joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140207d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1403bc150]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str........._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1ff
call fcn.1402fdb30
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1402f5580
cmp byte [rdi + 0x17], 0
jns 0x140207e10
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1402f57b0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140319a10
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x140207e50
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.14031b780
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x140207eef
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14033c934
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1402fe610
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.140210f80
mov rcx, rsi
mov rdx, r14
call fcn.1402fe7b0
mov rcx, r14
call fcn.1402fe7a0
mov rcx, rbx
call fcn.1402fe7a0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140319a10
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140207f20
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14031b780
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140207fb5
cmp word [rsp + 0x70], 0
je 0x140207fb5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14033c934
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1402fe610
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140319a10
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1403bc150]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1402fe5d0
mov rcx, rdi
call fcn.140207e50
test al, al
je 0x140207ff5
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1402fe5f0
jmp 0x140208014
lea rax, [0x1403c1a8a]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1402fe610
lea rcx, [rsp + 0x40]
call fcn.1402fe7a0
jmp 0x140207f97
Function at 0x140208310
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x24]
mov dword [r8], 1
movsxd rcx, ecx
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140319a10
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140208d30
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x140208e30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.14032b24c
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x80]
mov qword [r14 + 0x40], rax
movaps xmm6, xmmword [0x1403bc150]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str........._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x48
call fcn.1402fdb30
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1402f5580
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.14032b224
mov ecx, eax
call fcn.14032baec
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140208e37
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
jmp 0x140208e3d
xor ebx, ebx
jmp 0x140208f09
mov r14d, 0xffff
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [case.0x140318756.0]
xor r13d, r13d
mov ebp, 0x10000
lea r15, [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
add rcx, r13
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.1403357a0
test rax, rax
je 0x140208ed7
mov r12, rax
mov rax, rdi
sub rax, r13
cmp rax, r12
jb 0x140208ed0
add r12, r13
mov rcx, rbx
call fcn.140334cf4
test eax, eax
jne 0x140208ed4
test r13, r13
cmove r14, rbp
lea r8, [r12 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov rcx, r15
call qword [case.0x140318756.0]
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
mov r13, r12
jmp 0x140208e6c
xor ebx, ebx
jmp 0x140208ee7
mov r13, r12
mov rcx, rbx
call fcn.140334d20
test eax, eax
sete bl
mov rdi, r13
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [case.0x140318756.0]
lea rcx, [rsp + 0x80]
call fcn.1402f57b0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140319a10
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14020eca0
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14020ed60
mov eax, dword [rsi]
mov dword [reloc.WS2_32.dll_accept], eax
test al, 1
jne 0x14020ecc1
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x1403f76b8]
test rcx, rcx
je 0x14020ed2c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1403f76b8], 0
mov rcx, qword [0x1403f7690]
test rcx, rcx
jne 0x14020ed13
and byte [reloc.WS2_32.dll_accept], 0xfe
mov ecx, 0x18
call fcn.140318438
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1403f7690], rax
mov rdx, qword [rsi + 8]
call fcn.14020fc50
cmp dword [rsi + 0x14], 0
je 0x14020ed3a
add rsp, 0x20
pop rsi
jmp fcn.14020eea0
mov rcx, qword [0x1403f7690]
test rcx, rcx
jne 0x14020ed13
jmp 0x14020ecf1
mov rcx, qword [0x1403f7690]
cmp byte [rcx + 0x17], 0
jns 0x14020ed4a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14020ed22
Function at 0x14020eea0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1403f76b8], 0
jne 0x14020ef6d
mov rdi, qword [0x1403f7690]
test rdi, rdi
je 0x14020ef8a
test byte [reloc.WS2_32.dll_accept], 1
je 0x14020ef6d
cmp byte [rdi + 0x17], 0
jns 0x14020eef3
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403f76b8], rax
inc rax
cmp rax, 1
ja 0x14020ef6d
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14031b780
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x14020f050
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140319a10
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
call fcn.140318438
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.14031b780
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1403bc150]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.140352ef0
movzx eax, byte [rdi + 0x17]
mov rcx, rdi
test al, al
jns 0x14020eff2
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
jne 0x14020f018
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.1402006f0
mov qword [0x1403f7690], rdi
jmp 0x14020eedd
lea r8, [rax + rax]
test r8, r8
je 0x14020eff7
lea rdx, [r8 - 2]
cmp word [rcx + r8 - 2], 0x5c
mov r8, rdx
jne 0x14020f01c
cmp rdx, 0xfffffffffffffffe
je 0x14020eff7
sar rdx, 1
cmp rax, rdx
jbe 0x14020f136
inc rdx
mov rcx, rdi
call fcn.140353200
jmp 0x14020eff7
mov rdi, qword [0x1403f7690]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.14033c934
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.1402003d0
mov rcx, qword [0x1403f7690]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x14020f129
mov rax, qword [rcx + 8]
test rax, rax
je 0x14020f13e
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x14020f0b6
lea rdx, [0x1403bde8c]
mov r8d, 1
call fcn.1402006f0
mov rcx, qword [0x1403f7690]
lea rdx, str.debug.log
mov r8d, 9
call fcn.1402006f0
mov rcx, qword [0x1403f7690]
cmp byte [rcx + 0x17], 0
jns 0x14020f0d8
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403f76b8], rax
inc rax
cmp rax, 1
ja 0x14020ef6d
mov qword [0x1403f76b8], 0
jmp 0x14020ef6b
test rax, rax
je 0x14020f13e
mov rdx, rcx
jmp 0x14020f095
mov rcx, rdi
call fcn.140350e80
lea rax, str.string::back__:_string_is_empty
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str........._buildtools_third_partylibc_trunkinclude_string
lea r9, str._empty__
mov r8d, 0x502
call fcn.140351370
int3
Function at 0x1402117e0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1403f7770]
test rdi, rdi
jne 0x140211893
mov ecx, 0x50
call fcn.140318438
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.140318438
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x1402118b5
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x1403f7770], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1402118e1
mov rcx, rax
call fcn.14033c934
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1402118f0
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140319a10
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str........._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140351370
int3
Function at 0x1402118f0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1402069b0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x140211a7c
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x1403c2d08]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x140211acd
lea rdx, [0x1403c2d58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140211ae0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x140318756.0]
mov r14, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x140211ae8
shl r12, 3
movabs rax, 0x5555555555555551
cmp r12, rax
jae 0x140211af2
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.140318438
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, r15
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov r15, rbx
test r15, r15
je 0x140211aa1
mov rdx, qword [r14 + r13]
mov rcx, r15
call fcn.140352ef0
add r15, 0x18
add r13, 8
cmp r12, r13
jne 0x1402119fc
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140211600
movups xmmword [rsi], xmm6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x140211a4a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140211a7c
cmp r15, rbx
jne 0x140211a61
jmp 0x140211a74
mov rcx, qword [r15 - 0x18]
call fcn.140318474
jmp 0x140211a6c
lea rsi, [r15 - 0x18]
cmp byte [r15 - 1], 0
js 0x140211a56
mov r15, rsi
cmp rsi, rbx
jne 0x140211a61
mov rcx, rbx
call fcn.140318474
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140319a10
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str........._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140351370
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1402119a1
xor r14d, r14d
jmp 0x1402119a4
xor r15d, r15d
xor ebx, ebx
jmp 0x140211a23
lea rcx, [rsp + 0x30]
call fcn.1403512e0
int3
Function at 0x140212660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x1403f7780]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x140212764
mov rsi, rcx
lea r14, [0x1403c2cd0]
movabs r15, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1403bc150]
lea rbx, [rsp + 0x20]
xor r12d, r12d
mov rax, r12
shl rax, 4
mov qword [rsp + 0x30], r15
movaps xmmword [rsp + 0x20], xmm6
mov rdx, qword [rax + r14]
mov r8, qword [rax + r14 + 8]
mov rcx, rbx
call fcn.1401f2a70
movzx eax, byte [rsp + 0x37]
mov rcx, qword [rsp + 0x20]
mov r8, rbx
mov rdx, rax
test al, al
jns 0x1402126fa
mov rdx, qword [rsp + 0x28]
mov r8, rcx
mov r9, qword [rsi + 8]
cmp r9, rdx
mov r10, rdx
cmovb r10, r9
test r10, r10
js 0x14021278a
cmp rdx, r9
jbe 0x140212716
xor ebp, ebp
jmp 0x14021273f
mov bpl, 1
test rdx, rdx
je 0x14021273d
mov r9, qword [rsi]
xor r10d, r10d
movzx r11d, word [r9 + r10*2]
cmp r11w, word [r8 + r10*2]
jne 0x140212712
inc r10
cmp rdx, r10
jne 0x140212724
