joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400634d0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x140063500
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x14006350e
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140063620
lea rax, [rdx - 1]
test rdx, rax
jne 0x140063524
mov rdi, rdx
jmp 0x1400634e5
jae 0x140063611
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x140063531
cvtsi2ss xmm0, rax
jmp 0x140063546
mov rcx, rdx
call fcn.14009ed50
mov rdi, rax
jmp 0x1400634e5
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.1400f58c0
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x14014c1fc]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x1400635f9
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x1400635f9
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x140063601
mov rcx, rdx
call fcn.14009ed50
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x1400634ee
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140063e50
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x140063e8f
test r15, r15
je 0x140063f7d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140063ed9
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.1400c7420
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x140063e6d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x140063fa9
lea rcx, [r12*8]
call fcn.1400c4664
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x140063f4d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x140063f7d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x140063f35
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x140063e6d
mov rcx, r14
call fcn.1400c46a0
mov r15, qword [rsi + 0x10]
jmp 0x140063e6d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.1400f6b10
call fcn.1400f6640
int3
Function at 0x140066680
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x140066821
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x1400666fb
cmp r14, rax
ja 0x140066826
lea rcx, [r14*8]
call fcn.1400c4664
jmp 0x1400666fd
xor eax, eax
shl rbx, 3
add rbx, rax
je 0x1400667f5
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rbx], rcx
mov qword [rdi], 0
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x14006679d
mov r8, qword [rdx - 8]
mov qword [rbx - 8], r8
mov qword [rdx - 8], 0
lea r8, [rdx - 8]
add rbx, 0xfffffffffffffff8
mov rdx, r8
cmp r8, rdi
jne 0x14006672b
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x1400667a8
add r14, 0xfffffffffffffff8
test r14, r14
je 0x1400667c9
mov rax, qword [r14]
test rax, rax
je 0x14006678f
mov rcx, qword [rax + 8]
movsxd rcx, dword [rcx + 4]
add rcx, rax
add rcx, 8
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14018e008]
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x140066766
jmp 0x1400667a8
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
je 0x1400667be
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400c46a0
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.1400f6b10
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.1400f6b10
call fcn.1400dc550
call fcn.1400f6640
int3
Function at 0x140072c70
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140072d5e
cmp qword [rsi], 0
jne 0x140072d5e
cmp dword [rsi + 0x14], 0
jne 0x140072d5e
cmp qword [rsi + 8], 0
jne 0x140072d5e
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x140072ce0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140072d30
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140072cd8
mov qword [rsi], r14
call fcn.1400a33d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x140072d1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140072d46
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140072d12
mov qword [rsi + 8], r14
call fcn.1400a33d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400a33d0
mov rcx, qword [rsi]
call fcn.1400ae980
mov qword [rsi], 0
jmp 0x140072cc6
call fcn.1400a33d0
mov rcx, qword [rsi + 8]
call fcn.1400ae980
mov qword [rsi + 8], 0
jmp 0x140072cff
mov rcx, rsi
call fcn.1401172a0
mov rax, qword [rsi]
jmp 0x140072caa

Function at 0x140072e90
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140072f6d
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x40]
mov qword [rbx], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov r14, rax
call r15
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x140072f71
mov r14, qword [rsp + 0x40]
cmp qword [rsi], r14
je 0x140072f37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140072f57
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140072f2f
mov qword [rsi], r14
call fcn.1400a33d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c59b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400a33d0
mov rcx, qword [rsi]
call fcn.1400ae980
mov qword [rsi], 0
jmp 0x140072f1d
mov bl, 1
jmp 0x140072f3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140072f2f
Function at 0x140073b90
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x28
mov rdx, qword [rdx]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x140073c90
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
call fcn.140072c20
xor eax, eax
mov qword [rsi + 0x18], rax
mov r15, qword [rdi]
mov qword [rdi], rax
lea r12, [r15 + 1]
cmp r12, 2
jb 0x140073ccc
call fcn.1400a33d0
cmp qword [rsi + 0x18], r15
je 0x140073d02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x140073dc8
cmp r12, 2
jb 0x140073cfa
mov qword [rsi + 0x18], r15
call fcn.1400a33d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov qword [rsi + 0x20], rax
mov r12, qword [rbx]
mov qword [rbx], rax
lea r13, [r12 + 1]
cmp r13, 2
jb 0x140073d1e
call fcn.1400a33d0
mov r15, qword [rsp + 0x90]
cmp qword [rsi + 0x20], r12
je 0x140073d5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x140073de3
cmp r13, 2
jb 0x140073d54
mov qword [rsi + 0x20], r12
call fcn.1400a33d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r12, qword [rsp + 0x98]
xor eax, eax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], r14
mov qword [rsi + 0x38], rax
mov rax, qword [0x140168020]
and rax, r15
cmp rax, qword [0x140168008]
je 0x140073dfe
mov qword [rsi + 0x40], r15
lea rcx, [rsi + 0x58]
xorps xmm0, xmm0
movups xmmword [rsi + 0x48], xmm0
mov rdx, r12
call fcn.140089470
mov rax, qword [rbx]
inc rax
cmp rax, 2
jae 0x140073e0b
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140073e21
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400a33d0
mov rcx, qword [rsi + 0x18]
call fcn.1400ae980
mov qword [rsi + 0x18], 0
jmp 0x140073ceb
call fcn.1400a33d0
mov rcx, qword [rsi + 0x20]
call fcn.1400ae980
mov qword [rsi + 0x20], 0
jmp 0x140073d45
mov rcx, r15
call fcn.1400a1ac0
jmp 0x140073d85
call fcn.1400a33d0
mov rcx, qword [rbx]
call fcn.1400ae980
mov qword [rbx], 0
jmp 0x140073da8
call fcn.1400a33d0
mov rcx, qword [rdi]
call fcn.1400ae980
mov qword [rdi], 0
jmp 0x140073db4
Function at 0x140073e40
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140072e20
test al, al
je 0x140073e6e
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x140073e8f
mov rcx, rdi
call fcn.1400896d0
mov rcx, rdi
call fcn.1400c46a0
mov rdx, qword [rsi + 0x58]
test rdx, rdx
jne 0x140073f42
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x140073eb2
call fcn.1400a19c0
mov rcx, qword [rsi + 0x40]
mov rax, qword [0x140168020]
and rax, rcx
cmp rax, qword [0x140168008]
je 0x140073f5b
mov rdi, qword [rsi + 0x38]
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
test rdi, rdi
jne 0x140073f65
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x140073f04
call fcn.1400a33d0
mov rcx, qword [rsi + 0x28]
call fcn.1400ae980
mov qword [rsi + 0x28], 0
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x140073f7a
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jb 0x140073f34
call fcn.1400a33d0
mov rcx, qword [rsi + 0x18]
call fcn.1400ae980
mov qword [rsi + 0x18], 0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140072d70
lea rdi, [rsi + 0x58]
mov rcx, rdi
call fcn.1400749a0
mov rcx, qword [rdi]
call fcn.1400c46a0
jmp 0x140073e9c
call fcn.1400a1c10
jmp 0x140073ecd
mov rcx, rdi
call fcn.1400896d0
mov rcx, rdi
call fcn.1400c46a0
jmp 0x140073ee1
call fcn.1400a33d0
mov rcx, qword [rsi + 0x20]
call fcn.1400ae980
mov qword [rsi + 0x20], 0
jmp 0x140073f11
Function at 0x140076f70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x14017d050], 0
jne 0x140076fad
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140076fa0
mov dword [rdi], eax
mov dword [0x14017d058], eax
mov qword [0x14017d050], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x140078a10
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140175968]
cmp ecx, 0xffffffff
je 0x140078a35
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x140078a30

Function at 0x140078a40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140175968]
cmp ecx, 0xffffffff
je 0x140078b09
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140078b09
mov eax, dword [0x14017e8d8]
mov ecx, dword [0x140175c44]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140078b13
mov rbx, qword [0x14017e8d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140078b59
mov rax, qword [0x14017d0c0]
inc rax
xor ecx, ecx
lea rdx, [0x14017d0d0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x140078b66
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov qword [0x14017d0c0], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x140078b7b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140078b80
jmp 0x140078a6a
lea rcx, [0x14017e8d8]
call fcn.1400c47c0
cmp dword [0x14017e8d8], 0xffffffff
jne 0x140078a8f
mov ecx, 8
call fcn.1400c4664
mov rbx, rax
mov rcx, rax
call fcn.1400b2990
mov qword [0x14017e8d0], rbx
lea rcx, [0x14017e8d8]
call fcn.1400c4858
jmp 0x140078a8f
mov rcx, rbx
call fcn.1400b29a0
jmp 0x140078aa7
inc rcx
cmp rcx, 0x100
jne 0x140078aba
jmp 0x140078aef
int3
Function at 0x140078b80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1400c5950
sub rsp, rax
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140175968]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x140078c34
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140078c72
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400c7ad0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400c46dc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400c7420
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400c59b0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.14008f500
test al, al
je 0x140078c75
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140078c78
mov eax, 0xffffffff
lock cmpxchg dword [0x140175968], ecx
je 0x140078bb8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140175968]
mov dword [rsp + 0x2c], ecx
jmp 0x140078bb8
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.14008f500
test al, al
je 0x140078c9d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140078c9d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140078c4b
int3
Function at 0x140079e90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.14007a080
test al, al
jne 0x140079f18
call fcn.14007a050
movzx edx, al
mov ecx, esi
call fcn.140060ce0
mov eax, dword [0x14017e928]
mov ecx, dword [0x140175c44]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079ee7
movsxd rdx, esi
inc rdx
lea rcx, [0x14017e918]
add rsp, 0x20
pop rsi
jmp fcn.1400b2c30
lea rcx, [0x14017e928]
call fcn.1400c47c0
cmp dword [0x14017e928], 0xffffffff
jne 0x140079ed0
lea rcx, [0x14017e918]
xor edx, edx
call fcn.140078d90
lea rcx, [0x14017e928]
call fcn.1400c4858
jmp 0x140079ed0
mov edx, 3
jmp 0x140079ea8

Function at 0x140079f20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.140060ce0
mov eax, dword [0x14017e928]
mov ecx, dword [0x140175c44]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140079f64
movsxd rdx, esi
inc rdx
lea rcx, [0x14017e918]
add rsp, 0x20
pop rsi
jmp fcn.1400b2c30
lea rcx, [0x14017e928]
call fcn.1400c47c0
cmp dword [0x14017e928], 0xffffffff
jne 0x140079f4d
lea rcx, [0x14017e918]
xor edx, edx
call fcn.140078d90
lea rcx, [0x14017e928]
call fcn.1400c4858
jmp 0x140079f4d
Function at 0x14007bdd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14017ea70]
cmp rdi, 1
jbe 0x14007bdf9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400b2c30
lea rcx, [0x14017ea70]
call fcn.14008ce70
test al, al
je 0x14007be3e
xorps xmm0, xmm0
movups xmmword [0x14017ea78], xmm0
lea rbx, [0x14017ea70]
lea rdi, [0x14017ea78]
mov rcx, rdi
xor edx, edx
call fcn.140078d90
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008cf30
jmp 0x14007bde7
mov rdi, qword [0x14017ea70]
jmp 0x14007bde7

