joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f050
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140090d80
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002f0e5
cmp word [rsp + 0x70], 0
je 0x14002f0e5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1400ad360
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140066b00
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14008ec50
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14010dbf0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1400669d0
mov rcx, rdi
call fcn.14002ef80
test al, al
je 0x14002f125
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140066ae0
jmp 0x14002f144
lea rax, [0x1401112b6]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.140066b00
lea rcx, [rsp + 0x40]
call fcn.140066c80
jmp 0x14002f0c7
Function at 0x14002f960
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea r14, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.140090d80
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14003e360
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14010dbf0]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14003e560
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x14002f9f8
mov rax, qword [rsp + 0x38]
jmp 0x14002f9fb
and eax, 0x7f
test rax, rax
jne 0x14002fa3d
lea rcx, [rsp + 0x30]
call fcn.140066c80
lea rcx, [rsp + 0x298]
call fcn.14003e4b0
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.14008ec50
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r12d, r12d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.140090d80
mov rcx, r15
mov rdx, r14
call fcn.14003e520
mov edx, dword [rsp + 0x48]
test dl, 1
jne 0x14002fb5e
mov rcx, r14
call fcn.14003e330
test al, al
jne 0x14002fb0d
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x14002fa9b
mov rcx, qword [rsp + 0x30]
call r13
test eax, eax
jne 0x14002fb93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
call fcn.140019c10
mov rcx, r15
mov rdx, r14
call fcn.14003e560
mov rcx, rdi
mov rdx, r14
call fcn.14002b110
mov rcx, r14
call fcn.140066c80
movzx eax, byte [rsp + 0x47]
test al, al
jns 0x14002faf9
mov rax, qword [rsp + 0x38]
jmp 0x14002fafc
and eax, 0x7f
mov r12d, ebp
test rax, rax
je 0x14002fa00
jmp 0x14002fa54
xor ebp, ebp
test bl, bl
je 0x14002fabc
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.14002f960
test eax, eax
jne 0x14002fbb0
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x14002fb38
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14002fabc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x14002fabc
test bl, bl
je 0x14002fb73
and edx, 0xfffffffe
cmp byte [rsp + 0x47], 0
jns 0x14002fb9a
mov rcx, qword [rsp + 0x30]
jmp 0x14002fb9f
lea rcx, [rsp + 0x48]
call fcn.14003e330
test al, al
je 0x14002fbaa
lea rcx, [rsp + 0x48]
call fcn.14003e330
test al, al
je 0x14002fa8c
xor ebp, ebp
jmp 0x14002fabc
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x14002fa7c
mov edx, dword [rsp + 0x48]
jmp 0x14002fb62
mov ebp, eax
jmp 0x14002fabc
Function at 0x14002fc30
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14002fc77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002fc91
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002fc6f
mov qword [rsi], rdi
call fcn.140072d50
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14002fca7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140072d50
mov rcx, qword [rsi]
call fcn.140074250
mov qword [rsi], 0
jmp 0x14002fc5d
int3

Function at 0x1400310e0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400311d7
mov ebx, eax
mov edx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x20]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x14010dbf0]
movaps xmmword [r14], xmm0
mov rcx, r14
xor r8d, r8d
call fcn.140022410
cmp byte [r14 + 0x17], 0
jns 0x14003114d
mov r14, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400311c7
mov edx, eax
movzx eax, byte [rsp + 0x37]
test al, al
jns 0x140031172
mov rax, qword [rsp + 0x28]
jmp 0x140031175
and eax, 0x7f
cmp rax, rdx
jbe 0x1400311c7
lea rdi, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.140065fc0
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
xorps xmm0, xmm0
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
cmp byte [rsp + 0x37], 0
js 0x1400311e7
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008ec50
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x1400311a6
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x1400311ad
mov rcx, qword [rsp + 0x20]
call fcn.14008d7f8
jmp 0x1400311ad
Function at 0x140031750
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x17], 0
mov rsi, rcx
jns 0x140031778
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400317ab
test al, 0x10
jne 0x140031843
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.140031930
xor edi, edi
jmp 0x14003185c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
movzx eax, byte [rdi + 0x17]
mov r9d, eax
and r9d, 0x7f
test al, al
mov rax, qword [rdi]
cmovns rax, rdi
cmovs r9, qword [rdi + 8]
add r9, r9
test r9, r9
je 0x1400317f7
movzx ecx, word [rax + r9 - 2]
add r9, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x1400317f1
cmp ecx, 0x2f
jne 0x1400317d8
cmp r9, 0xfffffffffffffffe
jne 0x140031876
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x140031830
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
je 0x1400318d8
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.140031930
xor edi, edi
cmp byte [rsp + 0x57], 0
jns 0x14003185c
mov rcx, qword [rsp + 0x40]
call fcn.14008d7f8
jmp 0x14003185c
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.140031930
mov dil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008ec50
mov eax, edi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
sar r9, 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x28]
mov rdx, rdi
xor r8d, r8d
call fcn.140027a70
cmp byte [rsp + 0x57], 0
jns 0x1400318a4
mov rcx, qword [rsp + 0x40]
call fcn.14008d7f8
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rcx], xmm0
call fcn.140031750
test al, al
jne 0x1400317f7
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.140031930
jmp 0x14003182e
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rsi
call fcn.1400c0e20
cmp byte [r14 + 0x17], 0
jns 0x1400318f4
mov r14, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
setne al
and ebp, 0x10
shr ebp, 4
and bpl, al
cmp byte [rsp + 0x3f], 0
jns 0x14003191f
mov rcx, qword [rsp + 0x28]
call fcn.14008d7f8
test bpl, bpl
je 0x14003181c
jmp 0x140031830
Function at 0x140031930
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.140060650
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x14013bb50]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.140092040
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008ec50
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140032480
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140090d80
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140032515
mov eax, eax
inc rax
cmp rax, 1
je 0x140032515
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x1400324e1
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140032502
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1400a8804
test eax, eax
je 0x1400325f4
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140032576
mov eax, eax
inc rax
cmp rax, 1
je 0x140032576
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x140032542
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140032563
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1400a8804
test eax, eax
je 0x140032602
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400325d3
mov eax, eax
inc rax
cmp rax, 1
je 0x1400325d3
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x1400325a3
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400325c4
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1400a8804
test eax, eax
je 0x140032610
xor ebx, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14008ec50
mov eax, ebx
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14003261e
mov rax, qword [rsi + 8]
jmp 0x140032621
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14003263f
mov rax, qword [rsi + 8]
jmp 0x140032642
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140032663
mov rax, qword [rsi + 8]
jmp 0x140032666
and eax, 0x7f
mov bl, 1
cmp rax, r14
je 0x1400325d5
mov rcx, rsi
mov rdx, r14
call fcn.1400d1c00
cmp word [rax], 0x5c
jne 0x140032515
jmp 0x1400325d5
and eax, 0x7f
mov bl, 1
cmp rax, r14
je 0x1400325d5
mov rcx, rsi
mov rdx, r14
call fcn.1400d1c00
cmp word [rax], 0x5c
jne 0x140032576
jmp 0x1400325d5
and eax, 0x7f
mov bl, 1
cmp rax, r14
je 0x1400325d5
mov rcx, rsi
