joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001dc0
Capabilities:
Check for debugger via api
Check for process debug object
Check processdebugflags
Check processdebugport

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
call fcn.1400274e0
mov r14, rax
mov edi, edx
mov ecx, 0x23
call fcn.14002a5e0
call fcn.1400274e0
mov rsi, rax
mov ebx, edx
mov r8, qword [0x142f530e8]
test r8, r8
jne 0x140001e23
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call sub.KERNEL32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14000205a
mov r8, qword [rsp + 0x38]
mov qword [0x142f530e8], r8
test r8, r8
je 0x14000205f
cmp r8, 0x3b9aca00
ja 0x140001e38
mov eax, 0x3b9aca00
xor edx, edx
div r8d
jmp 0x140001e3a
xor eax, eax
lea ecx, [rax - 0x3b9aca00]
xor edx, edx
cmp r8, 2
cmovae ecx, eax
setb al
xor r9d, r9d
cmp r14, rsi
setne r9b
mov r8d, 0xff
cmovae r8d, r9d
test r8b, r8b
jne 0x140001e71
cmp edi, ebx
setne r8b
jb 0x140001f10
cmp r8b, 1
jne 0x140001f10
mov r8, r14
sub r8, rsi
jb 0x14000205f
cmp edi, ebx
jae 0x140001eac
test r8, r8
je 0x14000205f
dec r8
lea r9d, [rdi + 0x3b9aca00]
sub r9d, ebx
cmp r9d, 0x3b9aca00
jae 0x140001ebb
jmp 0x140001ee0
mov r9d, edi
sub r9d, ebx
cmp r9d, 0x3b9aca00
jb 0x140001ee0
mov r10d, r9d
shr r10d, 9
imul r10, r10, 0x44b83
shr r10, 0x27
add r8, r10
jb 0x14000205f
imul r10d, r10d, 0x3b9aca00
sub r9d, r10d
mov dl, al
xor eax, eax
cmp r8, rdx
setne al
mov edx, 0xff
cmovb eax, edx
xor r8d, r8d
cmp r9d, ecx
setne r8b
cmovb r8d, edx
test al, al
cmovne r8d, eax
cmp r8b, 1
jne 0x140002055
cmp rsi, r14
jb 0x140002055
sub rsi, r14
cmp ebx, edi
jae 0x140001f32
test rsi, rsi
je 0x140002055
dec rsi
add ebx, 0x3b9aca00
sub ebx, edi
cmp ebx, 0x3b9aca00
jb 0x140001f53
shr ebx, 9
imul rax, rbx, 0x44b83
shr rax, 0x27
add rsi, rax
jb 0x14000205f
cmp rsi, 0x19
jb 0x140002055
lea rcx, [rsp + 0x38]
call fcn.14004e3b0
cmp byte [rsp + 0x38], 0x12
jne 0x14000205f
call fcn.140036e60
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x2c], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 0x1f
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0x2c], 0
jne 0x140002055
cmp qword [rsp + 0x30], 0
jne 0x140002055
cmp dword [rsp + 0x28], 0
je 0x140002055
cmp qword [rsp + 0x38], 0
jne 0x140002055
mov ecx, 0x80000001
call sub.KERNEL32.dll_SetThreadExecutionState
call fcn.140002070
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14002aeb0
call sub.KERNEL32.dll_GetLastError
ud2
Function at 0x140016120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x820
mov ecx, dword [0x140057018]
test ecx, ecx
je 0x14001614a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140016163
add rax, 8
jmp 0x140016325
lea rcx, section..data
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140016141
je 0x140016323
mov rax, qword [0x142f53030]
cmp rax, 3
jne 0x140016330
mov rsi, qword [0x142f53038]
lock inc qword [rsi]
jle 0x140016346
mov eax, 0x60
movups xmm0, xmmword [0x142f4c930]
movups xmm1, xmmword [0x142f4c920]
nop
movups xmmword [rsp + rax - 0x30], xmm0
movups xmmword [rsp + rax - 0x40], xmm1
movups xmmword [rsp + rax - 0x20], xmm1
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax], xmm1
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax + 0x20], xmm1
movups xmmword [rsp + rax + 0x30], xmm0
sub rax, 0xffffffffffffff80
cmp rax, 0x860
jne 0x1400161a0
movzx eax, byte [0x142f53108]
mov edx, 0x980
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140016346
mov rbx, rax
and rbx, 0xffffffffffffff80
lea rdi, [rbx + 0x80]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], rsi
lea rcx, [rbx + 0x90]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
call sub.msvcrt.dll_memcpy
xorps xmm0, xmm0
movaps xmmword [rbx + 0x890], xmm0
mov qword [rbx + 0x8a0], 1
mov qword [rbx + 0x8a8], 0
mov qword [rbx + 0x900], 0
mov rcx, qword [0x142f53038]
mov rax, qword [rcx + 0x200]
nop word cs:[rax + rax]
mov qword [rdi], rax
lock cmpxchg qword [rcx + 0x200], rdi
jne 0x140016270
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140016346
mov rbx, rax
mov rsi, rax
lea rax, section..data
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140057018]
test ecx, ecx
je 0x140016348
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057018]
test ecx, ecx
je 0x14001635b
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14001631e
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 0x820]
lea rdx, [rax - 1]
mov qword [rcx + 0x820], rdx
cmp qword [rcx + 0x818], 0
jne 0x14001630d
cmp rax, 1
je 0x14001636e
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x140016325
xor eax, eax
add rsp, 0x820
pop rbx
pop rdi
pop rsi
ret
call fcn.140015c30
mov rsi, qword [0x142f53038]
lock inc qword [rsi]
jg 0x14001618b
ud2
lea rcx, section..data
call fcn.140027e30
mov ecx, eax
jmp 0x1400162be
lea rcx, section..data
call fcn.140027e30
mov ecx, eax
jmp 0x1400162d6
call fcn.140015b20
jmp 0x14001630d
Function at 0x14001f610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140057080]
test ecx, ecx
je 0x14001f63a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14001f653
add rax, 8
jmp 0x14001f6ea
lea rcx, [0x140057068]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14001f631
je 0x14001f66f
test rsi, rsi
je 0x14001f673
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x14001f675
mov rdi, qword [rsi + 8]
jmp 0x14001f675
xor eax, eax
jmp 0x14001f6ea
xor edi, edi
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x14001f712
mov rbx, rax
mov rsi, rax
lea rax, [0x140057068]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140057080]
test ecx, ecx
je 0x14001f6f2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057080]
test ecx, ecx
je 0x14001f702
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14001f6e7
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140057068]
call fcn.140027e30
mov ecx, eax
jmp 0x14001f6b1
lea rcx, [0x140057068]
call fcn.140027e30
mov ecx, eax
jmp 0x14001f6c5
ud2
Function at 0x1400225b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140057060]
test ecx, ecx
je 0x1400225da
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400225f3
add rax, 8
jmp 0x14002268a
lea rcx, [0x140057048]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400225d1
je 0x140022688
test rsi, rsi
je 0x14002260f
cmp dword [rsi], 0
mov dword [rsi], 0
je 0x14002260f
mov rdi, qword [rsi + 4]
jmp 0x140022611
xor edi, edi
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x1400226b2
mov rbx, rax
mov rsi, rax
lea rax, [0x140057048]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140057060]
test ecx, ecx
je 0x140022692
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057060]
test ecx, ecx
je 0x1400226a2
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140022683
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x14002268a
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140057048]
call fcn.140027e30
mov ecx, eax
jmp 0x14002264d
lea rcx, [0x140057048]
call fcn.140027e30
mov ecx, eax
jmp 0x140022661
ud2

Function at 0x1400256c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ecx, dword [0x140057100]
test ecx, ecx
je 0x1400256e7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140025700
add rax, 8
jmp 0x14002579b
lea rcx, [0x1400570e8]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400256de
je 0x140025799
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x1400257c3
mov rbx, rax
mov rsi, rax
lea rax, [0x1400570e8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140057100]
test ecx, ecx
je 0x1400257a3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140057100]
test ecx, ecx
je 0x1400257b3
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140025794
mov rax, qword [rdi + 8]
test rax, rax
je 0x140025783
lock dec qword [rax]
jne 0x140025783
mov rcx, qword [rdi + 8]
call fcn.140023b20
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x14002579b
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400570e8]
call fcn.140027e30
mov ecx, eax
jmp 0x140025746
lea rcx, [0x1400570e8]
call fcn.140027e30
mov ecx, eax
jmp 0x14002575a
ud2
Function at 0x1400257d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400570e0]
test ecx, ecx
je 0x1400257fa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140025813
add rax, 8
jmp 0x1400258c8
lea rcx, [0x1400570c8]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400257f1
je 0x14002582f
test rsi, rsi
je 0x140025836
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x140025838
mov rdi, qword [rsi + 8]
jmp 0x140025838
xor eax, eax
jmp 0x1400258c8
xor edi, edi
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x1400258f0