mov rdi, rdx
jmp 0x14021273f
xor edi, edi
test al, al
jns 0x140212748
call fcn.140318474
test bpl, bpl
jne 0x140212766
inc r12
movzx eax, byte [0x1403f7780]
xor rax, 3
cmp r12, rax
jb 0x1402126bc
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140319a10
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
Function at 0x140214410
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14031b780
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1402144a5
mov eax, eax
inc rax
cmp rax, 1
je 0x1402144a5
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x140214471
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140214492
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1403315a8
test eax, eax
je 0x140214584
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140214506
mov eax, eax
inc rax
cmp rax, 1
je 0x140214506
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x1402144d2
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1402144f3
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1403315a8
test eax, eax
je 0x1402145ae
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140214563
mov eax, eax
inc rax
cmp rax, 1
je 0x140214563
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x140214533
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140214554
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1403315a8
test eax, eax
je 0x1402145d8
xor ebx, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140319a10
mov eax, ebx
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140214590
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x140214565
mov rcx, rsi
mov rdx, r14
call fcn.1403627d0
cmp word [rax], 0x5c
jne 0x1402144a5
jmp 0x140214565
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1402145ba
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x140214565
mov rcx, rsi
mov rdx, r14
call fcn.1403627d0
cmp word [rax], 0x5c
jne 0x140214506
jmp 0x140214565
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1402145e4
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x140214565
mov rcx, rsi
mov rdx, r14
call fcn.1403627d0
cmp word [rax], 0x5c
jne 0x140214563
jmp 0x140214565
Function at 0x140214b50
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x140214d69
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1403e77c0], rax
jne 0x140214d6c
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.1402fd8c0
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140214d2b
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x140214cc4
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140214cbd
lea rdx, [rsi + 0x48]
bswap rcx
mov r14d, dword [rdx + r12*8 + 0x18]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x140214d38
mov edx, ecx
and edx, 0x1fc000
je 0x140214d38
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.1403006f0
mov ecx, dword [0x1403f77b8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1403f3d34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x150], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140319a10
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x140214c1e
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.14030ad20
test rax, rax
je 0x140214d6f
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x140214c38
mov rcx, rbx
call fcn.140301360
jmp 0x140214bce
movaps xmm0, xmmword [0x1403bc150]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.14036e400
mov rcx, rsi
call fcn.1401f1190
mov rcx, r14
call fcn.140214d90
int3
int3
xor edi, edi
jmp 0x140214c62
Function at 0x1402160d0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
sub rsp, 0x1c0
mov rax, qword [0x1403e4018]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov rax, qword [0x1403f7830]
cmp rax, 1
jbe 0x140216111
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140319a10
nop
add rsp, 0x1c0
pop rsi
ret
lea rcx, [0x1403f7830]
call fcn.140210500
test al, al
je 0x140216168
lea rsi, [rsp + 0x20]
mov r8d, 0x198
mov rcx, rsi
mov dl, 0xaa
call fcn.14031b780
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14021614d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x1403f7838]
lea rcx, [0x1403f7830]
xor r8d, r8d
mov r9, rcx
call fcn.1402105c0
jmp 0x1402160f7
mov rax, qword [0x1403f7830]
jmp 0x1402160f7

Function at 0x140219b40
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140219c2e
cmp qword [rsi], 0
jne 0x140219c2e
cmp dword [rsi + 0x14], 0
jne 0x140219c2e
cmp qword [rsi + 8], 0
jne 0x140219c2e
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x140219bb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140219c00
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140219ba8
mov qword [rsi], r14
call fcn.1402fdb50
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x140219bea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140219c16
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140219be2
mov qword [rsi + 8], r14
call fcn.1402fdb50
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1402fdb50
mov rcx, qword [rsi]
call fcn.1402f2e40
mov qword [rsi], 0
jmp 0x140219b96
call fcn.1402fdb50
mov rcx, qword [rsi + 8]
call fcn.1402f2e40
mov qword [rsi + 8], 0
jmp 0x140219bcf
mov rcx, rsi
call fcn.140374970
mov rax, qword [rsi]
jmp 0x140219b7a