Function at 0x14007c2e0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x48], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov r14, rax
call r15
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 8
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14007c3d5
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14007c3cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x14007c3d1
call fcn.1400a33d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi], 1
mov qword [rsi + 8], 0
cmp rbx, 0xffffffffffffffff
je 0x14007c38e
test rbx, rbx
je 0x14007c3b1
call fcn.1400a33d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14007c3a9
mov qword [rsi + 8], rbx
call fcn.1400a33d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c59b0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14007c373
xor ebx, ebx
jmp 0x14007c36b
mov byte [rsi], 0
jmp 0x14007c3b1
Function at 0x14007c410
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
test r8b, r8b
jne 0x14007c4d9
lea r8, [rsp + 0x30]
mov rcx, rdx
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14007c547
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14007c4d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x14007c4d5
call fcn.1400a33d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi], 1
mov qword [rsi + 8], 0
cmp rbx, 0xffffffffffffffff
je 0x14007c496
test rbx, rbx
je 0x14007c4b9
call fcn.1400a33d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14007c4b1
mov qword [rsi + 8], rbx
call fcn.1400a33d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c59b0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x14007c47b
xor ebx, ebx
jmp 0x14007c473
lea r8, [rsp + 0x30]
mov rcx, rdx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14007c547
lea rdi, [rsp + 0x30]
mov rdx, qword [rdi]
lea rbx, [rsp + 0x28]
mov qword [rbx], 0
mov rcx, rbx
call fcn.1400a79e0
mov rcx, qword [rbx]
mov edx, 1
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x14007c54f
mov rax, qword [rsp + 0x28]
inc rax
cmp rax, 2
jb 0x14007c456
call fcn.1400a33d0
mov rcx, qword [rsp + 0x28]
call fcn.1400ae980
jmp 0x14007c456
mov byte [rsi], 0
jmp 0x14007c4b9
mov byte [rsi], 0
mov rax, qword [rsp + 0x28]
inc rax
cmp rax, 2
jb 0x14007c4b9
call fcn.1400a33d0
mov rcx, qword [rsp + 0x28]
call fcn.1400ae980
jmp 0x14007c4b9

Function at 0x14007c580
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x14007c5a6
call fcn.1400a33d0
cmp qword [rsi], rbx
je 0x14007c5d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14007c5e2
cmp r14, 2
jb 0x14007c5cd
mov qword [rsi], rbx
call fcn.1400a33d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400a33d0
mov rcx, qword [rsi]
call fcn.1400ae980
mov qword [rsi], 0
jmp 0x14007c5bf
Function at 0x140080ae0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [0x140166028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x6c], 0
jne 0x140080bfa
mov rdi, rdx
mov rsi, rcx
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
test rdi, rdi
jne 0x140080c01
lea r8, [rsp + 0x38]
mov rcx, rbx
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140080c32
mov rdi, qword [rsp + 0x38]
cmp qword [rsi + 0x48], rdi
je 0x140080b83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x48]
inc rax
cmp rax, 2
jae 0x140080bdf
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140080b77
mov qword [rsi + 0x48], rdi
call fcn.1400a33d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x48]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], r14
movaps xmm0, xmmword [0x14014b720]
movaps xmmword [rbx], xmm0
mov rcx, rbx
mov rdx, rdi
call fcn.14007c2e0
cmp byte [rbx], 0
je 0x140080c3c
lea rcx, [rsi + 0x50]
lea rdi, [rsp + 0x40]
mov rdx, rdi
call fcn.140080c60
mov byte [rsi + 0x6c], 1
xor esi, esi
cmp byte [rdi], 0
jne 0x140080c43
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c59b0
mov eax, esi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400a33d0
mov rcx, qword [rsi + 0x48]
call fcn.1400ae980
mov qword [rsi + 0x48], 0
jmp 0x140080b64
mov esi, 0x4df
jmp 0x140080bc6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x140080b3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140080bc6
mov esi, 0x3f0
jmp 0x140080bc6
lea rcx, [rsp + 0x48]
call fcn.14007c3e0
jmp 0x140080bc6