mov rbx, rax
mov rsi, rax
lea rax, [0x1400570c8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x1400570e0]
test ecx, ecx
je 0x1400258d0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1400570e0]
test ecx, ecx
je 0x1400258e0
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x1400258c5
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400258b4
lock dec qword [rax]
jne 0x1400258b4
mov rcx, rdi
add rcx, 8
call fcn.1400350a0
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400570c8]
call fcn.140027e30
mov ecx, eax
jmp 0x140025874
lea rcx, [0x1400570c8]
call fcn.140027e30
mov ecx, eax
jmp 0x140025888
ud2
Function at 0x1400261c0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov edi, 0xffffffff
xor ebx, ebx
xor r15d, r15d
cmp r8, 0x201
jae 0x140026260
jmp 0x14002623f
jae 0x14002630a
cmp r8, 0x201
jae 0x140026260
mov esi, 0x200
lea r12, [rsp + 0x98]
mov r13, r8
jmp 0x14002628b
sub r8, r15
sub rbx, r15
cmp rbx, r8
jb 0x1400262e9
cmp r14, rdi
mov r15d, 0xffffffff
cmovb r15, r14
mov qword [rsp + 0x40], r15
mov rbx, r14
mov rsi, r15
mov r12, qword [rsp + 0x48]
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r12
mov edx, r13d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400262b0
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400263a3
mov r8d, ebp
cmp r13, r8
jne 0x140026230
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14002645c
add r13, r13
cmp r13, rdi
cmovae r13, rdi
mov r8, r13
cmp r8, 0x201
jb 0x14002623f
jmp 0x140026260
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.14004a5c0
mov r14, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
jmp 0x14002626b
cmp rsi, r8
jb 0x14002645c
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, r12
call fcn.140032400
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r14
call fcn.140033180
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x140026358
lea rdx, [0x142f4cfe0]
lea rcx, [rsp + 0x60]
mov r8d, 3
call case.0x1400336cb.43
movabs rdi, 0x8000000000000000
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.1400273b0
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
cmp rsi, rdi
jne 0x1400263cc
mov rcx, rdi
mov rdx, rbx
call fcn.140030bd0
mov rax, qword [rsp + 0x28]
mov qword [rax], rdi
jmp 0x140026411
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rcx], rax
jmp 0x14002642c
mov r14, qword [rsp + 0x90]
mov rcx, rbx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1400263f3
mov rax, qword [rsp + 0x28]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
jmp 0x140026411
mov rax, qword [rsp + 0x28]
mov qword [rax], rdi
test rsi, rsi
je 0x140026411
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x60], 0
je 0x14002642c
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x142f53058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x30], 0
je 0x140026447
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x142f53058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140027e30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x140027eb5
mov rax, qword [0x142f56038]
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x140027eec
cmp dword [rsp + 0x2c], 0
je 0x140027edd
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140027eee
mov edi, eax
mov rax, qword [0x142f53068]
nop dword [rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x142f53068], rsi
jne 0x140027e90
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140027ee2
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140027eec
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x140027ee2
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x140027ee2
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2

Function at 0x1400287b0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x142f4cbc8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x14002881a
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14002884d
test eax, eax
js 0x14002882e
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x142f4cc28]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.14002bc10
mov rcx, rax
call fcn.140028720
mov ecx, 7
int 0x29
ud2
Function at 0x140028c80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400570a0]
test ecx, ecx
je 0x140028caa
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140028cc3
add rax, 8
jmp 0x140028d58
lea rcx, [0x140057088]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140028ca1
je 0x140028d56
xor edi, edi
test rsi, rsi
je 0x140028cdf
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, edi
mov edi, eax
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140028d80
mov rbx, rax
mov rsi, rax
lea rax, [0x140057088]
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov ecx, dword [0x1400570a0]
test ecx, ecx
je 0x140028d60
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1400570a0]
test ecx, ecx
je 0x140028d70
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140028d51
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x140028d58
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140057088]
call fcn.140027e30
mov ecx, eax
jmp 0x140028d1b
lea rcx, [0x140057088]
call fcn.140027e30
mov ecx, eax
jmp 0x140028d2f
ud2

Function at 0x140029d60
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140029e30
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140029e40]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x140029e23
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x140029ddb
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x140029dfe
cmp qword [rbx + 0x10], 0x11
jb 0x140029ded
mov rdi, qword [rdi - 8]
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x14002a690
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x142f4ccc8]
cmovne rdx, rcx
add rsp, 0x58
ret
Function at 0x14002a6d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov ecx, dword [0x1400570c0]
test ecx, ecx
je 0x14002a6ff
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14002a718
add rax, 8
jmp 0x14002a7c9
lea rcx, [0x1400570a8]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14002a6f6
je 0x14002a7c7
test rsi, rsi
je 0x14002a734
movups xmm6, xmmword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x14002a750
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x142f53108]
mov edx, 0x18
xor ecx, ecx
call fcn.140025a60
test rax, rax
je case.0x140028139.97
mov rbx, rax
mov rsi, rax
lea rax, [0x1400570a8]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x1400570c0]
test ecx, ecx
je 0x14002a7d6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1400570c0]
test ecx, ecx
je 0x14002a7e6
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14002a7c2
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x14002a7c9
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400570a8]
call fcn.140027e30
mov ecx, eax
jmp 0x14002a78c
lea rcx, [0x1400570a8]
call fcn.140027e30
mov ecx, eax
jmp 0x14002a7a0
Function at 0x14002c050
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0x28]
call fcn.140025ac0
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
cmp rax, rdi
je 0x14002c0b5
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.140029780
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rbx, rdi
jne 0x14002c0c0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x14002c0e8
test rbx, rbx
je 0x14002c110
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
xor eax, eax
jmp 0x14002c0b8
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
test rbx, rbx
je 0x14002c0b8
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rsi
mov rsi, rax
call sub.KERNEL32.dll_HeapFree
jmp 0x14002c0b5
xor eax, eax
jmp 0x14002c0b8
Function at 0x140030ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, r9
mov rdx, rax
call fcn.140033180
cmp byte [rbx], 0
jne 0x140030b22
lea rdx, [0x142f4cfe0]
mov r8d, 3
mov rcx, rsi
call case.0x1400336cb.43
movabs rbx, 0x8000000000000000
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1400273b0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
cmp r15, rbx
jne 0x140030b5d
mov rcx, rbx
mov rdx, r14
call fcn.140030bd0
mov qword [rdi], rbx
jmp 0x140030b95
mov r12, qword [rsp + 0x30]
mov rcx, r14
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x140030b7c
mov qword [rdi], r15
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r12
jmp 0x140030b95
mov qword [rdi], rbx
test r15, r15
je 0x140030b95
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
cmp qword [rsi], 0
je 0x140030bba
mov r8, qword [rsi + 8]
mov rcx, qword [0x142f53058]
xor edx, edx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret