joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c2d9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14009c300
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009c330
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
cmp dword [0x1403629c0], 2
jg 0x14009c3fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x75
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140097cc9
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14009c38f
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
jmp 0x14009c392
and eax, 0x7f
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
test rax, rax
js 0x14009c404
test rsi, rsi
jne 0x14009c3ab
test rax, rax
jne 0x14009c407
lea rsi, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400c7180
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14009c3cd
and r8d, 0x7f
jmp 0x14009c3d7
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140097cc9
cmp byte [rsp + 0x4f], 0
jns 0x14009c3f3
mov rcx, qword [rsp + 0x38]
call fcn.140153bcc
lea rcx, [rsp + 0x50]
call fcn.14009c720
xor esi, esi
jmp 0x14009c314
int3
int3
Function at 0x14009c554
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14009c57e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14009c681
cmp dword [0x1403629c0], 2
jg 0x14009c662
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x82
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140097cc9
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
js 0x14009c5e8
and eax, 0x7f
jmp 0x14009c5ef
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
test rax, rax
js 0x14009c695
test rsi, rsi
jne 0x14009c610
test rax, rax
jne 0x14009c698
lea rsi, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400c7180
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14009c632
and r8d, 0x7f
jmp 0x14009c63c
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140097cc9
cmp byte [rsp + 0x57], 0
jns 0x14009c658
mov rcx, qword [rsp + 0x40]
call fcn.140153bcc
lea rcx, [rsp + 0x58]
call fcn.14009c720
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140156fe0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov edi, eax
bt eax, 0xa
jae 0x14009c68d
test bl, bl
je 0x14009c662
and edi, 0x10
shr edi, 4
jmp 0x14009c664
int3
int3
Function at 0x14009e8ea
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14009e948
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14009e932
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14009e922
mov qword [rdi], rsi
call fcn.1400bcc80
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.1400bcc80
mov rcx, qword [rdi]
call fcn.1400d2f70
mov qword [rdi], 0
jmp 0x14009e910
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400ae560
Capabilities:
Get file size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], r15
movaps xmm0, xmmword [0x1402fccc0]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xb2
call fcn.1400c6940
xor ebx, ebx
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140066fa0
mov qword [r14], r15
mov rcx, qword [rdi]
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rbx, rbx
or rbx, qword [rdi]
mov rcx, rsi
call fcn.140067230
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140156fe0
mov rax, rbx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400b39a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
je 0x1400b39e3
mov r8, rdx
shr r8, 2
xor r9d, r9d
lea r10, [0x14031b5a0]
movzx r11d, r8b
movzx esi, byte [rax + r9]
xor esi, r11d
shr r8d, 8
xor r8d, dword [r10 + rsi*4]
inc r9
cmp rdx, r9
jne 0x1400b39be
cmp r8d, dword [rcx + 0x18]
sete al
pop rsi
ret
xor r8d, r8d
jmp 0x1400b39da

Function at 0x1400b7270
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x50]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1402fccc0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x65
call fcn.1400c6940
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140066fa0
test esi, esi
js 0x1400b7354
lea r9, [rsp + 0x30]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b7360
mov esi, dword [rsp + 0x30]
test esi, esi
js 0x1400b735b
lea rcx, [rsp + 0x50]
call fcn.140067230
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x1400b7329
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400b7329
Function at 0x1400c0aac
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov dword [rcx], eax
mov qword [rcx + 8], rax
mov ecx, dword [rdx]
mov dword [rsi], ecx
mov dword [rdx], eax
mov rbx, qword [rdx + 8]
mov qword [rdx + 8], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x1400c0add
call fcn.1400bcc80
cmp qword [rsi + 8], rbx
je 0x1400c0b0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400c0b1c
cmp r14, 2
jb 0x1400c0b07
mov qword [rsi + 8], rbx
call fcn.1400bcc80
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400bcc80
mov rcx, qword [rsi + 8]
call fcn.1400d2f70
mov qword [rsi + 8], 0
jmp 0x1400c0af8
Function at 0x1400ca330
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400ca3f6
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400ca3bc
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400ca397
mov qword [rsi], rdi
call fcn.1400bcc80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 0
inc rax
cmp rax, 1
jbe 0x1400ca3fa
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400bcc80
mov r14, qword [rsi]
mov rcx, qword [0x140362b78]
test rcx, rcx
je 0x1400ca3e8
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x14037e008]
mov qword [rsi], 0
jmp 0x1400ca385
call fcn.140053470
mov rcx, qword [0x140362b78]
jmp 0x1400ca3d0
mov byte [rsi + 8], 0
int3
Function at 0x1400d28cf
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], r8
mov rsi, rcx
mov r13, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
mov rdi, qword [rcx + 0x10]
lea rax, [rdi + r13]
test rdi, rdi
jle 0x1400d2934
movdqa xmm0, xmmword [0x1403059b0]
movdqa xmm1, xmmword [0x1403059c0]
mov rcx, r13
movdqu xmm2, xmmword [rcx]
pxor xmm3, xmm3
pcmpgtb xmm3, xmm2
pand xmm3, xmm0
pxor xmm3, xmm1
movdqu xmmword [rcx], xmm3
add rcx, 0x10
cmp rcx, rax
jb 0x1400d2913
mov rcx, qword [r13]
mov r8, qword [r13 + 7]
mov qword [rax + 8], r8
mov qword [rax + 1], rcx
mov byte [r13 + rdi], 0xff
test rdi, rdi
je 0x1400d2a33
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x20], rax
xor ebp, ebp
mov r15, qword [rsp + 0x30]
jmp 0x1400d29dd
mov r9d, 0x10
mov r10, r8
add r10, r9
and r10, rdx
movdqu xmm0, xmmword [rcx + r10]
pcmpeqd xmm1, xmm1
pcmpgtb xmm1, xmm0
pmovmskb r11d, xmm1
add r9, 0x10
test r11d, r11d
je 0x1400d2975
bsf r9d, r11d
add r9, r10
and r9, rdx
mov r10, r9
sub r10, r8
mov r11, rbp
sub r11, r8
xor r11, r10
and r11, rdi
cmp r11, 0xf
ja 0x1400d2a5d
and al, 0x7f
mov byte [rcx + rbp], al
lea r8, [rbp - 0xf]
and r8, rdx
and edx, 0xf
add rdx, r8
mov byte [rcx + rdx], al
inc rbp
add r15, r14
cmp rbp, rdi
je 0x1400d2a33
cmp byte [r13 + rbp], 0xfe
jne 0x1400d29d2
mov rcx, rsi
mov rdx, r15
mov rax, rbx
call qword [0x14037e008]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov r9, rax
shr r9, 7
mov r8, rcx
shr r8, 0xc
xor r8, r9
and r8, rdx
movdqu xmm0, xmmword [rcx + r8]
pcmpeqd xmm1, xmm1
pcmpgtb xmm1, xmm0
pmovmskb r11d, xmm1
mov r10, r8
test r11d, r11d
jne 0x1400d2997
jmp 0x1400d296c
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, rcx
shr rdx, 3
add rdx, qword [rsi + 0x18]
sub rcx, rdx
mov qword [rax - 8], rcx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, r9
imul r12, r14
add r12, qword [rsp + 0x30]
and al, 0x7f
lea r8, [r9 - 0xf]
and r8, rdx
and edx, 0xf
add rdx, r8
cmp byte [r13 + r9], 0x80
mov byte [rcx + r9], al
mov byte [rcx + rdx], al
mov rcx, rsi
je 0x1400d2ad3
mov rdx, qword [rsp + 0x28]
mov r8, r12
mov rax, qword [rsp + 0x20]
call qword [0x14037e008]
mov rcx, rsi
mov rdx, r12
mov r8, r15
mov r12, qword [rsp + 0x20]
mov rax, r12
call qword [0x14037e008]
mov rcx, rsi
mov rdx, r15
mov r8, qword [rsp + 0x28]
mov rax, r12
call qword [0x14037e008]
dec rbp
sub r15, r14
jmp 0x1400d29d2
mov rdx, r12
mov r8, r15
mov rax, qword [rsp + 0x20]
call qword [0x14037e008]
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov r8b, 0x80
mov byte [rax + rbp], r8b
lea rdx, [rbp - 0xf]
and rdx, rcx
and ecx, 0xf
add rcx, rdx
mov byte [rax + rcx], r8b
jmp 0x1400d29d2
Function at 0x1400d2e32
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx], 1
xor eax, eax
mov qword [rcx + 8], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400d2e64
call fcn.1400bcc80
cmp qword [rsi + 8], r14
je 0x1400d2e96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400d2ec7
cmp r15, 2
jb 0x1400d2e8e
mov qword [rsi + 8], r14
call fcn.1400bcc80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400d2eb1
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400bcc80
mov rcx, qword [rdi]
call fcn.1400d2f70
mov qword [rdi], 0
jmp 0x1400d2ea2
call fcn.1400bcc80
mov rcx, qword [rsi + 8]
call fcn.1400d2f70
mov qword [rsi + 8], 0
jmp 0x1400d2e7f

Function at 0x1400d2ee0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400d2f0a
call fcn.1400bcc80
cmp qword [rsi], r14
je 0x1400d2f39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400d2f58
cmp r15, 2
jb 0x1400d2f31
mov qword [rsi], r14
call fcn.1400bcc80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400bcc80
mov rcx, qword [rsi]
call fcn.1400d2f70
mov qword [rsi], 0
jmp 0x1400d2f23

Function at 0x1400d55b0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x1400d55fc
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400d5607
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400d55ea
mov qword [rdi], rsi
call fcn.1400bcc80
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400bcc80
mov r14, qword [rdi]
mov rcx, qword [0x140362b78]
test rcx, rcx
je 0x1400d5633
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x14037e008]
mov qword [rdi], 0
jmp 0x1400d55d8
call fcn.140053470
mov rcx, qword [0x140362b78]
jmp 0x1400d561b
Function at 0x1400d81e0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0x28]
mov qword [rdx], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140362788]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400d8236
jnp 0x1400d829c
ucomisd xmm0, xmm6
jne 0x1400d823e
jnp 0x1400d8298
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1403068f0]
subpd xmm1, xmmword [0x140306900]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x14030e398]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140156fe0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400d8270
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140362798]
mov ecx, dword [0x1403576e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400d83b9
mov eax, dword [0x1403627a8]
mov ecx, dword [0x1403576e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400d83f3
rdtsc
mov rbx, rax
mov r14, rdx
xor r12d, r12d
lea r15, [rsp + 0x30]
mov qword [r15], r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r15], r12
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r13, qword [0x1403627a0]
cvtsi2sd xmm1, r13
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x14030e390]
ucomisd xmm2, xmm1
ja 0x1400d8236
shl r14, 0x20
or rbx, r14
sub rbx, qword [0x140362790]
movq xmm2, rbx
punpckldq xmm2, xmmword [0x1403068f0]
subpd xmm2, xmmword [0x140306900]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x140362788], xmm0
jmp 0x1400d8236
lea rcx, [0x140362798]
call fcn.1401547b8
cmp dword [0x140362798], 0xffffffff
jne 0x1400d82e5
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140362790], rdx
lea rcx, [0x140362798]
call fcn.140153cf4
jmp 0x1400d82e5
lea rcx, [0x1403627a8]
call fcn.1401547b8
cmp dword [0x1403627a8], 0xffffffff
jne 0x1400d830a
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x1403627a0], rax
lea rcx, [0x1403627a8]
call fcn.140153cf4
jmp 0x1400d830a
Function at 0x1400e0990
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140357044]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400e09c4
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x1400e09c4
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1400e09be
Function at 0x1400e09d0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rcx + 0x10]
inc rbx
cmp rbx, 2
jb 0x1400e0b2e
mov rsi, r9
lea rax, [rcx + 0x10]
mov rdx, qword [r8 + 8]
mov dword [rdx], 0x20
mov r8d, dword [rcx + 0x20]
mov dword [rdx + 4], r8d
mov dword [rdx + 0xc], 0
mov r8d, dword [rcx + 0x18]
cmp r8d, 2
ja 0x1400e0a2b
mov dword [rdx + 8], r8d
mov r8, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x30]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], r8
movabs rcx, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x38]
mov qword [rdi], rcx
mov rcx, rax
mov rdx, rdi
call fcn.1400e0c20
xor eax, eax
mov qword [rsp + 0x20], rax
mov r14, qword [rdi]
mov qword [rdi], rax
test r14, r14
je 0x1400e0a93
cmp r14, 0xffffffffffffffff
je 0x1400e0b55
call fcn.1400bcc80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x20], r14
call fcn.1400bcc80
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x20]
call fcn.1400d2e32
cmp qword [rsi], 0
je 0x1400e0c15
mov r14, qword [rsi + 8]
mov eax, dword [rsp + 0x28]
mov dword [r14], eax
mov dword [rsp + 0x28], 0
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x1400e0adc
call fcn.1400bcc80
cmp qword [r14 + 8], r15
je 0x1400e0b12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [r14 + 8]
inc rax
cmp rax, 2
jae 0x1400e0bb7
cmp r12, 2
jb 0x1400e0b0a
mov qword [r14 + 8], r15
call fcn.1400bcc80
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
inc rax
cmp rax, 2
jae 0x1400e0b8d
mov rax, qword [rsp + 0x38]
inc rax
cmp rax, 2
jae 0x1400e0b62
test rbx, 0xfffffffffffffffe
setne bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140156fe0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400e0a8b
call fcn.1400bcc80
mov rsi, qword [rsp + 0x38]
mov rcx, qword [0x140362b78]
test rcx, rcx
je 0x1400e0c04
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [0x14037e008]
jmp 0x1400e0b2e
call fcn.1400bcc80
mov rsi, qword [rsp + 0x30]
mov rcx, qword [0x140362b78]
test rcx, rcx
je 0x1400e0be8
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [0x14037e008]
jmp 0x1400e0b20
call fcn.1400bcc80
mov rdi, qword [r14 + 8]
mov rcx, qword [0x140362b78]
test rcx, rcx
je 0x1400e0bf6
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x14037e008]
mov qword [r14 + 8], 0
jmp 0x1400e0afb
call fcn.140053470
mov rcx, qword [0x140362b78]
jmp 0x1400e0ba3
call fcn.140053470
mov rcx, qword [0x140362b78]
jmp 0x1400e0bcc
call fcn.140053470
mov rcx, qword [0x140362b78]
jmp 0x1400e0b7c
int3
Function at 0x1400e7f40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140357044]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x1400e7f68
test rdi, rdi
je 0x1400e7f81
call fcn.140074760
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400e83a0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1038
call fcn.140156f80
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x1030], rax
lea r14, [rsp + 0x830]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.140159120
lea rax, [rsp + 0x2c]
mov dword [rax], 1
lea r9, [rsp + 0x28]
mov dword [r9], 0x800
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.1400e84c0
mov edi, eax
test eax, eax
jne 0x1400e843e
mov eax, dword [rsp + 0x2c]
cmp eax, 1
jne 0x1400e845d
lea rdi, [rsp + 0x830]
mov rcx, rdi
call fcn.14015468c
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14010a634
xor edi, edi
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140156fe0
mov eax, edi
add rsp, 0x1038
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp eax, 2
jne 0x1400e84a5
lea rdi, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.140159120
lea rcx, [rsp + 0x830]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x28], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x1400e84ac
lea rdi, [rsp + 0x30]
jmp 0x1400e8426
mov edi, 0x3f4
jmp 0x1400e843e
mov edi, 0xea
jmp 0x1400e843e

Function at 0x1400e84c0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, r9
mov r14, r8
mov rsi, rdx
mov r12, rcx
mov rdi, qword [rsp + 0xd0]
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x5f]
mov byte [rbx], 0xaa
mov r13, qword [rcx]
lea rdx, str.ReadValue
lea r8, str....._basewin_registry.cc
lea rbp, [rsp + 0x38]
mov rcx, rbp
mov r9d, 0x1c4
call fcn.1400c6940
mov rcx, rbx
mov rdx, rbp
mov r8, r13
mov r9d, 1
call fcn.1400e8580
mov rcx, qword [r12]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rcx, rbx
call fcn.1400bf590
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret