joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e171c
Capabilities:
Encode data using base64

Disassembly:
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
sar rax, 3
cmp rax, rdx
jae 0x1400e1737
sub rdx, rax
jmp 0x1400e5ea8
jbe 0x1400e1742
lea rdx, [r8 + rdx*8]
jmp fcn.1400e5e3c
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
mov rdi, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov rcx, rax
sub rcx, rdi
sar rcx, 3
cmp rcx, rdx
jae 0x1400e5f48
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov rcx, qword [rsi]
sub rdi, rcx
sar rdi, 3
lea rbx, [rdi + r14]
mov rdx, rbx
shr rdx, 0x3d
jne 0x1400e5fe0
sub rax, rcx
mov rdx, rax
sar rdx, 2
cmp rdx, rbx
cmovbe rdx, rbx
lea rcx, [rsi + 0x18]
movabs rbx, 0x7ffffffffffffff8
cmp rax, rbx
movabs rbx, 0x1fffffffffffffff
cmovb rbx, rdx
mov qword [rbp - 0x10], rcx
test rbx, rbx
je 0x1400e5f5d
mov rdx, rbx
xor r8d, r8d
call fcn.1400e5dfa
jmp 0x1400e5f5f
mov rcx, rsi
mov rdx, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.1400e5d50
xor eax, eax
lea rcx, [rbp - 0x30]
mov qword [rcx], rax
lea rdx, [rax + rdi*8]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rdx
lea rax, [rax + rbx*8]
mov qword [rcx + 0x18], rax
mov rdx, r14
call fcn.1400e6012
lea rdi, [rbp - 0x30]
mov rbx, qword [rdi + 8]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
sub rbx, r8
mov rcx, rbx
call fcn.140258c70
mov rax, qword [rsi]
mov qword [rsi], rbx
mov qword [rdi + 8], rax
mov rcx, qword [rsi + 8]
mov rdx, qword [rdi + 0x10]
mov qword [rsi + 8], rdx
mov qword [rdi + 0x10], rcx
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rdi + 0x18]
mov qword [rsi + 0x10], rdx
mov qword [rdi + 0x18], rcx
mov qword [rdi], rax
mov rcx, rdi
call fcn.1400e60aa
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rcx, rsi
call fcn.1400e5de8
int3

Function at 0x1400eb018
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140255d40
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400eb080]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1402692a4
mov qword [rbx], rax
test rax, rax
je 0x1400eb06f
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400ec270
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1403226e8]
test rdi, rdi
jne 0x1400ec314
mov ecx, 0x48
call fcn.140255d40
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.140255d40
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1403226e8], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400ec336
mov rcx, rax
call fcn.14027a424
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400ec340
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140257200
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x1400ec340
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov r8d, 3
call fcn.140110a20
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x1400ec4c0
movups xmm0, xmmword [rsi]
movups xmmword [r14], xmm0
mov dword [rsp + 0x3c], 0
lea rcx, [0x1402b22b4]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r15, rax
test rax, rax
je 0x1400ec3ea
lea rdx, [0x1402b2304]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ec3fd
mov rcx, qword [rsi]
lea rdx, [rsp + 0x3c]
call qword [case.0x140112150.0]
jmp 0x1400ec3f8
mov rcx, qword [rsi]
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
jmp 0x1400ec400
xor r13d, r13d
movsxd rdi, dword [rsp + 0x3c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x30], 0
test rdi, rdi
je 0x1400ec481
shl rdi, 3
movabs rax, 0x5555555555555551
cmp rdi, rax
jae 0x1400ec50d
lea rbx, [rdi + rdi*2]
mov rcx, rbx
call fcn.140255d40
mov r12, rax
mov qword [rsp + 0x20], rax
add rax, rbx
mov qword [rsp + 0x30], rax
xor esi, esi
mov rbx, r12
nop word cs:[rax + rax]
mov rdx, qword [r13 + rsi]
mov rcx, rbx
call fcn.1400231ae
add rbx, 0x18
add rsi, 8
cmp rdi, rsi
jne 0x1400ec460
mov qword [rsp + 0x28], rbx
jmp 0x1400ec486
xor ebx, ebx
xor r12d, r12d
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.1400ebf10
movups xmmword [r14], xmm6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
je 0x1400ec4ae
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x1400ec4c0
cmp rbx, r12
jne 0x1400ec4f8
mov rcx, r12
call fcn.140255d7c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140257200
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, rsi
cmp rsi, r12
je 0x1400ec4b8
lea rsi, [rbx - 0x18]
cmp byte [rbx - 1], 0
jns 0x1400ec4f0
mov rcx, qword [rbx - 0x18]
call fcn.140255d7c
jmp 0x1400ec4f0
call fcn.14026f3e0
int3
Function at 0x1400edf50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx eax, byte [0x1403226f8]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x1400ee105
mov qword [rsp + 0x28], rdx
mov rsi, qword [rcx]
mov qword [rsp + 0x20], rcx
mov r13, qword [rcx + 8]
xor r15d, r15d
movaps xmm6, xmmword [0x14029de10]
lea r12, [rsp + 0x30]
jmp 0x1400edfcf
test al, al
js 0x1400ee050
inc r15
movzx eax, byte [0x1403226f8]
xor rax, 3
cmp r15, rax
jae 0x1400ee105
mov rcx, r15
shl rcx, 4
lea rax, str.Rt_
add rcx, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movaps xmmword [rsp + 0x30], xmm6
mov rdx, r12
call fcn.14002fd70
movzx eax, byte [rsp + 0x47]
test al, al
mov rcx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rdx, rax
cmovs rdx, r14
cmp rdx, r13
ja 0x1400edfb0
test rdx, rdx
je 0x1400ee05a
test al, al
mov rbp, r12
cmovs rbp, rcx
xor edi, edi
nop dword [rax]
movzx ebx, word [rsi + rdi*2]
cmp bx, word [rbp + rdi*2]
jne 0x1400edfb0
inc rdi
cmp rdx, rdi
jne 0x1400ee030
jmp 0x1400ee05a
call fcn.140255d7c
jmp 0x1400edfb8
test al, al
js 0x1400ee063
mov r14, rax
jmp 0x1400ee068
call fcn.140255d7c
mov rsi, qword [rsp + 0x20]
test r14, r14
je 0x1400ee105
cmp r14, qword [rsi + 8]
je 0x1400ee105
lea rax, [0x1402b22b0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.1401004c0
mov rdx, qword [rsi + 8]
sub rdx, r14
jb 0x1400ee12f
sub rax, r14
mov rbp, qword [rsp + 0x28]
mov rcx, qword [rbp + 8]
cmp rdx, rax
cmovb rax, rdx
cmp rax, rcx
jne 0x1400ee105
mov bl, 1
test rcx, rcx
je 0x1400ee107
mov rax, qword [rbp]
add r14, r14
add r14, qword [rsi]
xor edx, edx
nop word cs:[rax + rax]
movzx ebp, word [r14 + rdx*2]
cmp bp, word [rax + rdx*2]
jne 0x1400ee105
inc rdx
cmp rcx, rdx
jne 0x1400ee0f0
jmp 0x1400ee107
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140257200
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3

Function at 0x1400f21c0
Capabilities:
Check if file exists

Disassembly:
xor r8d, r8d
jmp 0x1400f21d0
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400f222f
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400f2215
call fcn.1400f5de0
mov rcx, qword [rsi]
call fcn.140112bc0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400f2227
mov qword [rsi], rdi
call fcn.1400f5de0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.14001f0c0
lea rcx, [rsi + 0x20]
call fcn.140153bf0
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400f21d0
Capabilities:
Check if file exists

Disassembly:
xor r8d, r8d
jmp 0x1400f21d0
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400f222f
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400f2215
call fcn.1400f5de0
mov rcx, qword [rsi]
call fcn.140112bc0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400f2227
mov qword [rsi], rdi
call fcn.1400f5de0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.14001f0c0
lea rcx, [rsi + 0x20]
call fcn.140153bf0
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400f2260
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14010b850
mov qword [rsi], 0
test rax, rax
je 0x1400f22c7
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400f22ad
call fcn.1400f5de0
mov rcx, qword [rsi]
call fcn.140112bc0
mov qword [rsi], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400f22bf
mov qword [rsi], rbx
call fcn.1400f5de0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14005d600
lea rcx, [rsi + 0x20]
call fcn.140153bf0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
movzx eax, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
movzx eax, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400f5df0
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
call fcn.1400f5ee0
mov eax, dword [rsi]
mov dword [0x14030ebf8], eax
test al, 1
jne 0x1400f5e11
mov al, 1
add rsp, 0x30
pop rsi
ret
mov rcx, qword [0x140322778]
test rcx, rcx
je 0x1400f5e43
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140322778], 0
mov rcx, qword [0x140322750]
test rcx, rcx
jne 0x1400f5e71
and byte [0x14030ebf8], 0xfe
jmp 0x1400f5e4f
mov rcx, qword [0x140322750]
test rcx, rcx
jne 0x1400f5e71
mov ecx, 0x18
call fcn.140255d40
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140322750], rax
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x1400f5ea6
call fcn.1400e8c9c
cmp dword [rsi + 0x14], 0
jne 0x1400f5e9b
mov rcx, qword [0x140322750]
cmp byte [rcx + 0x17], 0
jns 0x1400f5e95
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x30
pop rsi
jmp fcn.1400f6030
lea rax, str.string::assign_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xa6a
call fcn.14004f520
int3
Function at 0x140101bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov r10, qword [rcx + 8]
test r10, r10
je 0x140101d11
mov r11, qword [rcx]
xor esi, esi
lea r8, str._000000000000
lea r9, [0x1402b30e2]
jmp 0x140101bec
mov rsi, rdx
cmp rdx, r10
jae 0x140101d11
lea rdx, [rsi + 1]
movzx eax, byte [r11 + rsi]
test al, al
jns 0x140101be0
mov ecx, 0xffffffff
cmp rdx, r10
jne 0x140101c14
mov rdx, r10
cmp ecx, 0xd800
jae 0x140101ccc
jmp 0x140101be0
cmp al, 0xe0
jb 0x140101c4e
cmp al, 0xef
ja 0x140101c71
and eax, 0xf
movzx esi, byte [rax + r8]
movzx edi, byte [r11 + rdx]
mov ebx, edi
shr ebx, 5
bt esi, ebx
jae 0x140101cc0
and dil, 0x3f
inc rdx
cmp rdx, r10
je 0x140101c03
shl eax, 6
movzx esi, dil
or esi, eax
jmp 0x140101c57
cmp al, 0xc2
jb 0x140101cc0
and eax, 0x1f
mov esi, eax
movzx eax, byte [r11 + rdx]
xor eax, 0x80
cmp al, 0x3f
ja 0x140101cc0
shl esi, 6
or esi, eax
inc rdx
mov ecx, esi
jmp 0x140101cc0
cmp al, 0xf4
ja 0x140101cc0
lea ebx, [rax - 0xf0]
movzx eax, byte [r11 + rdx]
mov rdi, rax
shr rdi, 4
movsx edi, byte [rdi + r9]
bt edi, ebx
jae 0x140101cc0
add rsi, 2
cmp rsi, r10
je 0x140101c03
movzx edi, byte [r11 + rsi]
add dil, 0x80
cmp dil, 0x3f
ja 0x140101d01
shl ebx, 6
and eax, 0x3f
or eax, ebx
mov rdx, rsi
jmp 0x140101c3b
cmp ecx, 0xd800
jb 0x140101be0
lea eax, [rcx - 0xe000]
cmp eax, 0x1dd0
jb 0x140101be0
lea esi, [rcx - 0xfdf0]
xor eax, eax
cmp esi, 0x10020f
ja 0x140101d13
and ecx, 0xfffe
cmp ecx, 0xfffe
jne 0x140101be0
jmp 0x140101d13
mov rdx, rsi
cmp ecx, 0xd800
jae 0x140101ccc
jmp 0x140101be0
mov al, 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x140105ae0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14030ec30]
cmp ecx, 0xffffffff
je 0x140105b02
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
jmp 0x140105b04
xor eax, eax
add rsp, 0x28
ret
Function at 0x140105b10
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x14030ec30]
cmp ecx, 0xffffffff
je 0x140105b36
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140105b3b
call fcn.140105c50
mov eax, dword [0x140324118]
mov ecx, dword [0x14031d424]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140105bfb
mov rbx, qword [0x140324110]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140105bee
mov rcx, qword [0x140322908]
inc rcx
xor edx, edx
lea rax, [0x140322910]
nop word [rax + rax]
lea edi, [rcx + rdx]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x140105baf
inc rdx
cmp rdx, 0x100
jne 0x140105b90
jmp 0x140105bd0
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
mov qword [rax + rsi*8 + 8], r14
mov qword [0x140322908], rdi
mov qword [r15], rdi
mov eax, dword [rax + rsi*8 + 0x10]
mov dword [r15 + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [r15], 0x100
jae 0x140105c41
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rbx
call fcn.140111020
jmp 0x140105b74
lea rcx, [0x140324118]
call fcn.140255ea0
cmp dword [0x140324118], 0xffffffff
jne 0x140105b60
mov ecx, 8
call fcn.140255d40
mov rbx, rax
mov rcx, rax
call fcn.14005b6a0
mov qword [0x140324110], rbx
lea rcx, [0x140324118]
call fcn.140255f38
jmp 0x140105b60
int3

Function at 0x140105c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1402571a0
sub rsp, rax
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x14030ec30]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x140105cec
lea rcx, [rsp + 0x2c]
call fcn.14016d000
test al, al
je 0x140105d67
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x140105cce
lea rcx, [rsp + 0x2c]
call fcn.14016d000
test al, al
je 0x140105d6a
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140105d6a
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x14030ec30], ecx
je 0x140105cec
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14030ec30]
mov dword [rsp + 0x2c], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140105d64
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140259320
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.140255dbc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140258c70
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140257200
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
int3
int3
int3
Function at 0x140105e50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14030ec30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140105e80
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x140105e80
mov rax, qword [rax + rcx]
jmp 0x140105e82
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140105e90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14030ec30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140105ece
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140105ec7
call fcn.140105c50
jmp 0x140105eae
Function at 0x140109c10
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str....._base_file_version_info_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r9d, 0x4c
call fcn.1400f5dc0
lea rcx, [rsp + 0x50]
mov rdx, rsi
xor r8d, r8d
call fcn.140153ea0
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rbx + 0x17], 0
jns 0x140109cb1
mov rbx, qword [rbx]
lea rdx, [rsp + 0x24]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x140109de7
mov ebp, eax
mov esi, eax
mov rcx, rsi
call fcn.140255d40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140259320
mov edx, dword [rsp + 0x24]
mov rcx, rbx
mov r8d, ebp
mov r9, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140109dd1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x4c], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
lea r8, [rsp + 0x28]
lea r9, [rsp + 0x4c]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140109dd1
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x140109dd1
mov rbp, rdi
add rbp, rsi
mov ecx, 0x38
call fcn.140255d40
mov rsi, rax
movzx r15d, word [rbx]
movzx ebx, word [rbx + 2]
lea rax, fcn.14010a3e0
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], rbp
mov rax, qword [0x1403102a0]
and rax, rdi
cmp rax, qword [0x140310288]
jne 0x140109d88
mov rcx, rdi
call fcn.1400fa4f0
mov qword [rsi + 0x20], rdi
mov word [rsi + 0x28], r15w
mov word [rsi + 0x2a], bx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x4c], 0xaaaaaaaa
lea rdx, [0x1402b33d2]
lea r8, [rsp + 0x28]
lea r9, [rsp + 0x4c]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140109e1b
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x30], rax
mov qword [r14], rsi
jmp 0x140109dee
mov qword [r14], 0
test rdi, rdi
je 0x140109dee
mov rcx, rdi
call fcn.140255d7c
jmp 0x140109dee
mov qword [r14], 0
lea rcx, [rsp + 0x50]
call fcn.1401541a0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140257200
mov rax, r14
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
int3
Function at 0x14010a800
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b0
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x4a0], rax
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x490], xmm0
movaps xmmword [rsp + 0x480], xmm0
movaps xmmword [rsp + 0x470], xmm0
movaps xmmword [rsp + 0x460], xmm0
movaps xmmword [rsp + 0x450], xmm0
lea rdx, [0x1402b340d]
lea r8, str....._base_files_file_util_win.cc
lea rsi, [rsp + 0x240]
mov rcx, rsi
mov r9d, 0x194
call fcn.1400f5dc0
lea rcx, [rsp + 0x450]
mov rdx, rsi
xor r8d, r8d
call fcn.140153ea0
lea rsi, [rsp + 0x240]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140259320
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14010a8c4
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, rsi
call fcn.1401021a0
mov rcx, rsi
call fcn.140019da0
lea rsi, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140259320
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x14010a8fb
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, rsi
call fcn.1401021a0
mov rcx, rsi
call fcn.140019da0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14010a91d
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x14010a929
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov sil, 1
test eax, eax
jne 0x14010a994
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14010bec0
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x14010a95f
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x14010a968
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
test r14, r14
je 0x14010a994
test eax, eax
jne 0x14010a994
cmp ebp, 0xfffffffc
jne 0x14010a98f
call fcn.14010bea0
mov ebp, eax
mov dword [r14], ebp
xor esi, esi
lea rcx, [rsp + 0x450]
call fcn.1401541a0
mov rcx, qword [rsp + 0x4a8]
xor rcx, rsp
call fcn.140257200
mov eax, esi
add rsp, 0x4b0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14010a9d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1c7
call fcn.1400f5dc0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140153ea0
cmp byte [rsi + 0x17], 0
jns 0x14010aa61
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rdi
call fcn.1401541a0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140257200
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret