joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d970
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006d9ae
movsxd rcx, dword [rsi + 0x2f8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 0x2fc]
jne 0x14006d9ae
cmp qword [rax + rcx], 0
jne 0x14006dab7
mov eax, dword [0x140179c88]
mov ecx, dword [0x1401719a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006dabf
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006dab7
movsxd rcx, dword [0x140179c80]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140179c84]
jne 0x14006dab7
cmp qword [rax + rcx], 0
je 0x14006dab7
mov rdi, qword [0x140179758]
cmp rdi, 1
jbe 0x14006db02
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006dab7
movsxd rcx, dword [rdi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rdi + 4]
jne 0x14006dab7
cmp qword [rax + rcx], 0
je 0x14006dab7
mov eax, dword [0x1401797c8]
test eax, eax
jne 0x14006dbc2
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006db5f
movsxd rcx, dword [rsi + 0x2f0]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 0x2f4]
jne 0x14006db5f
mov rdi, qword [rax + rcx]
test rdi, rdi
je 0x14006db5f
mov rax, qword [rsi + 0x360]
cmp dword [rdi + 0x28], eax
jne 0x14006db4f
mov eax, dword [0x1401797c8]
test eax, eax
jne 0x14006dbdd
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140179c88]
call fcn.14007b4e8
cmp dword [0x140179c88], 0xffffffff
jne 0x14006d9d3
mov qword [0x140179c80], 0
lea rcx, [0x140179c80]
xor edx, edx
call fcn.140050d20
lea rcx, [0x140179c88]
call fcn.14007ac34
jmp 0x14006d9d3
lea rcx, [0x140179758]
call fcn.14004bff0
test al, al
je 0x14006dc05
mov qword [0x140179760], 0
lea rbx, [0x140179758]
lea rdi, [0x140179760]
mov rcx, rdi
xor edx, edx
call fcn.140050d20
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14004be50
jmp 0x14006da20
mov rcx, rdi
call fcn.14000a620
mov rcx, rdi
call fcn.14007a98c
mov ecx, 0x30
call fcn.14007a994
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.1400bacf0
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006dbb2
movsxd rcx, dword [rsi + 0x2f0]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 0x2f4]
movsxd rdx, dword [rsi + 0x2f0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
jmp 0x14006daa9
test rdi, rdi
je 0x14006daa9
call fcn.140008040
jmp 0x14006db89
mov eax, dword [0x1401797c8]
test eax, eax
je 0x14006da5b
call fcn.1400fdae0
inc dword [rax + 0x38]
jmp 0x14006da5b
mov eax, dword [0x1401797c8]
test eax, eax
je 0x14006dab7
call fcn.1400fdae0
mov ecx, dword [rax + 0x38]
test ecx, ecx
je 0x14006dab7
dec ecx
mov dword [rax + 0x38], ecx
jmp 0x14006dab7
mov rdi, qword [0x140179758]
jmp 0x14006da20
Function at 0x14006f246
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, pe_nt_image_headers64
call fcn.14007a994
mov rsi, rax
lea rax, [0x140149170]
mov qword [rsi], rax
lea rax, [0x1400bd0d0]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x14017a570]
lea rdx, [0x140138ff0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14006f385
lea rbx, [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rsi + 0x64], xmm0
movups xmmword [rsi + 0x58], xmm0
movups xmmword [rsi + 0x48], xmm0
movups xmmword [rsi + 0x38], xmm0
movups xmmword [rsi + 0x28], xmm0
movaps xmm0, xmmword [0x140155f60]
movups xmmword [rsi + 8], xmm0
movaps xmm0, xmmword [0x140155f70]
movups xmmword [rsi + 0x18], xmm0
mov dword [rsi + 0x74], 0x20
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
mov rcx, rbx
call fcn.1400495c0
lea rdi, [rsp + 0x30]
movaps xmm0, xmmword [0x140147b90]
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov qword [rdi - 0x10], r12
mov qword [rdi - 8], r14
cmp r14, 0x20
cmovb r12, rdi
mov rcx, r12
mov rdx, rbx
call fcn.1400511c0
mov r8, qword [rdi - 8]
cmp r8, 0x1f
jbe 0x14006f376
test rsi, rsi
je 0x14006f35a
xorps xmm0, xmm0
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx], xmm0
mov rcx, rsi
call fcn.14007a98c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14007d5a0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x20]
mov rdx, rdi
call fcn.14007f530
jmp 0x14006f32f
call fcn.14007bcd0
int3
Function at 0x140075720
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
movaps xmm6, xmmword [0x140147b90]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x88
call fcn.140038cd0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140043760
movabs rbx, 0xaaaaaaaaaaaaaaaa
test esi, esi
js 0x1400758c6
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 0
mov rcx, qword [0x140175b18]
test rcx, rcx
je 0x1400757d9
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
jne 0x1400758f5
lea rdi, [rsp + 0xb0]
mov dword [rdi], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rdi]
cmp qword [rsp + 0x40], 0
jne 0x1400758d0
test byte [0x140170030], 0x19
jne 0x140075853
lea rcx, [rsp + 0x60]
call fcn.14003ce50
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14007d5a0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rbx
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x140170030]
lea r9, [0x140152245]
mov rcx, rdi
mov dl, 0x45
call fcn.14003ce30
mov rax, qword [rdi]
test rax, rax
je 0x1400758ad
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0xb0]
mov qword [rcx], 0
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
call fcn.14003d09e
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140075820
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140075820
mov esi, 0xffffffff
jmp 0x140075817
mov rcx, qword [0x140175b18]
test rcx, rcx
je 0x140075817
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x140075817
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x40]
mov r8, r15
call fcn.1400f59d0
jmp 0x1400757d9
Function at 0x1400759fe
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
test edx, edx
jne 0x140075aad
mov ecx, pe_nt_image_headers64
call fcn.14007a994
mov rdi, rax
lea rax, [0x140149170]
mov qword [rdi], rax
lea rax, [0x1400bd0d0]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14017a570]
lea rdx, [0x140138ff0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140075ab6
xorps xmm0, xmm0
movups xmmword [rdi + 0x64], xmm0
movups xmmword [rdi + 0x58], xmm0
movups xmmword [rdi + 0x48], xmm0
movups xmmword [rdi + 0x38], xmm0
movups xmmword [rdi + 0x28], xmm0
movaps xmm0, xmmword [0x140155f60]
movups xmmword [rdi + 8], xmm0
movaps xmm0, xmmword [0x140155f70]
movups xmmword [rdi + 0x18], xmm0
mov dword [rdi + 0x74], 0x20
mov qword [rsi], rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007d5a0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov qword [rsi], 0
jmp 0x140075a96
call fcn.14007bcd0
int3

Function at 0x140077c60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140139000]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14017a578]
lea rdx, [0x140138ff0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140077d39
cmp dword [0x14017a580], 0
jne 0x140077cfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [0x14017a584]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x140077cfe
mov rsi, qword [rsi]
test rsi, rsi
je 0x140077cfe
mov eax, dword [rsi + 0x204]
xor edi, edi
cmp eax, dword [rsi + 0x200]
jne 0x140077d3e
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007d5a0
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 0x210
call fcn.140067600
test rax, rax
je 0x140077d4d
mov rsi, rax
xor edi, edi
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.14007f940
lea r8, [0x140138ac0]
xor ecx, ecx
mov rdx, rsi
call fcn.1400ae9a0
test eax, eax
jne 0x140077cd8
jmp 0x140077ce8
call fcn.14007bcd0
inc eax
and eax, 0xf
shl rax, 5
mov edi, dword [rsi + rax + 0x10]
jmp 0x140077ce8
xor edi, edi
jmp 0x140077ce8
Function at 0x140077d60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140179c08]
mov ecx, dword [0x1401719a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140077e33
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140077dc1
movsxd rcx, dword [0x140179c00]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140179c04]
jne 0x140077dc1
mov rdi, qword [rax + rcx]
test rdi, rdi
jne 0x140077dc9
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rdi]
test rax, rax
js 0x140077e76
cmp dword [rdi + 0x14], 1
jne 0x140077e80
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x140077ebf
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov rsi, qword [rsi]
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x140077edd
mov rax, qword [rdi]
movabs rcx, 0x6000000000000000
and rcx, rax
movabs rax, 0xffffffffffffff
and rsi, rax
or rsi, rcx
mov qword [rdi], rsi
add dword [rdi + 0x14], 0xffffffff
jmp 0x140077dc1
lea rcx, [0x140179c08]
call fcn.14007b4e8
cmp dword [0x140179c08], 0xffffffff
jne 0x140077d8f
mov qword [0x140179c00], 0
lea rcx, [0x140179c00]
xor edx, edx
call fcn.140050d20
lea rcx, [0x140179c08]
call fcn.14007ac34
jmp 0x140077d8f
call fcn.140128b20
jmp 0x140077dd5
cmp byte [rsi + 8], 0
je 0x140077dfa
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140077eac
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0x4000000000000000
lock or qword [rdi], rax
jmp 0x140077dfa
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x140077dec
mov rbx, qword [rdi]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x140077e0a

Function at 0x140077f00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140179c10]
cmp rsi, 1
jbe 0x140077f4c
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov al, 2
and rcx, 0xfffffffffffffffc
je 0x140077f45
movsxd rdx, dword [rsi]
shl rdx, 4
mov edi, dword [rcx + rdx + 8]
cmp edi, dword [rsi + 4]
jne 0x140077f45
mov rcx, qword [rcx + rdx]
test rcx, rcx
je 0x140077f45
mov al, byte [rcx]
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140179c10]
call fcn.14004bff0
test al, al
je 0x140077f92
mov qword [0x140179c18], 0
lea rdi, [0x140179c10]
lea rsi, [0x140179c18]
mov rcx, rsi
xor edx, edx
call fcn.140050d20
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14004be50
jmp 0x140077f13
mov rsi, qword [0x140179c10]
jmp 0x140077f13
Function at 0x1400a7390
Capabilities:
Create thread

Disassembly:
jmp 0x1400a7390
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.14007a994
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x1400a66f0]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400a7431
test rbp, rbp
je 0x1400a7461
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007d5a0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400a744a
mov ebp, eax
cmp eax, 0x5af
je 0x1400a744a
cmp ebp, 0xe
jne 0x1400a746c
mov rcx, r15
call fcn.1400f8080
test r14, r14
je 0x1400a740f
mov rcx, r14
call fcn.14007a98c
jmp 0x1400a740f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a740f
mov eax, dword [0x140175b80]
mov ecx, dword [0x1401719a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400a74db
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.1400fb400
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x140175b78]
call fcn.14003ef40
cmp byte [rsi + 0x17], 0
jns 0x1400a7452
mov rcx, qword [rsp + 0x38]
call fcn.14007a98c
jmp 0x1400a7452
lea rcx, [0x140175b80]
call fcn.14007b4e8
cmp dword [0x140175b80], 0xffffffff
jne 0x1400a748d
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400a6c10
mov qword [0x140175b78], rax
lea rcx, [0x140175b80]
call fcn.14007ac34
jmp 0x1400a748d
Function at 0x1400a9580
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
test esi, esi
je 0x1400a967f
mov rdi, rdx
mov rbx, rsi
shr rbx, 0x20
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a963d
movsxd rcx, dword [0x140175f10]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140175f14]
jne 0x1400a963d
cmp qword [rax + rcx], 0
je 0x1400a963d
mov ecx, dword [0x140171588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a96c8
movsxd rcx, dword [0x140175f10]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140175f14]
jne 0x1400a96c8
mov rcx, qword [rax + rcx]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400a963d
cmp dword [rax + 0x2610], esi
jne 0x1400a963d
mov edx, ebx
and edx, 0x3ffffff
cmp rdx, qword [rcx + 0x20]
jne 0x1400a963d
mov rcx, rsi
shr rcx, 0x3a
imul rcx, rcx, 0x98
add rax, rcx
add rax, 0x10
jne 0x1400a9681
test rdi, rdi
je 0x1400a9648
cmp byte [rdi + 8], 0
je 0x1400a96a8
mov rax, qword [0x140175f50]
test rax, rax
je 0x1400a968b
and ebx, 0x3ffffff
cmp rbx, qword [0x140175f58]
jne 0x1400a968b
cmp dword [rax + 0x2610], esi
jne 0x1400a967f
shr rsi, 0x3a
imul rcx, rsi, 0x98
add rax, rcx
add rax, 0x10
jmp 0x1400a9681
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140175c40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax
mov r14, qword [rdi]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400a96be
mov byte [rdi + 8], 1
jmp 0x1400a9648
mov rcx, r14
call fcn.140039d60
jmp 0x1400a96b8
xor ecx, ecx
jmp 0x1400a9607
Function at 0x1400ac140
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x1400ac22c
cmp qword [rsi], 0
jne 0x1400ac22c
cmp dword [rsi + 0x14], 0
jne 0x1400ac22c
cmp qword [rsi + 8], 0
jne 0x1400ac22c
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x1400ac1af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400ac1fe
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400ac1a7
mov qword [rsi], rbx
call fcn.14003af20
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x1400ac1e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400ac214
lea rax, [rbp + 1]
cmp rax, 2
jb 0x1400ac1e1
mov qword [rsi + 8], rbp
call fcn.14003af20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.14003af20
mov rcx, qword [rsi]
call fcn.1400337d0
mov qword [rsi], 0
jmp 0x1400ac195
call fcn.14003af20
mov rcx, qword [rsi + 8]
call fcn.1400337d0
mov qword [rsi + 8], 0
jmp 0x1400ac1ce
mov rcx, rsi
call fcn.1400ac0a0
mov rax, qword [rsi]
jmp 0x1400ac179

Function at 0x1400ac670
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 4
lea r15, [rsp + 0x3c]
mov dword [r15], eax
lea r12, [rsp + 0x38]
mov dword [r12], eax
lea rsi, [rsp + 0x34]
mov dword [rsi], 0
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.140038cd0
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ac732
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400ac715
cmp dword [rsp + 0x38], 4
jne 0x1400ac715
mov eax, dword [rsp + 0x34]
mov dword [r14], eax
xor edi, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007d5a0
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x1400ac715
Function at 0x1400ad0ff
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14007f940
xor ebx, ebx
lea r14, str.PROGRAMFILES
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r14]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call r15
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400ad17a
mov edx, eax
mov rcx, rdi
mov r8, rsi
call fcn.1400ad1ac
test al, al
jne 0x1400ad1a7
add rbx, 8
cmp rbx, 0x18
jne 0x1400ad147
xor esi, esi
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14007d5a0
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov sil, 1
jmp 0x1400ad186

Function at 0x1400ad2eb
Capabilities:
Get common file path
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov eax, dword [0x140175b0c]
mov ecx, dword [0x1401719a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400ad429
lea rcx, [0x140175b0c]
call fcn.14007b4e8
cmp dword [0x140175b0c], 0xffffffff
jne 0x1400ad429
movabs r14, 0x7fffffffffffffef
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.14007f940
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [0x140147b90]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rsi
call fcn.14007adcc
cmp rax, r14
ja 0x1400ad480
mov rsi, rax
cmp rax, 0xb
jae 0x1400ad450
lea rbx, [rsp + 0x20]
mov byte [rbx + 0x17], sil
mov rdi, rbx
test rsi, rsi
je 0x1400ad3d8
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007f530
mov word [rdi + rsi*2], 0
lea rdx, str.usp10.dll
lea rcx, [rsp + 0x20]
call fcn.14004a6dc
cmp byte [rax + 0x17], 0
jns 0x1400ad3f8
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [rbx + 0x17], 0
jns 0x1400ad413
mov rcx, qword [rsp + 0x20]
call fcn.14007a98c
cmp esi, 0xffffffff
setne byte [0x140175b08]
lea rcx, [0x140175b0c]
call fcn.14007ac34
mov bl, byte [0x140175b08]
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14007d5a0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea r15, [rsi + 8]
and r15, 0xfffffffffffffff8
lea rcx, [r15 + r15]
call fcn.14007a994
mov rdi, rax
lea rbx, [rsp + 0x20]
mov qword [rbx], rax
add r14, 0x11
or r14, r15
mov qword [rbx + 0x10], r14
mov qword [rbx + 8], rsi
jmp 0x1400ad3c5
lea rcx, [rsp + 0x20]
call fcn.1400da168
int3
Function at 0x1400adc4e
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14016e028]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x1400adc82
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400add7c
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x1400add7c
cmp edi, 2
lea rax, [0x140177780]
lea rcx, [0x140177980]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400add7c
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400add7c
cmp byte [0x140177770], 0
setne al
bt ebx, 8
jb 0x1400add7c
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400add7c
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x1400addd7
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x1400add69
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
call fcn.14007ad3c
test eax, eax
je 0x1400add9b
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x1400add4b
cmp dword [rsp + 0x2c], 0
jne 0x1400adddf
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007d5a0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [rbx + rdi*2]
cmp cx, 0x5c
je 0x1400addaa
test cx, cx
jne 0x1400add69
lea rax, [rbx + rdi*2]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x1400ade07
cmp dword [rsp + 0x2c], 2
jne 0x1400ade18
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400ade18
mov rbx, r12
jmp 0x1400add2c
cmp byte [r12 + 0x17], 0
js 0x1400ade47
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.1400f4b80
jmp 0x1400add7c
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
cmp cx, 0x5c
jne 0x1400ade31
lea rbx, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x1400ade1e
jmp 0x1400ade34
mov rbx, rax
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
xor r15d, r15d
mov r13, rbp
jmp 0x1400add70
mov rax, qword [r12]
jmp 0x1400addea