joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c522d
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140076ec8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400e1680]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400782fc
mov qword [rbx], rax
test rax, rax
je 0x1400c5284
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400c52a0
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea rbx, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, rbx
mov dl, 0xaa
call fcn.14007c4d0
mov qword [rsp + 0x20], rsi
xor esi, esi
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.1400aded0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x30]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1401146a0]
movaps xmmword [r15], xmm0
mov rcx, rbx
mov rdx, r15
call fcn.14000be50
movzx eax, byte [r15 + 0x17]
test al, al
jns 0x1400c5331
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400c53e6
xor ebp, ebp
lea rdi, [rsp + 0x48]
lea rbx, [rsp + 0x298]
mov r14, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 0x250
mov rcx, rdi
mov dl, 0xaa
call fcn.14007c4d0
mov rcx, rbx
mov rdx, rdi
call fcn.1400c5490
test byte [rsp + 0x48], 1
jne 0x1400c5426
mov rcx, rdi
call fcn.1400c5480
test al, al
jne 0x1400c541f
cmp byte [rsp + 0x47], 0
mov rcx, r15
jns 0x1400c5395
mov rcx, qword [rsp + 0x30]
call r14
xor esi, esi
test eax, eax
je 0x1400c543e
test ebp, ebp
cmovne esi, ebp
mov rcx, rdi
call fcn.1400b33f0
mov rcx, rbx
mov rdx, rdi
call fcn.14000be50
mov rcx, r15
mov rdx, rdi
call fcn.140068e80
mov rcx, rdi
call fcn.14004e350
movzx eax, byte [rsp + 0x47]
test al, al
jns 0x1400c53db
mov rax, qword [rsp + 0x38]
mov ebp, esi
test rax, rax
jne 0x1400c5350
lea rcx, [rsp + 0x30]
call fcn.14004e350
lea rcx, [rsp + 0x298]
call fcn.14004e1e0
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140079ea0
mov eax, esi
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor esi, esi
jmp 0x1400c53a2
lea rcx, [rsp + 0x48]
call fcn.1400c5480
test al, al
je 0x1400c5456
lea rcx, [rsp + 0x48]
jmp 0x1400c5379
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
cmovne esi, eax
jmp 0x1400c53a2
mov edx, dword [rsp + 0x48]
and edx, 0xfffffffe
cmp byte [rsp + 0x47], 0
jns 0x1400c546b
mov rcx, qword [rsp + 0x30]
jmp 0x1400c5470
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400c5376
Function at 0x1400c6d80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400c6dab
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock inc dword [rsi]
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, rsi
call fcn.1400f9ca0
lock dec dword [rsi]
je 0x1400c6dca
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.1400f9c40
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400013b0

Function at 0x1400c7970
Capabilities:
Get file version info

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x50]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1401146a0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str..._.._base_file_version_info_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r9d, 0x4e
call fcn.1400498a0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140048980
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 0x17], 0
jns 0x1400c7a02
mov rdi, qword [rdi]
lea rdx, [rsp + 0x24]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1400c7b1f
mov ebp, eax
mov esi, eax
mov rcx, rsi
call fcn.140076ec8
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.14007c4d0
mov edx, dword [rsp + 0x24]
mov rcx, rdi
mov r8d, ebp
mov r9, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400c7b28
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea r9, [rsp + 0x4c]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400c7b28
mov rbp, qword [rsp + 0x28]
test rbp, rbp
je 0x1400c7b28
mov rdi, rbx
add rdi, rsi
mov ecx, 0x38
call fcn.140076ec8
mov rsi, rax
mov eax, dword [rbp]
lea rcx, fcn.14000f810
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], rbx
mov dword [rsi + 0x28], eax
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea r9, [rsp + 0x4c]
mov dword [r9], 0xaaaaaaaa
lea rdx, [0x1401177b2]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400c7b3e
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x30], rax
mov qword [r14], rsi
lea rcx, [rsp + 0x50]
call fcn.140043a50
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140079ea0
mov rax, r14
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov qword [r14], 0
jmp 0x1400c7af4
mov qword [r14], 0
test rbx, rbx
je 0x1400c7af4
mov rcx, rbx
call fcn.140076eb8
jmp 0x1400c7af4
int3
Function at 0x1400e2010
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
mov rcx, qword [r8]
cmovns rcx, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
cmovs rax, qword [r8 + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1400561a0
cmp byte [rsi + 0x17], 0
jns 0x1400e206b
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1400561a0
cmp byte [rdi + 0x17], 0
jns 0x1400e2090
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x1400e20af
mov rcx, qword [rsp + 0x48]
call fcn.140076eb8
cmp byte [rsp + 0x87], 0
jns 0x1400e20c3
mov rcx, qword [rsp + 0x70]
call fcn.140076eb8
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140079ea0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400e2170
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1400561a0
cmp byte [rdi + 0x17], 0
jns 0x1400e21b1
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x1400e21d2
mov rcx, qword [rsp + 0x58]
call fcn.140076eb8
test edi, edi
je 0x1400e227e
test r14, r14
je 0x1400e227e
mov ecx, edi
add rcx, rcx
call fcn.140077350
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.1400561a0
cmp byte [rsi + 0x17], 0
jns 0x1400e2213
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x1400e2233
mov rcx, qword [rsp + 0x58]
call fcn.140076eb8
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x1400e229c
mov rcx, rbx
call fcn.140077408
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.140054e90
cmp byte [r14 + 0x17], 0
js 0x1400e22a0
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
test rbx, rbx
je 0x1400e227e
mov rcx, rbx
call fcn.140076ec0
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140079ea0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x1400e2245
mov rcx, qword [r14]
call fcn.140076eb8
jmp 0x1400e225f
Function at 0x1400e4950
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx r14d, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov ebp, eax
movzx ebx, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call rsi
mov word [rsp + 0x3e], ax
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.14007c4d0
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.1400e4da0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400e4a54
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400e4a54
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x1400e4a54
dec r8d
mov rcx, r15
call fcn.1400718d0
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140079ea0
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.14007c4d0
movzx eax, bp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.1400e4da0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400e4ad3
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400e4ad3
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x1400e4a20
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.14007c4d0
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.1400e4da0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400e4b57
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400e4b57
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x1400e4a20
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.14007c4d0
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.1400e4da0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400e4bdc
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400e4bdc
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x1400e4a20
xor esi, esi
jmp 0x1400e4a2e
Function at 0x1400e4fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 4
lea r15, [rsp + 0x3c]
mov dword [r15], eax
lea r12, [rsp + 0x38]
mov dword [r12], eax
lea rsi, [rsp + 0x34]
mov dword [rsi], 0
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.1400498a0
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e5072
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400e5055
cmp dword [rsp + 0x38], 4
jne 0x1400e5055
mov eax, dword [rsp + 0x34]
mov dword [r14], eax
xor edi, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140079ea0
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x1400e5055

Function at 0x1400e56d8
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400e5730
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140079ea0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, eax
mov edx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x20]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1401146a0]
movaps xmmword [r14], xmm0
mov rcx, r14
xor r8d, r8d
call fcn.140070eaa
cmp byte [r14 + 0x17], 0
jns 0x1400e5769
mov r14, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400e57b7
mov edx, eax
movzx eax, byte [rsp + 0x37]
mov rcx, rax
test al, al
jns 0x1400e578f
mov rcx, qword [rsp + 0x28]
cmp rcx, rdx
jbe 0x1400e57bb
lea rdi, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.14006387c
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
jmp 0x1400e5716
mov al, byte [rsp + 0x37]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
test al, al
jns 0x1400e5716
mov rcx, qword [rsp + 0x20]
call fcn.140076eb8
jmp 0x1400e5716
Function at 0x1400e73c0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x140138030]
test rax, rax
je 0x1400e74c1
cmp eax, 2
jne 0x1400e7446
mov ecx, 2
call fcn.140062530
test al, al
je 0x1400e74a5
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.1400caa50
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch
mov r8d, 0x1d
call fcn.14006c36d
mov rcx, rsi
call fcn.140001da0
jmp 0x1400e74a5
mov eax, 1
lock xadd qword [0x140138068], rax
test rax, rax
jle 0x1400e7466
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140137fe8], eax
mov qword [0x140137fe0], rsi
mov rcx, qword [0x1401331b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140079ea0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x140138030]
test rax, rax
je 0x1400e74c8
jmp 0x1400e73ee

Function at 0x1400e8400
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140134758]
cmp ecx, 0xffffffff
je 0x1400e8425
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400e8420
Function at 0x1400ee8cf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400ee8f9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ee93a
mov edi, eax
test bl, bl
jne 0x1400ee9f3
mov eax, edi
and eax, 0x400
je 0x1400ee9f3
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140079ea0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140062530
test al, al
je 0x1400ee91b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x81
mov r9d, 2
call fcn.1400e24c0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14006c36d
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140054e90
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ee9c8
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.14006c36d
cmp byte [rsp + 0x57], 0
jns 0x1400ee9e4
mov rcx, qword [rsp + 0x40]
call fcn.140076eb8
lea rcx, [rsp + 0x58]
call fcn.1400c3280
jmp 0x1400ee91b
and edi, 0x10
shr edi, 4
jmp 0x1400ee91d
Function at 0x1400f05ce
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400f05f5
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f0610
and eax, 0x410
cmp eax, 0x410
je 0x1400f0704
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400f061c
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x1400f0645
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140079ea0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140062530
test al, al
je 0x1400f06fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.1400e24c0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.14006c36d
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140054e90
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400f06d7
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.14006c36d
cmp byte [rsp + 0x4f], 0
jns 0x1400f06f3
mov rcx, qword [rsp + 0x38]
call fcn.140076eb8
lea rcx, [rsp + 0x50]
call fcn.1400c3280
xor edi, edi
jmp 0x1400f0629
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140079ea0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400fd66e
Function at 0x1400f8c00
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400f8c7e
mov rax, 0xffffffffffffffff
xor edx, edx
div rsi
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x20]
cmp rax, rcx
ja 0x1400f8c28
xor edx, edx
div rsi
mov rsi, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140079ea0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x1400f9c40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x90
call fcn.1400fd520
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1400f9c66
mov qword [rsi + 0x70], rcx
call fcn.1400013b0
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x1400f9c78
mov qword [rsi + 0x50], rcx
call fcn.1400013b0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x1400f9c8a
mov qword [rsi + 0x30], rcx
call fcn.1400013b0
mov rdx, qword [rsi + 0x18]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1400fd550
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
jne 0x1400fd562
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rdx]
call 0x1400fd550
mov rdx, qword [rsi + 8]
mov rcx, rdi
call 0x1400fd550
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400013b0

Function at 0x1400fc750
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov rcx, qword [rcx]
mov rbx, qword [r15 + 8]
sub rbx, rcx
sar rbx, 4
lea rax, [rbx + 1]
mov rdx, rax
shr rdx, 0x3c
jne 0x1400fc864
movabs rdx, 0xfffffffffffffff
mov rdi, qword [r15 + 0x10]
sub rdi, rcx
mov rcx, rdi
sar rcx, 4
sar rdi, 3
cmp rdi, rax
cmovb rdi, rax
movabs rax, 0x7ffffffffffffff
cmp rcx, rax
cmovae rdi, rdx
test rdi, rdi
jne 0x1400fc857
xor eax, eax
shl rbx, 4
lea rdx, [rax + rbx]
shl rdi, 4
add rdi, rax
mov rcx, qword [r14]
lea r8, [rax + rbx]
add r8, 0x10
mov qword [r8 - 0x10], rcx
mov cl, byte [r14 + 8]
and cl, 1
mov byte [r8 - 8], cl
mov cl, byte [r14 + 9]
and cl, 1
mov byte [r8 - 7], cl
mov rbx, qword [r15]
mov rcx, qword [r15 + 8]
cmp rcx, rbx
je 0x1400fc82a
mov rax, qword [rcx - 0x10]
mov qword [rdx - 0x10], rax
mov al, byte [rcx - 8]
and al, 1
mov byte [rdx - 8], al
mov al, byte [rcx - 7]
lea rsi, [rcx - 0x10]
and al, 1
mov byte [rdx - 7], al
add rdx, 0xfffffffffffffff0
mov rcx, rsi
cmp rbx, rsi
jne 0x1400fc7ff
mov rcx, qword [r15]
mov qword [r15], rdx
mov qword [r15 + 8], r8
mov qword [r15 + 0x10], rdi
test rcx, rcx
je 0x1400fc84a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400013b0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rdi
call fcn.1400fca30
jmp 0x1400fc7bf
mov rcx, r15
call fcn.1400c8ad4
int3

Function at 0x1400fd520
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x38
call 0x140100610
add rsi, 8
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x140100610
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140100632
mov rdi, qword [rcx]
call fcn.140012ef0
mov rcx, rdi
test rdi, rdi
jne 0x140100622
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x140100657
mov r8, qword [rsi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400124a0
nop
add rsp, 0x28
pop rdi
pop rsi
ret