joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d310
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, section..rdata
mov edx, 0xd
mov r8, rsi
xor r9d, r9d
call fcn.14003d0b0
test al, al
je 0x14003d33b
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140177010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.14003d0b0

Function at 0x14003d360
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x140177020]
mov edx, 0x27
mov r8, rsi
xor r9d, r9d
call fcn.14003d0b0
test al, al
je 0x14003d38b
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140177010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.14003d0b0

Function at 0x14003d3b0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x140177040]
mov edx, 0xe
mov r8, rsi
xor r9d, r9d
call fcn.14003d0b0
test al, al
je 0x14003d3db
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140177010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.14003d0b0

Function at 0x1400401f0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 1
je 0x140040223
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
jne 0x14004022a
mov rbx, qword [rsi + 8]
cmp rdi, rbx
ja 0x140040320
jb 0x140040237
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov edi, 2
jmp 0x14004020c
mov rcx, rdi
call fcn.1400a9ce0
mov rdi, rax
jmp 0x14004020c
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x140040247
cvtsi2ss xmm0, rax
jmp 0x14004025c
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.1400ec70c
cvttss2si rcx, xmm0
mov rdx, rcx
subss xmm0, dword [0x140194028]
cvttss2si rax, xmm0
sar rdx, 0x3f
and rax, rdx
or rax, rcx
cmp rbx, 3
jb 0x140040308
mov rcx, rbx
shr rcx, 1
movabs r8, 0x5555555555555555
and r8, rcx
mov rdx, rbx
sub rdx, r8
movabs r8, 0x3333333333333333
mov rcx, rdx
shr rcx, 2
and rdx, r8
and rcx, r8
add rcx, rdx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x140040308
cmp rax, 2
jb 0x140040310
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x140040310
mov rcx, rax
call fcn.1400a9ce0
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jae 0x14004021b
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14010d990
Function at 0x140041090
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0x101
lea rbx, [rsp + 0x30]
mov r8d, 0x202
mov rcx, rbx
mov dl, 0xaa
call fcn.1400d8590
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x1400410ee
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14004bf60
test edi, edi
setne bl
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.1400d5720
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret

Function at 0x140043d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140043dba
mov dl, byte [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x1401e9010]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r14, [rbp - 0x20]
mov rcx, r9
mov rdx, r14
call fcn.1400aa570
lea rdx, [0x1401d5a08]
mov rcx, r14
call fcn.1400aad80
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140043dfa
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401e9010]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1401a01c0]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, r15
call qword [0x1401e9010]
movzx r9d, byte [r15 + 0x17]
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
mov rax, r9
cmovs rax, r8
test rax, rax
je 0x140043ec1
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x140043ea6
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140043eaa
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x140043e7b
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, r9b
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x140043e56
jmp 0x140043ec1
xor edi, edi
jmp 0x140043e87
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1401e9010]
jmp 0x140043e74
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x140043daa
call fcn.1400d4ef4
jmp 0x140043daa
Function at 0x14004d3c0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1401d6738]
test rdi, rdi
jne 0x14004d463
mov ecx, 0x48
call fcn.1400d4eb8
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.1400d4eb8
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1401d6738], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14004d485
mov rcx, rax
call fcn.1400f53b4
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14004d490
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d5720
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x14004d490
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1400585c0
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x14004d6a8
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x14004d6de
lea rdx, [0x1401aa9ce]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004d6f1
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [0x1401e9010]
mov r12, rax
movsxd rbp, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test rbp, rbp
mov qword [rsp + 0x28], rbx
je 0x14004d6f9
test ebp, ebp
js 0x14004d700
shl rbp, 3
lea rsi, [rbp*2]
add rsi, rbp
mov rcx, rsi
call fcn.1400d4eb8
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, rsi
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov rsi, qword [r12 + r15]
mov rcx, rsi
call fcn.1400f53b4
mov rdi, rax
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14004d6ce
cmp rdi, 0xb
jae 0x14004d5e9
mov byte [rbx + 0x17], dil
test rdi, rdi
je 0x14004d5e4
cmp rdi, 3
jne 0x14004d6d6
movzx eax, word [rsi + 4]
mov word [rbx + 4], ax
mov eax, dword [rsi]
mov dword [rbx], eax
mov r13, rbx
jmp 0x14004d62a
lea r14, [rdi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
call fcn.1400d4eb8
mov r13, rax
mov qword [rbx], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, r14
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov r8, rdi
add r8, rdi
mov rcx, r13
mov rdx, rsi
call fcn.1400d8180
mov word [r13 + rdi*2], 0
add rbx, 0x18
add r15, 8
cmp rbp, r15
jne 0x14004d59d
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call fcn.14004d080
movups xmmword [rsi], xmm6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14004d676
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x14004d6a8
cmp rbx, rsi
je 0x14004d6a0
lea rdi, [rbx - 0x18]
cmp byte [rbx - 1], 0
jns 0x14004d698
mov rcx, qword [rbx - 0x18]
call fcn.1400d4ef4
mov rbx, rdi
cmp rdi, rsi
jne 0x14004d685
mov rcx, rsi
call fcn.1400d4ef4
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d5720
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.1401245a0
mov r13, rbx
jmp 0x14004d619
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14004d544
xor r12d, r12d
jmp 0x14004d547
xor ebx, ebx
jmp 0x14004d648
lea rcx, [rsp + 0x30]
call fcn.14010ac90
int3
Function at 0x14004eaf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx eax, byte [0x1401d6748]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x14004ec97
mov qword [rsp + 0x40], rdx
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdi, qword [rcx + 8]
xor r13d, r13d
lea r12, [0x1401aa940]
movabs rcx, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1401a01c0]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x48]
mov rax, r13
shl rax, 4
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rax + r12]
mov rbp, qword [rax + r12 + 8]
mov byte [rsp + 0x77], bpl
mov r8, rbp
add r8, rbp
mov r15, rsi
mov rcx, rsi
call fcn.1400d8180
mov word [rsp + rbp*2 + 0x60], 0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x14004ebb9
mov rcx, qword [rsp + 0x68]
cmp rdi, rcx
jb 0x14004ecf1
mov r14b, 1
test rcx, rcx
mov rsi, r15
je 0x14004ecfc
mov rdx, rsi
test al, al
jns 0x14004ebdd
mov rdx, qword [rsp + 0x60]
xor ebp, ebp
movzx edi, word [rbx + rbp*2]
cmp di, word [rdx + rbp*2]
jne 0x14004ec2e
inc rbp
cmp rcx, rbp
jne 0x14004ebdf
mov rbp, rcx
test al, al
js 0x14004ed03
test r14b, r14b
jne 0x14004ec38
mov qword [rsp + 0x28], rbp
inc r13
movzx eax, byte [0x1401d6748]
xor rax, 3
cmp r13, rax
mov rdi, qword [rsp + 0x30]
movabs rcx, 0xaaaaaaaaaaaaaaaa
jb 0x14004eb71
jmp 0x14004ec97
xor r14d, r14d
mov rbp, qword [rsp + 0x28]
jmp 0x14004ebf4
test rbp, rbp
je 0x14004ec97
mov rsi, qword [rsp + 0x38]
cmp rbp, qword [rsi + 8]
mov rdi, qword [rsp + 0x40]
je 0x14004ec97
lea rax, [0x1401aa970]
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], 1
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
xor r8d, r8d
call fcn.1400b4df0
mov rdx, qword [rsi + 8]
sub rdx, rbp
jb 0x14004ed15
sub rax, rbp
mov rcx, qword [rdi + 8]
cmp rdx, rax
cmovb rax, rdx
cmp rax, rcx
je 0x14004ecc4
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d5720
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov bl, 1
test rcx, rcx
je 0x14004ec99
mov rax, qword [rdi]
add rbp, rbp
add rbp, qword [rsi]
xor edx, edx
mov rdi, rbp
movzx ebp, word [rbp + rdx*2]
cmp bp, word [rax + rdx*2]
jne 0x14004ec97
inc rdx
cmp rcx, rdx
mov rbp, rdi
jne 0x14004ecd6
jmp 0x14004ec99
xor r14d, r14d
mov rsi, r15
jmp 0x14004ec31
xor ebp, ebp
jmp 0x14004ebf4
mov rcx, qword [rsp + 0x60]
call fcn.1400d4ef4
mov rsi, r15
jmp 0x14004ebfc
int3
Function at 0x14004f9f0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1400b64b0
cmp byte [rdi + 0x17], 0
jns 0x14004fa31
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x14004fa52
mov rcx, qword [rsp + 0x58]
call fcn.1400d4ef4
test edi, edi
je 0x14004faf9
test r14, r14
je 0x14004faf9
mov ecx, edi
add rcx, rcx
call fcn.1400d4f2c
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.1400b64b0
cmp byte [rsi + 0x17], 0
jns 0x14004fa93
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x14004fab3
mov rcx, qword [rsp + 0x58]
call fcn.1400d4ef4
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x14004fb17
mov rcx, rbx
call fcn.1400f53b4
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.1400b6800
cmp byte [r14 + 0x17], 0
js 0x14004fb1a
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
mov rcx, rbx
call fcn.1400d4f34
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400d5720
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
mov rcx, qword [r14]
call fcn.1400d4ef4
jmp 0x14004fadf

Function at 0x14004fd50
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400b8c20
mov qword [rsi], 0
test rax, rax
je 0x14004fda3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004fdd7
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004fd9b
mov qword [rsi], rbx
call fcn.1400b0f40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.1400add70
lea rcx, [rsi + 0x20]
call fcn.1400be280
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400b0f40
mov rcx, qword [rsi]
call fcn.1400b9290
mov qword [rsi], 0
jmp 0x14004fd89
Function at 0x140050670
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test r8, r8
je 0x1400506bb
cmp byte [rsi + 0x17], 0
js 0x140050884
xor eax, eax
mov byte [rsi], al
mov byte [rsi + 0x17], al
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.1400eecc0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x80]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x1401a01c0]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadStreamToStringWithMaxSize
lea r8, str..._.._base_files_file_util.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0xcd
call fcn.1400b0f20
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400b6db0
xorps xmm6, xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov dword [rbx + 0x30], 0
mov rcx, r12
call fcn.1400e4b7c
mov ecx, eax
call fcn.1400e536c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140050897
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov edi, 0xffff
cmovg rdi, rax
cmp rdi, r14
cmova rdi, r14
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm6
mov qword [r15 + 0x10], 0
inc rdi
xor ebx, ebx
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
call fcn.1400abfa0
mov r13d, 0x10000
cmp byte [rsp + 0x37], 0
mov rcx, r15
jns 0x1400507bc
mov rcx, qword [rsp + 0x20]
add rcx, rbx
mov edx, 1
mov r8, rdi
mov r9, r12
call fcn.1400eea40
test rax, rax
je 0x1400507fd
mov rcx, r14
sub rcx, rbx
cmp rcx, rax
jb 0x1400508a1
test rbx, rbx
cmove rdi, r13
add rbx, rax
mov rcx, r12
call fcn.1400ee050
test eax, eax
je 0x1400508a8
mov rcx, r12
call fcn.1400ee07c
test eax, eax
sete dil
mov r14, rbx
test rsi, rsi
je 0x140050843
movups xmm0, xmmword [rsi]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x30]
mov qword [rsi + 0x10], rcx
movaps xmm1, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.1400abfa0
cmp byte [rsp + 0x37], 0
js 0x1400508be
lea rcx, [rsp + 0x80]
call fcn.1400b6e10
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi]
mov byte [rax], 0
mov qword [rsi + 8], 0
jmp 0x1400506bb
mov edi, 0xffff
jmp 0x14005077c
xor edi, edi
jmp 0x14005080e
lea rdx, [rbx + rdi]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.1400abfa0
jmp 0x1400507ad
mov rcx, qword [rsp + 0x20]
call fcn.1400d4ef4
jmp 0x14005084a
Function at 0x140050ce0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.1400acd50
test al, al
je 0x140050d39
call fcn.1400acd40
mov rdi, rax
lea rbx, [0x1401aeb33]
mov rcx, rax
mov rdx, rbx
call fcn.1400acdf0
test al, al
jne 0x140050d68
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1400acdf0
test al, al
jne 0x140050d68
mov eax, dword [rsi]
mov dword [0x1401c9fa8], eax
mov bl, 1
test al, 1
jne 0x140050e29
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400d5720
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp qword [0x1401d6750], 0
jne 0x140050eba
mov rax, qword [0x1401d6758]
mov qword [0x1401d6750], rax
mov ecx, 0x28
call fcn.1400d4eb8
mov r14, rax
lea rcx, str.vmodule
lea r15, [rsp + 0x48]
mov qword [r15], rcx
call fcn.1400f5100
mov qword [r15 + 8], rax
lea r12, [rsp + 0x58]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.1400acf00
lea r15, [rsp + 0x20]
mov qword [r15], rbx
mov rcx, rbx
call fcn.1400f5100
mov qword [r15 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.1400acf00
lea r9, [0x1401d6760]
mov rcx, r14
mov rdx, rbx
mov r8, r12
call fcn.14012f930
mov qword [0x1401d6758], r14
cmp byte [rbx + 0x17], 0
jns 0x140050e0f
mov rcx, qword [rsp + 0x30]
call fcn.1400d4ef4
cmp byte [rsp + 0x6f], 0
jns 0x140050d39
mov rcx, qword [rsp + 0x58]
call fcn.1400d4ef4
jmp 0x140050d39
mov rcx, qword [0x1401d6788]
test rcx, rcx
jne 0x140050e43
mov rcx, qword [0x1401d6768]
test rcx, rcx
je 0x140050e67
jmp 0x140050e89
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401d6788], 0
mov rcx, qword [0x1401d6768]
test rcx, rcx
jne 0x140050e89
and byte [0x1401c9fa8], 0xfe
mov ecx, 0x18
call fcn.1400d4eb8
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1401d6768], rax
mov rdx, qword [rsi + 8]
call fcn.14004bf60
cmp dword [rsi + 0x14], 0
jne 0x140050eae
mov rcx, qword [0x1401d6768]
cmp byte [rcx + 0x17], 0
jns 0x140050ea8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1401267b0
mov ebx, eax
jmp 0x140050d4b
int3
Function at 0x140055290
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401c9fe0]
cmp ecx, 0xffffffff
je 0x1400552b5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400552b0

Function at 0x1400552c0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x1401c9fe0]
cmp ecx, 0xffffffff
je 0x14005539e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14005539e
mov eax, dword [0x1401d8088]
mov ecx, dword [0x1401d17f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400553a8
mov rbx, qword [0x1401d8080]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400553ee
mov rax, qword [0x1401d6878]
inc rax
xor ecx, ecx
lea rdx, [0x1401d6880]
lea edi, [rax + rcx]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rdx + rsi*8], 0
jne 0x1400553fb
lea rax, [rdx + rsi*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x1401d6878], rdi
mov dword [r15], edi
mov eax, dword [rax + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x140055410
cmp eax, 0x100
jge 0x140055413
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140055420
jmp 0x1400552ee
lea rcx, [0x1401d8088]
call fcn.1400d5010
cmp dword [0x1401d8088], 0xffffffff
jne 0x140055313
mov ecx, 8
call fcn.1400d4eb8
mov rbx, rax
mov rcx, rax
call fcn.1400b91d0
mov qword [0x1401d8080], rbx
lea rcx, [0x1401d8088]
call fcn.1400d50a8
jmp 0x140055313
mov rcx, rbx
call fcn.1400b91e0
jmp 0x14005532b
inc rcx
cmp rcx, 0x100
jne 0x14005533e
jmp 0x140055372
int3
int3
Function at 0x140055420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1400d56b0
sub rsp, rax
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1401c9fe0]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400554d4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140055512
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400d8590
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400d4f2c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400d8180
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400d5720
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140065de0
test al, al
je 0x140055515
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140055518
mov eax, 0xffffffff
lock cmpxchg dword [0x1401c9fe0], ecx
je 0x140055458
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401c9fe0]
mov dword [rsp + 0x2c], ecx
jmp 0x140055458
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.140065de0
test al, al
je 0x14005553d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14005553d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x1400554eb
int3

Function at 0x140055630
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401c9fe0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
jne 0x140055655
call fcn.140135e50
jmp 0x140055671
and rax, 0xfffffffffffffffc
je 0x140055671
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140055671
mov rax, qword [rax + rcx]
jmp 0x140055673
xor eax, eax
add rsp, 0x20
pop rsi
ret