joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ec30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140146a10]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x222
call fcn.140003270
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140014670
cmp byte [rdi + 0x17], 0
jns 0x14004eca6
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.14000a640
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14010e4a0
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140054e80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140147c10]
mov qword [rcx], rax
lea rax, [0x140148ed0]
mov qword [rcx + 8], rax
mov eax, dword [0x140179158]
mov ecx, dword [0x14016f824]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140055006
lea rdi, [rsi + 8]
mov ecx, dword [0x14016f428]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140054fff
movsxd rcx, dword [0x140179150]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140179154]
jne 0x140054fff
mov rcx, qword [rax + rcx]
mov rdx, rsi
call fcn.140029640
call fcn.140011da0
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
call fcn.140041940
mov rdi, qword [rsi + 0x10]
add rdi, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140054ff2
mov rcx, rsi
call fcn.14000e780
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x2c]
mov dword [rdx], eax
mov ecx, 0x310
add rcx, qword [rsi + 0x10]
call fcn.1400528a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [rsi + 0x10]
mov ecx, dword [0x14016f428]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140054fa9
movsxd rcx, dword [rdi + 0x2f8]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 0x2fc]
movsxd rdx, dword [rdi + 0x2f8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
test rdi, rdi
je 0x140054fdd
mov rcx, rdi
call fcn.14000e260
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010e4a0
mov rcx, rdi
add rsp, 0x38
pop rdi
pop rsi
jmp fcn.14010b880
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010e4a0
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.1400067c0
jmp 0x140054f3f
xor ecx, ecx
jmp 0x140054f0b
lea rcx, [0x140179158]
call fcn.14010bdd8
cmp dword [0x140179158], 0xffffffff
jne 0x140054ed2
mov eax, 0xffffffff
mov qword [0x140179150], rax
lea rcx, [0x140179150]
xor edx, edx
call fcn.14001c0c0
lea rcx, [0x140179158]
call fcn.14010ba50
jmp 0x140054ed2
Function at 0x140076c18
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14010b888
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400957d0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.14010c934
mov qword [rbx], rax
test rax, rax
je 0x140076c6f
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140078150
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov rsi, qword [rsp + 0xc0]
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
test rsi, rsi
je 0x1400782d7
mov ebp, dword [rsi + 0x2c]
lea rbx, [rbp + 8]
mov rdi, qword [0x14016f440]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call qword [rdi]
test rax, rax
jne 0x1400781c4
cmp byte [0x140173a90], 0
jne 0x1400782e7
test rax, rax
je 0x1400782f7
mov qword [rax], rbp
add rax, 8
je 0x1400782f7
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rdx, qword [rsi + 0x10]
lea rcx, [0x140106ad0]
cmp rdx, rcx
jne 0x1400782cb
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140154fc0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x140154fd0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
lea rdi, [rsp + 0x30]
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call qword [rax + 0x18]
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, r14
call qword [rax + 0x20]
mov rax, qword [rdi]
test r13, r13
je 0x14007825a
mov ecx, dword [rax + 4]
mov dword [r13], ecx
mov r8d, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140110bf0
mov rdi, qword [rsp + 0x38]
mov esi, 1
test rdi, rdi
jne 0x1400782a3
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x1400782de
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
add r8, 8
mov rcx, rdi
xor edx, edx
call fcn.140110bf0
mov rcx, qword [0x14016f440]
mov rdx, rdi
xor r8d, r8d
call qword [rcx + 0x28]
jmp 0x140078279
lea rcx, [rsp + 0x30]
call rdx
jmp 0x14007822b
xor eax, eax
jmp 0x1400781e4
mov rcx, qword [rsp + 0x40]
call qword [rax]
jmp 0x140078283
mov rcx, rbx
call fcn.140020d60
test al, al
jne 0x1400781a7
mov dword [rsp + 0x20], 0xc4
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_digest_digest.c
xor esi, esi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.1400425f0
jmp 0x140078279
Function at 0x14007b620
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14010cee0
cmp rax, rbx
jne 0x14007b6bc
cmp edi, 1
je 0x14007b664
cmp edi, 2
je 0x14007b6bc
mov rcx, qword [rsi + 0x40]
call fcn.14010cf64
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010e4a0
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14007b6e0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14007b715
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14010cee0
xor ebx, ebx
test rsi, rsi
jle 0x14007b73a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x14007b73a
inc rbx
cmp rsi, rbx
jne 0x14007b71c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007b750
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x14007b7ba
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14007b7e0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14010cee0
mov esi, 0xffffffff
cmp rax, 1
je 0x14007b7bd
jmp 0x14007b7c0
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x14007b890
mov ebp, eax
cmp eax, 3
je 0x14007b86f
cmp ebp, 1
ja 0x14007b890
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14010cee0
cmp rax, rsi
jne 0x14007b890
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14007b7f8
jmp 0x14007b7bd
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14010cee0
cmp rax, 1
je 0x14007b7bd
mov esi, 0xffffffff
jmp 0x14007b7c0

Function at 0x14007b8e0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14007b915
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14010cee0
xor ebx, ebx
test rsi, rsi
jle 0x14007b93b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14007b93b
inc rbx
cmp rsi, rbx
jne 0x14007b91c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007b950
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x14007b9ba
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x14007b9e0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14010cee0
mov si, 0xffff
cmp rax, 1
je 0x14007b9bd
jmp 0x14007b9c0
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x14007ba90
mov ebp, eax
cmp eax, 3
je 0x14007ba6f
cmp ebp, 1
ja 0x14007ba90
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14010cee0
cmp rax, rsi
jne 0x14007ba90
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14007b9f8
jmp 0x14007b9bd
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14010cee0
cmp rax, 1
je 0x14007b9bd
mov si, 0xffff
jmp 0x14007b9c0
Function at 0x14008a6c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
call fcn.14007a5d6
mov ebx, eax
test rdi, rdi
jne 0x14008a70f
test bl, bl
je 0x14008a72b
mov rcx, rsi
call fcn.14007a5d6
mov ebx, eax
test bl, bl
je 0x14008a702
or byte [r14], 2
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
jne 0x14008a7f2
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
jmp 0x14008a7f5
xor edi, edi
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
jne 0x14008a745
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r8d, eax
jmp 0x14008a749
movzx r8d, word [rax]
mov rax, qword [r15]
mov rcx, r15
mov dx, 8
call qword [rax + 0x18]
test al, al
je 0x14008a7be
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
jne 0x14008a76f
mov rax, qword [rcx]
call qword [rax + 0x48]
jmp 0x14008a777
add rax, 2
mov qword [rcx + 0x18], rax
mov rcx, rsi
call fcn.14007a5d6
mov ebp, eax
test rdi, rdi
jne 0x14008a795
mov edi, 0
test bpl, bpl
je 0x14008a72d
jmp 0x14008a6f0
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
jne 0x14008a7aa
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
jmp 0x14008a7ad
movzx eax, word [rax]
cmp ax, 0xffff
je 0x14008a786
test bpl, bpl
jne 0x14008a72d
jmp 0x14008a807
mov rcx, rsi
call fcn.14007a5d6
mov ebx, eax
test rdi, rdi
je 0x14008a6fa
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14008a813
movzx eax, word [rax]
cmp ax, 0xffff
sete al
xor bl, al
je 0x14008a6fe
jmp 0x14008a702
movzx eax, word [rax]
cmp ax, 0xffff
je 0x14008a6ec
test bl, bl
jne 0x14008a72d
mov rcx, rsi
call fcn.14007a5d6
mov ebx, eax
jmp 0x14008a7d1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
jmp 0x14008a7de
Function at 0x140099b00
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x140146a10]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str..._.._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x1af
call fcn.140003270
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.140014670
movzx eax, byte [rsi + 0x17]
mov rcx, rax
test al, al
jns 0x140099b7f
mov rcx, qword [rsi + 8]
cmp rcx, 0x103
ja 0x140099ba6
test al, al
jns 0x140099b8f
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bpl
lea rcx, [rsp + 0x40]
call fcn.14000a640
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14010e4a0
mov eax, ebp
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140099cf0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov esi, ecx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rsp + 0x28], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140099d7b
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x28]
cmp rax, rcx
ja 0x140099d25
xor edx, edx
div rbx
add esi, edx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x14009a010
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov edi, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [0x140146a10]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x57
call fcn.140003270
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140014670
test edi, edi
js 0x14009a145
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rcx, qword [0x140173ab0]
test rcx, rcx
jne 0x14009a11f
lea r9, [rsp + 0x3c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rsi]
mov qword [rsp + 0x20], 0
mov rdx, r15
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009a14c
mov edi, dword [rsp + 0x3c]
cmp qword [rsp + 0x40], 0
jne 0x14009a15f
test byte [0x14016e010], 0x19
jne 0x14009a184
lea rcx, [rsp + 0x60]
call fcn.14000a6b0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14010e4a0
mov eax, edi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x14009a0b3
mov r9d, edi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.140096e50
jmp 0x14009a0b3
mov edi, 0xffffffff
jmp 0x14009a0e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
cmp eax, 0x26
setne dil
neg edi
jmp 0x14009a0df
mov rcx, qword [0x140173ab0]
test rcx, rcx
je 0x14009a0e7
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x14009a0e7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 0
lea rdx, [0x14016e010]
lea r8, [0x140151267]
mov cl, 0x45
xor r9d, r9d
call fcn.140099f00
jmp 0x14009a0f4
Function at 0x14009a1c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov edi, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [0x140146a10]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x88
call fcn.140003270
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140014670
test edi, edi
js 0x14009a2f4
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rcx, qword [0x140173ab0]
test rcx, rcx
jne 0x14009a2ce
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0xaaaaaaaa
mov rcx, qword [rsi]
mov qword [rsp + 0x20], 0
mov rdx, r15
mov r8d, edi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rbx]
cmp qword [rsp + 0x40], 0
jne 0x14009a2fb
test byte [0x14016e010], 0x19
jne 0x14009a319
lea rcx, [rsp + 0x60]
call fcn.14000a6b0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x14009a263
mov r9d, edi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.140096e50
jmp 0x14009a263
mov esi, 0xffffffff
jmp 0x14009a29a
mov rcx, qword [0x140173ab0]
test rcx, rcx
je 0x14009a29a
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x14009a29a
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 0
lea rdx, [0x14016e010]
lea r8, [0x140151267]
mov cl, 0x45
xor r9d, r9d
call fcn.140099f00
jmp 0x14009a2a3
Function at 0x14009a350
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rdi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x140146a10]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r9d, 0x9c
call fcn.140003270
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
call fcn.140014670
mov qword [rsi + 8], r14
mov qword [rsi], 0
mov rcx, qword [0x140173ab0]
test rcx, rcx
jne 0x14009a43f
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, qword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, eax
mov rbx, qword [rbx]
cmp qword [rsp + 0x40], 0
jne 0x14009a465
test byte [0x14016e010], 0x19
jne 0x14009a486
xor esi, esi
cmp edi, 1
sbb rsi, rsi
or rsi, rbx
lea rcx, [rsp + 0x60]
call fcn.14000a6b0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14010e4a0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x14009a3e0
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x40]
mov r8, rdi
xor r9d, r9d
call fcn.140096e50
jmp 0x14009a3e0
mov rcx, qword [0x140173ab0]
test rcx, rcx
je 0x14009a401
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x14009a401
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0
lea rdx, [0x14016e010]
lea r8, [0x140151267]
mov cl, 0x45
xor r9d, r9d
call fcn.140099f00
jmp 0x14009a40a

Function at 0x14009f340
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14016f428]
cmp ecx, 0xffffffff
je 0x14009f365
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14009f360
Function at 0x1400a2ad0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
test esi, esi
je 0x1400a2bcf
mov rdi, rdx
mov rbx, rsi
shr rbx, 0x20
mov ecx, dword [0x14016f428]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a2b8d
movsxd rcx, dword [0x140173e68]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140173e6c]
jne 0x1400a2b8d
cmp qword [rax + rcx], 0
je 0x1400a2b8d
mov ecx, dword [0x14016f428]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a2c0e
movsxd rcx, dword [0x140173e68]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140173e6c]
jne 0x1400a2c0e
mov rcx, qword [rax + rcx]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400a2b8d
cmp dword [rax + 0x2610], esi
jne 0x1400a2b8d
mov edx, ebx
and edx, 0x3ffffff
cmp rdx, qword [rcx + 0x20]
jne 0x1400a2b8d
mov rcx, rsi
shr rcx, 0x3a
imul rcx, rcx, 0x98
add rax, rcx
add rax, 0x10
jne 0x1400a2bd1
test rdi, rdi
je 0x1400a2b98
cmp byte [rdi + 8], 0
je 0x1400a2bf8
mov rax, qword [0x140173ea8]
test rax, rax
je 0x1400a2bdb
and ebx, 0x3ffffff
cmp rbx, qword [0x140173eb0]
jne 0x1400a2bdb
cmp dword [rax + 0x2610], esi
jne 0x1400a2bcf
shr rsi, 0x3a
imul rcx, rsi, 0x98
add rax, rcx
add rax, 0x10
jmp 0x1400a2bd1
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140173b90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax
mov r14, qword [rdi]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400a2c15
mov byte [rdi + 8], 1
jmp 0x1400a2b98
xor ecx, ecx
jmp 0x1400a2b57
mov rcx, r14
call fcn.1400067c0
jmp 0x1400a2c08