mov rdx, r14
call fcn.1400d1c00
cmp word [rax], 0x5c
jne 0x1400325d3
jmp 0x1400325d5
Function at 0x140032d70
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdx, qword [0x14013c350]
test rdx, rdx
jne 0x140032e87
mov ecx, 0x18
call fcn.14008d7bc
mov rbx, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [0x14013c350], rax
mov ecx, 0x18
call fcn.14008d7bc
mov r14, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], r15
mov qword [0x14013c358], rax
call fcn.140030790
mov rax, qword [rax + 8]
mov r15, qword [rax + 0x10]
lea rdx, str.user_data_dir
lea r12, [rsp + 0x38]
mov rcx, r12
call fcn.1400c0e20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r13, [rsp + 0x20]
mov rcx, r13
mov rdx, rax
call fcn.1400c0e20
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.140030ca0
mov rcx, rbp
mov rdx, r15
mov r8, rbx
mov r9, r14
call fcn.1400327d0
mov ebx, eax
cmp byte [rbp + 0x17], 0
jns 0x140032e56
mov rcx, qword [rsp + 0x50]
call fcn.14008d7f8
cmp byte [rsp + 0x37], 0
jns 0x140032e67
mov rcx, qword [rsp + 0x20]
call fcn.14008d7f8
cmp byte [rsp + 0x4f], 0
jns 0x140032e78
mov rcx, qword [rsp + 0x38]
call fcn.14008d7f8
test bl, bl
je 0x140032f6e
mov rdx, qword [0x14013c350]
cmp rdx, rdi
je 0x140032eb2
cmp byte [rdi + 0x17], 0
movzx r8d, byte [rdx + 0x17]
js 0x140032f30
test r8b, r8b
jns 0x140032f10
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rdi
mov rdx, rax
call fcn.140027ca0
mov dil, 1
test rsi, rsi
je 0x140032ee8
mov rdx, qword [0x14013c358]
cmp rdx, rsi
je 0x140032ee8
cmp byte [rsi + 0x17], 0
movzx r8d, byte [rdx + 0x17]
js 0x140032f3e
test r8b, r8b
jns 0x140032f20
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, rax
call fcn.140027ca0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008ec50
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdx + 0x10]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rdi], xmm0
jmp 0x140032eb2
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x140032ee8
test r8b, r8b
jns 0x140032f4c
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
jmp 0x140032f50
test r8b, r8b
jns 0x140032f5d
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
jmp 0x140032f61
and r8d, 0x7f
mov rcx, rdi
call fcn.140027bb0
jmp 0x140032eb2
and r8d, 0x7f
mov rcx, rsi
call fcn.140027bb0
jmp 0x140032ee8
xor edi, edi
jmp 0x140032ee8
Function at 0x14003d000
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x14003d03f
test r15, r15
je 0x14003d12d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x14003d089
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.1400906d0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x14003d01d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x14003d159
lea rcx, [r12*8]
call fcn.14008d7bc
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x14003d0fd
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x14003d12d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x14003d0e5
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x14003d01d
mov rcx, r14
call fcn.14008d7f8
mov r15, qword [rsi + 0x10]
jmp 0x14003d01d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.1400c1730
call fcn.1400c0f30
int3
Function at 0x14003d490
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x50]
mov qword [r14 + 0x50], r12
movaps xmm0, xmmword [0x14010dbf0]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, [0x140113520]
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x93
call fcn.140072d30
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140072d60
test esi, esi
js 0x14003d59f
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.14007ec00
test al, al
jne 0x14003d5a6
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.14007ec90
lea rcx, [rsp + 0x50]
call fcn.140072dc0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14008ec50
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14003d572
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400e8d10
jmp 0x14003d537
Function at 0x14003d730
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x14010dbf0]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, [0x140113520]
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x16f
call fcn.140072d30
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140072d60
mov eax, edi
and eax, 1
neg eax
and eax, 3
test dil, 2
mov edx, 1
cmove edx, eax
test dil, 4
mov ecx, 4
cmovne edx, ecx
test dil, 8
mov r8d, 2
cmove r8d, edx
test dil, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x14003d997
mov edx, edi
and edx, 0x40
shl edx, 0x18
test dil, 0x80
cmove ecx, edx
mov edx, edi
rol edx, 0x1a
mov r8d, edi
shl r8d, 0xb
and r8d, 0x20000000
mov r9d, edi
shr r9d, 4
and r9d, 0x10000
and edx, 0x80000100
or edx, r8d
or edx, r9d
or edx, ecx
mov ecx, edi
shr ecx, 8
and ecx, 3
mov r8d, edi
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r14d, edi
and r14d, 0x400
mov ecx, r14d
shl ecx, 0x14
mov r9d, edi
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, edi
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r9d, edi
shl r9d, 0xd
and r9d, 0x4000000
or r9d, ecx
mov ecx, edi
shl ecx, 8
and ecx, 0xa000000
or ecx, r9d
cmp byte [rbx + 0x17], 0
jns 0x14003d8ac
mov rbx, qword [rbx]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov rcx, rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp qword [rsi], rax
je 0x14003d908
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003d97e
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14003d8fd
mov qword [rsi], rbx
call fcn.140072d50
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi]
inc rbx
cmp rbx, 2
jb 0x14003d95b
shr r14d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r14b
test dil, 4
jne 0x14003d96d
test dil, 0xa
je 0x14003d930
mov byte [rsi + 0x28], 1
lea rcx, [rsp + 0x60]
call fcn.140072dc0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008ec50
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003d5d0
mov dword [rsi + 0x24], eax
jmp 0x14003d930
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x14003d930
call fcn.140072d50
mov rcx, qword [rsi]
call fcn.140074250
mov qword [rsi], 0
jmp 0x14003d8e9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
jmp 0x14003d930
Function at 0x14003dba0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14003d460
mov qword [rsi], 0
test rax, rax
je 0x14003dbf3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003dc27
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14003dbeb
mov qword [rsi], rbx
call fcn.140072d50
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.1400669f0
lea rcx, [rsi + 0x20]
call fcn.14007ec20
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140072d50
mov rcx, qword [rsi]
call fcn.140074250
mov qword [rsi], 0
jmp 0x14003dbd9
Function at 0x14003ef80
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [rcx], 0
je 0x14003ef8d
mov ecx, dword [rcx + 4]
jmp fcn.1400505d0
ret

Function at 0x14003f360
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xc0]
mov rax, qword [0x140129038]
xor rax, rsp
mov qword [rsp + 0x58], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14008d7bc
mov rsi, rax
mov rcx, r15
btr rcx, 0x3f
mov rax, qword [0x14012b720]
and rax, rcx
cmp rax, qword [0x14012b708]
je 0x14003f430
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14003f870]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14003f437
test r14, r14
je 0x14003f48c
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008ec50
mov eax, ebx
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14006cba0
jmp 0x14003f3c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14003f450
mov ebp, eax
cmp eax, 0x5af
je 0x14003f450
cmp ebp, 0xe
jne 0x14003f49a
mov rcx, rbx
call fcn.1400e1850
test rsi, rsi
je 0x14003f40c
movabs rcx, 0x7fffffffffffffff
and rcx, qword [rsi]
mov rax, qword [0x14012b720]
and rax, rcx
cmp rax, qword [0x14012b708]
jne 0x14003f482
call fcn.14006ccf0
mov rcx, rsi
call fcn.14008d7f8
jmp 0x14003f40c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003f40c
mov eax, dword [0x14013c608]
mov ecx, dword [0x140138f34]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003f512
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, ebp
call fcn.14003dd40
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
cmovs rcx, qword [rbx + 8]
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, qword [0x14013c600]
call fcn.14007ddf0
cmp byte [rbx + 0x17], 0
jns 0x14003f458
mov rcx, qword [rsp + 0x30]
call fcn.14008d7f8
jmp 0x14003f458
lea rcx, [0x14013c608]
call fcn.14008d910
cmp dword [0x14013c608], 0xffffffff
jne 0x14003f4bb
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.14004ec80
mov qword [0x14013c600], rax
lea rcx, [0x14013c608]
call fcn.14008d9a8
jmp 0x14003f4bb