joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14022c510
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14041af00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14022c54e
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14022c547
call fcn.14022c3f0
jmp 0x14022c52e

Function at 0x14022e540
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1403df810]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x14022e6bc
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x140426480]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.14035c608
mov rcx, rbx
call fcn.14035ad74
sub r14, rax
lea rdx, [0x1403e1760]
mov rcx, rbx
mov r8, r14
call fcn.14035c608
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1403369a0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14022e618
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14035c650
test eax, eax
je 0x14022e653
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14022e64f
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14035c650
test eax, eax
je 0x14022e653
xor eax, eax
jmp 0x14022e655
mov al, 1
mov byte [0x140426079], al
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1403eb070]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14022e6ad
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [case.0x1403339d6.0]
test eax, eax
je 0x14022e6ad
cmp dword [rsp + 0x30], 0
setne al
jmp 0x14022e6af
xor eax, eax
mov byte [0x140426680], al
mov byte [0x140426078], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14022e980
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x14022e9b3
mov rax, qword [rsi + 8]
test rax, rax
je 0x14022e9e2
bt ebx, 8
jae 0x14022e9c7
mov eax, ebx
and eax, 0x200
jne 0x14022e9e2
cmp edi, 2
lea rax, [0x140426080]
lea rcx, [0x140426280]
cmove rcx, rax
cmp word [rcx], 0
je 0x14022ea01
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140334bf0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x14022e9e2
cmp byte [0x140426680], 0
setne al
bt ebx, 8
jb 0x14022e9e2
shr ebx, 9
and ebx, 1
or bl, al
je 0x14022e9e2
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movzx ebp, byte [rsi + 0x17]
test bpl, bpl
js 0x14022ea64
mov rdi, rsi
jmp 0x14022ea6b
mov rdi, qword [rsi]
mov rbp, qword [rsi + 8]
mov ebx, 1
xor r14d, r14d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x14022eaa9
mov rdx, qword [r12]
mov rcx, rdi
mov r8, r15
call fcn.14034faa8
test eax, eax
je 0x14022eaba
add r12, 0x28
inc r14
cmp r14, rbx
jb 0x14022ea89
jmp 0x14022eb3d
movzx edx, word [rdi + r15*2]
cmp edx, 0x5c
je 0x14022eac8
test edx, edx
jne 0x14022eaa9
lea rcx, [rdi + r15*2]
mov r8d, dword [r12 + 0x10]
lea rax, str.WOW6432Node_
cmp r8d, 1
je 0x14022eafa
cmp r8d, 2
jne 0x14022eaf0
mov rdi, rcx
lea rax, str.WOW6432Node
jmp 0x14022eafa
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], r8d
jne 0x14022eb18
lea rdx, [rcx + 2]
dec r13
cmp word [rcx + 2], 0x5c
mov rcx, rdx
je 0x14022eb05
jmp 0x14022eb1b
mov rdx, rcx
mov rbx, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
mov rbp, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rax
xor r14d, r14d
mov rdi, rdx
jmp 0x14022eab0
cmp dword [rsp + 0x2c], 0
je 0x14022e9e2
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x14022eb54
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.140385930
jmp 0x14022e9e2
Function at 0x1402319e0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
mov rcx, qword [r8]
cmovns rcx, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
cmovs rax, qword [r8 + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.14030f580
cmp byte [rsi + 0x17], 0
jns 0x140231a3b
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.14030f580
cmp byte [rdi + 0x17], 0
jns 0x140231a60
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x140231a7f
mov rcx, qword [rsp + 0x48]
call fcn.1403336f4
cmp byte [rsp + 0x87], 0
jns 0x140231a93
mov rcx, qword [rsp + 0x70]
call fcn.1403336f4
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x140231b40
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.14030f580
cmp byte [rdi + 0x17], 0
jns 0x140231b81
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x140231ba2
mov rcx, qword [rsp + 0x58]
call fcn.1403336f4
test rsi, rsi
je 0x140231c51
test edi, edi
je 0x140231c51
mov ecx, edi
add rcx, rcx
call fcn.14033372c
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.14030f580
cmp byte [r14 + 0x17], 0
jns 0x140231be5
mov r14, qword [rsp + 0x58]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x140231c05
mov rcx, qword [rsp + 0x58]
call fcn.1403336f4
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140231c6f
mov rcx, rbx
call fcn.14035ad74
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.14030fa40
cmp byte [rsi + 0x17], 0
jns 0x140231c38
mov rcx, qword [rsi]
call fcn.1403336f4
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.140333734
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140232530
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140232557
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1402325a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140232594
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140334bf0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140232670
mov ecx, 2
call fcn.140317c40
test al, al
jne 0x1402325c0
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140334bf0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str........._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.14038d190
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.14036f000
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14030fa40
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14023263f
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.14036f000
cmp byte [rsp + 0x4f], 0
jns 0x14023265b
mov rcx, qword [rsp + 0x38]
call fcn.1403336f4
lea rcx, [rsp + 0x50]
call fcn.14038d210
jmp 0x1402325a2
Function at 0x140232670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140232697
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140232776
mov dil, 1
test al, 0x10
jne 0x140232786
mov ecx, 2
call fcn.140317c40
test al, al
je 0x140232784
lea rdx, str........._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.140212ee0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, sendto
call fcn.14036f000
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14030fa40
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140232739
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.14036f000
lea rdx, str.:_not_a_directory
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rax
call fcn.14036f000
cmp byte [rsp + 0x5f], 0
jns 0x14023276a
mov rcx, qword [rsp + 0x48]
call fcn.1403336f4
lea rcx, [rsp + 0x60]
call fcn.1402133d0
jmp 0x140232784
mov ecx, 2
call fcn.140317c40
test al, al
jne 0x1402327a2
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140334bf0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str........._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.14038d190
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, sendto
call fcn.14036f000
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14030fa40
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140232821
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.14036f000
cmp byte [rsp + 0x5f], 0
jns 0x14023283d
mov rcx, qword [rsp + 0x48]
call fcn.1403336f4
lea rcx, [rsp + 0x60]
call fcn.14038d210
jmp 0x140232784
Function at 0x140233ef0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x140233f84
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.140396490
test al, al
jne 0x140233f4c
add rdi, 0x70
cmp rdi, r12
jne 0x140233f31
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x140233f84
cmp byte [rdi + 0x27], 0
jns 0x140233f5e
mov rcx, qword [rdi + 0x10]
jmp 0x140233f62
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x140233f84
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140234290
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov esi, 1
cmp r14, r12
je 0x14023433c
mov rdi, r9
mov ebp, r8d
mov rbx, rcx
lea r15, [rsp + 0x20]
mov rcx, r14
mov rdx, r15
call fcn.140396490
test al, al
jne 0x1402342f0
add r14, 0x70
cmp r14, r12
jne 0x1402342d5
mov r14, r12
cmp r14, qword [rbx + 0x58]
je 0x14023433c
mov eax, dword [r14 + 0x68]
cmp eax, ebp
jne 0x14023430b
cmp byte [r14 + 0x27], 0
jns 0x14023431a
mov rcx, qword [r14 + 0x10]
jmp 0x14023431e
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
jmp 0x14023433c
lea rcx, [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14023433c
shr eax, 3
and eax, 2
mov esi, eax
jne 0x14023433c
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140334bf0
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140235640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140235610]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x140426800]
lea rdx, [0x140235470]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140235738
cmp dword [0x140426808], 0
jne 0x140235745
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x14042680c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x1402356ec
mov ecx, 1
mov edx, 0x28
call fcn.14030c9b0
test rax, rax
je 0x140235745
mov r14, rax
mov ecx, dword [0x14042680c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14023573d
lea r15, [0x140426810]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x140426820]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140334bf0
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14034cb60
mov rcx, r14
call fcn.14030c910
mov rcx, rsi
mov rax, rdi
call qword [case.0x1403339d6.0]
xor esi, esi
jmp 0x14023571c

Function at 0x1402358c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1402358fc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140235906
add rdi, rbx
sub rsi, rbx
jne 0x1402358da
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14034cb60
int3

Function at 0x140235da0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140426850], 0
jne 0x140235ddd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140235dd0
mov dword [rdi], eax
mov dword [0x140426858], eax
mov qword [0x140426850], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x140237b50
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x140237c3c
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1403369a0
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x140237c43
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.140237ca0
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140237c43
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x140237c4c
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140334bf0
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14023bb40
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14023bb50
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14023bb71
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14023bb91
cmp byte [r14 + 0x68], 0
jne 0x14023bc55
or edi, 0x20000000
test dil, 8
jne 0x14023bc0b
xor r15d, r15d
cmp byte [r14 + 0x70], 0
mov r12d, 0
je 0x14023bbab
mov r12, qword [r14 + 0x78]
cmp byte [r14 + 0x50], 0
mov r13d, 0
je 0x14023bbbc
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x28], 0
jne 0x14023bc20
cmp byte [r14], 0
jne 0x14023bc2e
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14023bc3f
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14023bc4b
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [r14 + 0x88], 0
je 0x14023bc72
or edi, 0x40000000
jmp 0x14023bb97
lea rcx, [r14 + 0x30]
call fcn.140225430
mov r15, rax
jmp 0x14023bbc3
add r14, 8
mov rcx, r14
call fcn.140225430
mov r9, rax
jmp 0x14023bbcc
cmp ebx, 4
jne 0x14023bc60
mov edx, 6
jmp 0x14023bbd5
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14023bbf6
or edi, 0x80000000
jmp 0x14023bb91
lea eax, [rbx - 2]
cmp eax, 2
jae 0x14023bc7d
mov edx, 7
jmp 0x14023bbd5
or edi, 0x10000000
jmp 0x14023bb97
cmp ebx, 1
jne 0x14023bc8c
mov edx, 4
jmp 0x14023bbd5
xor edx, edx
jmp 0x14023bbd5
Function at 0x14023bb50
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14023bb50
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14023bb71
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14023bb91
cmp byte [r14 + 0x68], 0
jne 0x14023bc55
or edi, 0x20000000
test dil, 8
jne 0x14023bc0b
xor r15d, r15d
cmp byte [r14 + 0x70], 0
mov r12d, 0
je 0x14023bbab
mov r12, qword [r14 + 0x78]
cmp byte [r14 + 0x50], 0
mov r13d, 0
je 0x14023bbbc
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x28], 0
jne 0x14023bc20
cmp byte [r14], 0
jne 0x14023bc2e
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14023bc3f
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14023bc4b
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [r14 + 0x88], 0
je 0x14023bc72
or edi, 0x40000000
jmp 0x14023bb97
lea rcx, [r14 + 0x30]
call fcn.140225430
mov r15, rax
jmp 0x14023bbc3
add r14, 8
mov rcx, r14
call fcn.140225430
mov r9, rax
jmp 0x14023bbcc
cmp ebx, 4
jne 0x14023bc60
mov edx, 6
jmp 0x14023bbd5
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14023bbf6
or edi, 0x80000000
jmp 0x14023bb91
lea eax, [rbx - 2]
cmp eax, 2
jae 0x14023bc7d
mov edx, 7
jmp 0x14023bbd5
or edi, 0x10000000
jmp 0x14023bb97
cmp ebx, 1
jne 0x14023bc8c
mov edx, 4
jmp 0x14023bbd5
xor edx, edx
jmp 0x14023bbd5

Function at 0x14023bca0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14023bcd8
cmp byte [r15 + 0x68], 0
jne 0x14023bda7
or edi, 0x20000000
test dil, 8
jne 0x14023bd66
xor r14d, r14d
cmp byte [r15 + 0x70], 0
mov r12d, 0
je 0x14023bcf6
mov r12, qword [r15 + 0x78]
cmp byte [r15 + 0x50], 0
mov r13d, 0
je 0x14023bd07
mov r13, qword [r15 + 0x58]
cmp byte [r15 + 0x28], 0
jne 0x14023bd7b
cmp byte [r15], 0
jne 0x14023bd89
xor r9d, r9d
cmp ebx, 4
jne 0x14023bd57
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x14023bd9d
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rbx - 2]
cmp eax, 2
jae 0x14023bdbd
mov edx, 7
jmp 0x14023bd21
cmp byte [r15 + 0x88], 0
je 0x14023bdb2
or edi, 0x40000000
jmp 0x14023bce2
lea rcx, [r15 + 0x30]
call fcn.140225430
mov r14, rax
jmp 0x14023bd0e
add r15, 8
mov rcx, r15
call fcn.140225430
mov r9, rax
jmp 0x14023bd17
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14023bd42
or edi, 0x80000000
jmp 0x14023bcd8
or edi, 0x10000000
jmp 0x14023bce2
mov edx, 1
test ebx, ebx
je 0x14023bd21
cmp ebx, 1
jne 0x14023bdd9
mov edx, 4
jmp 0x14023bd21
xor edx, edx
jmp 0x14023bd21
Function at 0x14023fb50
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14023fb65
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret