byte [0x14005b618], 1
jmp 0x14001cf77
mov rax, qword [0x14005b610]
mov byte [0x14005b618], 1
jmp 0x14001cf77
mov rax, qword [0x14005b610]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14001cefa
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
movabs dword [0x211404247043bc15], eax
je 0x14009672c
invalid
movabs al, byte [0x78e48fa8b6f18e1]
mov byte [rbp - 0x1c], WSACleanup
ret
Function at 0x14001d830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140058010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001d8b5
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001d8b5
call fcn.14001cc90
mov ebx, eax
jmp 0x14001d9d7
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14001d8d6
call fcn.14001cc90
jmp 0x14001d9c6
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14001d8f9
call fcn.14001cc90
jmp 0x14001d9c6
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14001d91b
mov ebx, 0x8007000e
jmp 0x14001d9c8
mov ecx, eax
test eax, eax
je 0x14001d950
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14001da0f
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14001d950
lea rcx, [rsp + 0x60]
call fcn.140020be0
jmp 0x14001d95a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14001d96d
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14001d97e
mov ebx, 0x8007000e
jmp 0x14001d9c8
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14001d9a3
call fcn.14001cc90
jmp 0x14001d9c6
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14001e920
mov ebx, eax
test rdi, rdi
je 0x14001d9d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14001d9ee
lea rcx, [rsp + 0x60]
call fcn.140020bd0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140025910
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140001260
int3
Function at 0x140023ee0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
cmp qword [rcx + 8], 0
je 0x140024033
xor edi, edi
cmp qword [rcx + 0xe0], rdi
je 0x140024007
cmp qword [rcx + 0xe8], rdi
je 0x140023f22
mov edi, 0xc80000
jmp 0x140023fe2
call fcn.1400013b0
mov rcx, rax
test rax, rax
je 0x140024046
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
test ebp, ebp
js 0x140024051
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x140023f79
mov edx, ebp
lea rcx, [rsp + 0x40]
call fcn.140024360
mov rbx, qword [rsp + 0x40]
mov r8d, ebp
mov rdx, rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x140023f9a
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14003053c
test eax, eax
js 0x140024051
cmp eax, dword [rbx - 0xc]
jg 0x140024051
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
cmp dword [rbx - 0x10], 0
je 0x140023fc6
mov eax, 0xc00000
cmp word [rbx], 0
cmovne edi, eax
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023fe2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 0x410000
mov ecx, 0x400000
cmp qword [rsi + 0xf0], 0
cmove eax, ecx
or edi, eax
cmp qword [rsi + 0xf8], 0
je 0x140024007
bts edi, 0x11
mov edx, 0xfffffff0
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xcb0000
cmp eax, edi
je 0x140024033
mov r9d, 0x37
mov r8d, edi
mov edx, eax
lea rcx, [rsi + 8]
call fcn.140014b70
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140001260
nop
mov ecx, 0x80070057
call fcn.140001260
int3

Function at 0x140026530
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002657a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002657a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002657a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002657a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002657a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002657c
xor al, al
add rsp, 0x28
ret
Function at 0x14002c408
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002c273
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002c273
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002c273
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002c273
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002c273
cmp dword [rcx + 0x84], 0xe
jbe 0x14002c273
cmp dword [rcx + 0xf8], 0
je 0x14002c273
mov ecx, ebx
call fcn.14002c324
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002c100
nop
cmp dword [rbp + 0x20], 0
je 0x14002c2c1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002c2cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002c204
Function at 0x1400362b8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003633f
mov rsi, rbx
cmp word [rax], bp
je 0x1400362fe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400362e8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400362e4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140033b0c
mov rdi, rax
test rax, rax
je 0x14003632c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400279b0
mov rbp, rdi
xor ecx, ecx
call fcn.140031874
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180008f84
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180008fb4
xor eax, eax
jmp 0x180009077
mov rbp, rbx
cmp word [rax], si
je 0x180008fd9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180008fc0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180008fbc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180008ea4
movsxd r14, eax
test eax, eax
jne 0x180009017
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180008fad
mov rcx, r14
call fcn.18000a214
mov rdi, rax
test rax, rax
jne 0x180009030
xor ecx, ecx
call fcn.180007578
jmp 0x18000900c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180008ea4
test eax, eax
jne 0x180009061
mov rcx, rdi
call fcn.180007578
jmp 0x18000906b
xor ecx, ecx
call fcn.180007578
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000e774
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x18000e7ec
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x18000e7ec
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x18000e7ec
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x18000e7e0
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x18000e7fe
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x18000e7ce
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x18000e7ee

Function at 0x18000ecb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000ecd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000ecd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000ebc0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x50]
mov qword [r15 + 0x40], rax
movaps xmm0, xmmword [0x14026cc70]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r12, [rsp + 0x30]
mov rcx, r12
mov r9d, 0x97
call fcn.1400ed1b0
xor esi, esi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.140116070
test edi, edi
js 0x14000eca9
lea r15, [rsp + 0x30]
mov dword [r15], 0xaaaaaaaa
mov rcx, qword [r14]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, edi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [r15]
lea rcx, [rsp + 0x50]
call fcn.140115ba0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140186020
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14000ec7c

Function at 0x140014bd0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140014c1c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140014c27
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140014c0a
mov qword [rdi], rsi
call fcn.1400ea220
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400ea220
mov r14, qword [rdi]
cmp qword [0x1402b6720], 0
je 0x140014c58
mov rcx, qword [0x1402b6720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402c9008]
mov qword [rdi], 0
jmp 0x140014bf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014c99
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140014c93
call qword [0x1402c9008]
mov rcx, rax
xor edx, edx
call fcn.140014550
jmp 0x140014c39
xor ecx, ecx
mov dl, 1
jmp 0x140014c8c
xor ecx, ecx
jmp 0x140014c8a
Function at 0x1400190e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1028
call fcn.140185fc0
sub rsp, rax
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, dword [0x1402ab12c]
cmp esi, 0xffffffff
je 0x140019193
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400191c5
lea rdi, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.140188160
lea rdx, [rsp + 0x23]
mov r14, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call r14
mov ecx, 0x1000
call fcn.140183658
mov rbx, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rdi
call fcn.140187ab0
mov rdx, rbx
or rdx, 3
mov ecx, esi
call r14
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140186020
mov rax, rbx
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400191c8
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x1402ab12c], esi
je 0x140019113
mov ecx, esi
call sub.KERNEL32.dll_TlsFree
mov esi, dword [0x1402ab12c]
jmp 0x140019113
int3
int3

Function at 0x14001a090
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
lea rax, [0x14026f618]
mov qword [rcx], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x14001a100
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14001a10b
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001a0f8
mov qword [rsi + 0x18], rdi
call fcn.1400ea220
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400ea220
mov rcx, qword [rsi + 0x18]
call fcn.140134ed0
mov qword [rsi + 0x18], 0
jmp 0x14001a0e5
Function at 0x14001f670
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xfffffffc00000000
shl ebp, 0x10
mov ecx, 0x18
call fcn.1401833f4
mov rsi, rax
mov rax, r15
and rax, r12
cmp rax, qword [0x14029be48]
je 0x14001f73e
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x140004120]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14001f753
test r14, r14
je 0x14001f748
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140186020
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.1400dc910
jmp 0x14001f6d5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001f718
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14001f76c
mov ebp, eax
cmp eax, 0x5af
je 0x14001f76c
cmp ebp, 0xe
jne 0x14001f797
mov rcx, rbx
call fcn.1401c9550
test rsi, rsi
je 0x14001f718
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x14029be48]
jne 0x14001f78d
call fcn.1400dca60
mov rcx, rsi
call fcn.1401833ec
jmp 0x14001f718
mov eax, dword [0x1402b6478]
mov ecx, dword [0x1402ab5e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001f81a
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.1400b9720
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
jns 0x14001f7dd
mov r8, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
jmp 0x14001f7e1
and r8d, 0x7f
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, rbx
call fcn.140180c80
mov rcx, qword [0x1402b6470]
mov rdx, r14
call fcn.140008da0
cmp byte [rsp + 0x4f], 0
jns 0x14001f774
mov rcx, qword [rsp + 0x38]
call fcn.1401833ec
jmp 0x14001f774
lea rcx, [0x1402b6478]
call fcn.140183590
cmp dword [0x1402b6478], 0xffffffff
jne 0x14001f7b8
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140007be0
mov qword [0x1402b6470], rax
lea rcx, [0x1402b6478]
call fcn.1401835f8
jmp 0x14001f7b8
Function at 0x1400206d0
Capabilities:
Get file size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], r15
movaps xmm0, xmmword [0x14026cc70]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xac
call fcn.1400ed1b0
xor ebx, ebx
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140116070
mov qword [r14], r15
mov rcx, qword [rdi]
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rbx, rbx
or rbx, qword [rdi]
mov rcx, rsi
call fcn.140115ba0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140186020
mov rax, rbx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400211b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 1
xor eax, eax
lock cmpxchg qword [rsi], rcx
sete bl
jne 0x140021203
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140186020
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi]
cmp rax, 1
jne 0x1400211e3
movabs r15, 0x8637bd05af7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x20], rax
mov rax, qword [fcn.140106270]
lea r12, [0x140181ca0]
cmp rax, r12
jne 0x14002130b
lea rdi, [rsp + 0x28]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
cmp rax, r15
jge 0x14002134e
imul rax, rax, 0xf4240
cqo
idiv qword [0x1402b6458]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movabs rbp, 0x7fffffffffffffff
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [fcn.140106270]
cmp rax, r12
jne 0x1400212f6
mov qword [rsp + 0x28], 0
mov rcx, rdi
call r13
mov rax, qword [rsp + 0x28]
cmp rax, r15
jge 0x140021327
imul rax, rax, 0xf4240
cqo
idiv qword [0x1402b6458]
mov rcx, qword [rsp + 0x20]
xor edx, edx
cmp rax, rcx
setns dl
add rdx, rbp
sub rax, rcx
cmovo rax, rdx
cmp rax, 0x3e7
jg 0x14002131b
xor ecx, ecx
call r14
mov rax, qword [rsi]
cmp rax, 1
je 0x14002128f
jmp 0x1400211e3
lea rcx, [rsp + 0x28]
call qword [0x1402c9008]
lea rax, [rsp + 0x28]
mov rax, qword [rax]
jmp 0x1400212c4
lea rcx, [rsp + 0x20]
call qword [0x1402c9008]
jmp 0x140021272
mov ecx, 0x3e8
call fcn.1401f6820
jmp 0x1400212e8
mov rcx, qword [0x1402b6458]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x1400212c4
mov rcx, qword [0x1402b6458]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x14002126d