joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140114d40
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rdi
mov dl, 0xaa
call fcn.14024e4f0
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
sete al
mov edx, dword [rbx]
test rdx, rdx
sete bl
or bl, al
jne 0x140114de3
movzx eax, byte [rsi + 0x17]
test al, al
js 0x140114e03
cmp edx, 0xb
jb 0x140114dbc
cmp rax, rdx
cmova rdx, rax
or rdx, 7
mov rcx, rsi
call fcn.1400d3c90
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.1400d43b0
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d3eb0
xor bl, 1
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.14024c3c0
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0x7fffffffffffffff
and rax, qword [rsi + 0x10]
dec rax
cmp rax, rdx
jae 0x140114dbc
mov rcx, qword [rsi + 8]
cmp rcx, rdx
cmova rdx, rcx
mov rcx, rdx
or rcx, 7
cmp rdx, 0xb
mov edx, 0xa
cmovae rdx, rcx
cmp rdx, rax
jne 0x140114db4
jmp 0x140114dbc

Function at 0x14011c170
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov dword [rcx], eax
mov qword [rcx + 8], rax
mov ecx, dword [rdx]
mov dword [rsi], ecx
mov dword [rdx], eax
mov rbx, qword [rdx + 8]
mov qword [rdx + 8], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x14011c1a1
call fcn.1401ee3c0
cmp qword [rsi + 8], rbx
je 0x14011c1d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14011c1e0
cmp r14, 2
jb 0x14011c1cb
mov qword [rsi + 8], rbx
call fcn.1401ee3c0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401ee3c0
mov rcx, qword [rsi + 8]
call fcn.140201a20
mov qword [rsi + 8], 0
jmp 0x14011c1bc
Function at 0x14011ed00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14011ed1a
test r8d, r8d
jne 0x14011ed13
call fcn.140166bd0
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.14011e4b0
Function at 0x14011fb70
Capabilities:
Initialize winhttp library

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x150], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x20], 0x10000000
mov rcx, rdx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
lea rax, [0x1403b5a78]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 0
test rdi, rdi
je 0x14011fce8
lea rbx, [rsp + 0x3c]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.14024e4f0
mov dword [rbx - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x100000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x30]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14011fce8
lea rbx, [rsp + 0x3c]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.14024e4f0
mov dword [rbx - 0xc], 0x11c
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x300000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x30]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x14011fce8
lea r8, [rsp + 0x30]
mov dword [r8], 0xa80
mov rcx, rdi
mov edx, 0x54
mov r9d, 4
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14024c3c0
mov rax, rsi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401324b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1401324d7
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140132511
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140132530
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14024c3c0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140132600
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14024c3c0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1401ee3d0
test al, al
jne 0x140132542
xor esi, esi
jmp 0x140132514
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.1402c61f0
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1402885e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1401fa740
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401325c8
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
jmp 0x1401325cc
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1402885e0
cmp byte [rsp + 0x4f], 0
jns 0x1401325e8
mov rcx, qword [rsp + 0x38]
call fcn.14024ac18
lea rcx, [rsp + 0x50]
call fcn.1402c6270
jmp 0x14013253e
Function at 0x140132600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140132627
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140132659
mov dil, 1
test al, 0x10
je 0x1401326f8
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14024c3c0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1401ee3d0
test al, al
je 0x140132706
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.1402c61f0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1402885e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1401fa740
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14013278a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x14013278e
mov ecx, 2
call fcn.1401ee3d0
test al, al
jne 0x14013270d
xor edi, edi
jmp 0x14013263d
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.1400ee420
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1402885e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1401fa740
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401327b9
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x1401327bd
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1402885e0
cmp byte [rsp + 0x5f], 0
jns 0x1401327aa
mov rcx, qword [rsp + 0x48]
call fcn.14024ac18
lea rcx, [rsp + 0x60]
call fcn.1402c6270
jmp 0x140132706
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1402885e0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1402885e0
cmp byte [rsp + 0x5f], 0
jns 0x1401327ee
mov rcx, qword [rsp + 0x48]
call fcn.14024ac18
lea rcx, [rsp + 0x60]
call fcn.1400ee910
jmp 0x140132706
Function at 0x140133cf0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140132890
mov rax, qword [rsi]
test rax, rax
je 0x140133d67
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140133d6e
lea rcx, [rsp + 0x28]
call fcn.140133410
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14024c3c0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140133d40
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140133d86
add rbx, 0x70
cmp rbx, r15
je 0x140133d40
jmp 0x140133d75
cmp byte [rbx + 0x27], 0
jns 0x140133d92
mov rcx, qword [rbx + 0x10]
jmp 0x140133d96
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x140133d7b
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
je 0x140133dbc
mov rcx, r14
mov rdx, rbx
call fcn.140134be0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140133d7b
mov rcx, rdi
mov rdx, rbx
call fcn.140134a10
jmp 0x140133d7b

Function at 0x140133dd0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140132890
mov rax, qword [rsi]
test rax, rax
je 0x140133e47
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140133e4e
lea rcx, [rsp + 0x28]
call fcn.140133410
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14024c3c0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140133e20
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x140133e7e
cmp byte [rbx + 0x27], 0
jns 0x140133e67
mov rcx, qword [rbx + 0x10]
jmp 0x140133e6b
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x140133e7e
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jne 0x140133e89
jmp 0x140133e9e
add rbx, 0x70
cmp rbx, r15
je 0x140133e20
jmp 0x140133e55
mov rcx, r14
mov rdx, rbx
call fcn.140134be0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140133e7e
mov rcx, rdi
mov rdx, rbx
call fcn.140134a10
jmp 0x140133e7e
Function at 0x140135460
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14044af28]
mov ecx, dword [0x140441a2c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14013549b
movzx eax, word [0x14044aef8]
cmp eax, 9
jne 0x1401354e3
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14044af28]
call fcn.14024ad30
cmp dword [0x14044af28], 0xffffffff
jne 0x140135485
xorps xmm0, xmm0
movups xmmword [0x14044af18], xmm0
movups xmmword [0x14044af08], xmm0
movups xmmword [0x14044aef8], xmm0
lea rcx, [0x14044aef8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14044af28]
call fcn.14024adc8
jmp 0x140135485
test eax, eax
je 0x140135496
cmp eax, 6
jne 0x1401354f3
mov eax, 2
jmp 0x140135496
cmp eax, 0xc
jne 0x1401354ff
mov eax, 3
jmp 0x140135496
mov eax, 4
jmp 0x140135496
Function at 0x140135e60
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1403a4808]
lea r9, [0x1403d4800]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140135fe9
xor r12d, r12d
lea r13, [rsp + 0x60]
mov qword [r13], r12
mov r15, qword [rsp + 0x68]
movzx eax, byte [r14 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r14]
cmovns rax, r14
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
cmovs rcx, qword [r14 + 8]
mov qword [rdx + 8], rcx
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.1401685a0
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [case.0x1402ceac0.0]
mov ebp, eax
mov rcx, r14
call fcn.1401685f0
test ebp, ebp
js 0x140135ff5
test bl, bl
je 0x140135f82
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140136001
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x14013600d
mov byte [rsi], 0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14013601f
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140135fc8
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402ceac0.0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14024c3c0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsi], 1
mov dword [rsi + 4], 0
jmp 0x140135fa8
mov byte [rsi], 1
mov dword [rsi + 4], 1
jmp 0x140135f9e
mov byte [rsi], 1
mov dword [rsi + 4], 2
jmp 0x140135f9e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402ceac0.0]
jmp 0x140135f9b
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402ceac0.0]
jmp 0x140135fa8
Function at 0x14013a7f0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14013a8de
cmp qword [rsi], 0
jne 0x14013a8de
cmp dword [rsi + 0x14], 0
jne 0x14013a8de
cmp qword [rsi + 8], 0
jne 0x14013a8de
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x14013a860
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14013a8b0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14013a858
mov qword [rsi], r14
call fcn.1401ee3c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x14013a89a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14013a8c6
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14013a892
mov qword [rsi + 8], r14
call fcn.1401ee3c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401ee3c0
mov rcx, qword [rsi]
call fcn.140201a20
mov qword [rsi], 0
jmp 0x14013a846
call fcn.1401ee3c0
mov rcx, qword [rsi + 8]
call fcn.140201a20
mov qword [rsi + 8], 0
jmp 0x14013a87f
mov rcx, rsi
call fcn.1403134a0
mov rax, qword [rsi]
jmp 0x14013a82a
Function at 0x140143c40
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x140143e5c
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x140435120], rax
jne 0x140143e5f
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.1401f0100
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140143e1e
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x140143dac
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140143e17
lea rdx, [rsi + r12*8]
bswap rcx
mov r14d, dword [rdx + 0x60]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x140143e2b
mov edx, ecx
and edx, 0x1fc000
je 0x140143e2b
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.140211130
mov ecx, dword [0x14044e458]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140441a2c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x140], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14024c3c0
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.140211f20
test rax, rax
je 0x140143e62
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x140143d27
xor ecx, ecx
jmp 0x140143d0d
mov rcx, rbx
call fcn.140211d90
jmp 0x140143cbe
movaps xmm0, xmmword [0x1403be790]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.1402c6da0
mov rcx, rsi
call fcn.140098280
mov rcx, r14
call fcn.1402c6e10
int3
int3
xor edi, edi
jmp 0x140143d51
Function at 0x1401498f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
call qword [case.0x1402ceac0.0]
mov byte [rsi + 0x429], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [case.0x1402ceac0.0]
test rax, rax
je 0x14014999d
mov eax, dword [0x14044fea0]
mov ecx, dword [0x140441a2c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140149962
lea rcx, [0x14044fe90]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1401fb790
lea rcx, [0x14044fea0]
call fcn.14024ad30
cmp dword [0x14044fea0], 0xffffffff
jne 0x14014994e
xorps xmm0, xmm0
movups xmmword [0x14044fe90], xmm0
lea rcx, [0x14044fe90]
xor edx, edx
call fcn.1400f9a00
lea rcx, [0x14044fea0]
call fcn.14024adc8
jmp 0x14014994e
add rsp, 0x20
pop rsi
ret

Function at 0x14014b8e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14044fef0]
cmp rdi, 1
jbe 0x14014b909
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1401fb790
lea rcx, [0x14044fef0]
call fcn.1400ede50
test al, al
je 0x14014b94e
xorps xmm0, xmm0
movups xmmword [0x14044fef8], xmm0
lea rbx, [0x14044fef0]
lea rdi, [0x14044fef8]
mov rcx, rdi
xor edx, edx
call fcn.1400f9a00
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400edf10
jmp 0x14014b8f7
mov rdi, qword [0x14044fef0]
jmp 0x14014b8f7

Function at 0x14014bf20
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14014bf35
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14014c710
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [rcx], 0
je 0x14014c71d
mov ecx, dword [rcx + 4]
jmp fcn.14014e1d0
ret
Function at 0x14014d170
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov edi, r9d
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0
test r8b, r8b
jne 0x14014d240
or edi, 8
lea r8, [rsp + 0x40]
mov rcx, rdx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14014d2e2
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14014d238
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x14014d23c
call fcn.1401ee3c0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi], 1
mov qword [rsi + 8], 0
cmp rbx, 0xffffffffffffffff
je 0x14014d1fb
test rbx, rbx
je 0x14014d21e
call fcn.1401ee3c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14014d216
mov qword [rsi + 8], rbx
call fcn.1401ee3c0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14024c3c0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
jmp 0x14014d1e0
xor ebx, ebx
jmp 0x14014d1d8
lea r8, [rsp + 0x40]
mov rcx, rdx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14014d2e2
mov rdx, qword [rsp + 0x40]
xor r14d, r14d
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, rbx
call fcn.1401d1cf0
mov rcx, qword [rbx]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
or edi, 8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 2
mov edx, edi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14014d2b2
mov r14, qword [rsp + 0x48]
mov qword [rsp + 0x40], r14
test r14, r14
je 0x14014d2ea
mov rax, qword [rsp + 0x38]
inc rax
cmp rax, 2
jb 0x14014d1bb
call fcn.1401ee3c0
mov rcx, qword [rsp + 0x38]
call fcn.140201a20
jmp 0x14014d1bb
mov byte [rsi], 0
jmp 0x14014d21e
mov byte [rsi], 0
mov rax, qword [rsp + 0x38]
inc rax
cmp rax, 2
jb 0x14014d21e
call fcn.1401ee3c0
mov rcx, qword [rsp + 0x38]
call fcn.140201a20
jmp 0x14014d21e

Function at 0x14014e1d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.1400f90a0
test al, al
jne 0x14014e258
call fcn.1400f9030
movzx edx, al
mov ecx, esi
call fcn.140102850
mov eax, dword [0x14044ff98]
mov ecx, dword [0x140441a2c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14014e227
movsxd rdx, esi
inc rdx
lea rcx, [0x14044ff88]
add rsp, 0x20
pop rsi
jmp fcn.1401fb790
lea rcx, [0x14044ff98]
call fcn.14024ad30
cmp dword [0x14044ff98], 0xffffffff
jne 0x14014e210
lea rcx, [0x14044ff88]
xor edx, edx
call fcn.1400f9a00
lea rcx, [0x14044ff98]
call fcn.14024adc8
jmp 0x14014e210
mov edx, 3
jmp 0x14014e1e8
Function at 0x14014e260
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.140102850
mov eax, dword [0x14044ff98]
mov ecx, dword [0x140441a2c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14014e2a4
movsxd rdx, esi
inc rdx
lea rcx, [0x14044ff88]
add rsp, 0x20
pop rsi
jmp fcn.1401fb790
lea rcx, [0x14044ff98]
call fcn.14024ad30
cmp dword [0x14044ff98], 0xffffffff
jne 0x14014e28d
lea rcx, [0x14044ff88]
xor edx, edx
call fcn.1400f9a00
lea rcx, [0x14044ff98]
call fcn.14024adc8
jmp 0x14014e28d

Function at 0x1401505b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x140150621
xor r11d, r11d
mov rdi, qword [r8 + r11*8]
mov rsi, qword [rcx + r11*8]
mov rbx, rsi
xor rbx, rdi
mov r14d, eax
lea rax, [rbx - 1]
mov r15, rsi
sub r15, rdi
xor r15, rsi
or r15, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor r15, rsi
sar r15, 0x3f
mov rsi, r15
not r15
and r15d, 1
or r15, rsi
mov rsi, rax
and r14d, esi
not rax
and rax, r15
or rax, r14
inc r11
cmp r10, r11
jne 0x1401505cb
cmp rdx, r9
jb 0x140150630
ja 0x14015065c
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x140150632
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x140150628
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14015065f
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
mov rcx, r8
and ecx, eax
not r8
and r8d, 1
or r8d, ecx
mov eax, r8d
jmp 0x140150628