joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045c30
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.14004cee0
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x140045e19
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x14011d938]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x140045e6e
lea rdx, [0x14011d988]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140045e81
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [0x140158008]
mov r12, rax
movsxd r13, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r13, r13
mov qword [rsp + 0x28], rbx
je 0x140045e89
shl r13, 3
movabs rax, 0x5555555555555551
cmp r13, rax
jae 0x140045e69
lea rdi, [r13*2]
add rdi, r13
mov rcx, rdi
call fcn.140087164
mov rsi, rax
mov qword [rsp + 0x30], rax
add rax, rdi
mov qword [rsp + 0x40], rax
xor r14d, r14d
mov rdi, qword [r12 + r14]
mov rcx, rdi
call fcn.1400aad10
mov rbx, rax
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x140045e69
cmp rbx, 0xb
jae 0x140045d81
mov byte [rsi + 0x17], bl
lea r15, [rsi + rbx*2]
mov rcx, rsi
test rbx, rbx
jne 0x140045db7
jmp 0x140045dc5
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.140087164
mov rcx, rax
mov qword [rsi], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbp
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rbx
lea r15, [rcx + rbx*2]
add rbx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.140089f20
mov word [r15], 0
add rsi, 0x18
add r14, 8
cmp r13, r14
jne 0x140045d48
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.1400459b0
movups xmmword [rdi], xmm6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140045e0f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jne 0x140045e3f
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400884b0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp rsi, rdi
je 0x140045e5f
lea rbx, [rsi - 0x18]
cmp byte [rsi - 1], 0
jns 0x140045e57
mov rcx, qword [rsi - 0x18]
call fcn.1400871a0
mov rsi, rbx
cmp rbx, rdi
jne 0x140045e44
mov rcx, rdi
call fcn.1400871a0
jmp 0x140045e19
call fcn.14009bdb0
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140045ce4
xor r12d, r12d
jmp 0x140045ce7
xor esi, esi
jmp 0x140045de1
Function at 0x140048930
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r13, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test r8, r8
je 0x14004897f
cmp byte [r13 + 0x17], 0
js 0x140048b52
xor eax, eax
mov byte [r13], al
mov byte [r13 + 0x17], al
test r12, r12
je 0x140048b66
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.1400a3350
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x80]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x14011b1d0]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadStreamToStringWithMaxSize
lea r8, str....._base_files_file_util.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0xeb
call fcn.14006cbc0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140070820
xorps xmm6, xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov dword [rbx + 0x30], 0
mov rcx, r12
call fcn.140099d20
mov ecx, eax
call fcn.140099d7c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140048b6a
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov edi, 0xffff
cmovg rdi, rax
cmp rdi, r14
cmovae rdi, r14
inc rdi
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm6
mov qword [r15 + 0x10], 0
xor esi, esi
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
call fcn.14006a4e0
cmp byte [rsp + 0x37], 0
mov rcx, r15
jns 0x140048a83
mov rcx, qword [rsp + 0x20]
add rcx, rsi
mov edx, 1
mov r8, rdi
mov r9, r12
call fcn.1400a30d0
test rax, rax
je 0x140048ac3
mov rbx, rax
mov rax, r14
sub rax, rsi
cmp rax, rbx
jb 0x140048b74
add rbx, rsi
mov rcx, r12
call fcn.1400a2650
test eax, eax
je 0x140048b7b
mov rsi, rbx
mov rcx, r12
call fcn.1400a267c
test eax, eax
sete dil
mov r14, rsi
test r13, r13
je 0x140048b0d
movups xmm0, xmmword [r13]
mov rax, qword [r13 + 0x10]
mov rcx, qword [rsp + 0x30]
mov qword [r13 + 0x10], rcx
movaps xmm1, xmmword [rsp + 0x20]
movups xmmword [r13], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, r13
mov rdx, r14
xor r8d, r8d
call fcn.14006a4e0
cmp byte [rsp + 0x37], 0
js 0x140048ba0
lea rcx, [rsp + 0x80]
call fcn.140070880
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400884b0
mov eax, edi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [r13]
mov byte [rax], 0
mov qword [r13 + 8], 0
jmp 0x14004897f
xor edi, edi
jmp 0x140048b25
mov edi, 0xffff
jmp 0x140048a49
xor edi, edi
jmp 0x140048ad4
test rsi, rsi
mov eax, 0x10000
cmove rdi, rax
lea rdx, [rbx + rdi]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.14006a4e0
mov rsi, rbx
jmp 0x140048a74
mov rcx, qword [rsp + 0x20]
call fcn.1400871a0
jmp 0x140048b18
Function at 0x140048cf0
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140048db0
mov eax, dword [rsi]
mov dword [0x140135f58], eax
test al, 1
jne 0x140048d11
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x140146040]
test rcx, rcx
jne 0x140048d2b
mov rcx, qword [0x140146018]
test rcx, rcx
je 0x140048d4f
jmp 0x140048d71
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140146040], 0
mov rcx, qword [0x140146018]
test rcx, rcx
jne 0x140048d71
and byte [0x140135f58], 0xfe
mov ecx, 0x18
call fcn.140087164
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140146018], rax
mov rdx, qword [rsi + 8]
call fcn.1400451d0
cmp dword [rsi + 0x14], 0
jne 0x140048d96
mov rcx, qword [0x140146018]
cmp byte [rcx + 0x17], 0
jns 0x140048d90
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.1400d8110
Function at 0x14004be50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x14011b1d0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1d3
call fcn.14006cbc0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140070820
cmp byte [rdi + 0x17], 0
jns 0x14004bed4
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.140070880
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400884b0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004bf10
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.14008a5d0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
add edi, 0xfffffefc
cmp edi, 0xfffffefd
jb 0x14004bfb3
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.1400aad10
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14006bd20
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.140048590
mov rcx, r14
mov rdx, rsi
call fcn.14006be70
mov rcx, rsi
call fcn.14006bdf0
mov rcx, rbx
call fcn.14006bdf0
cmp edi, 0xfffffefd
setae bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400884b0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14004bfe0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14008a5d0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14004c075
cmp word [rsp + 0x70], 0
je 0x14004c075
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1400aad10
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.14006bd20
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400884b0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14011b1d0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.14006bce0
mov rcx, rdi
call fcn.14004bf10
test al, al
je 0x14004c0b5
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14006bd00
jmp 0x14004c0d4
lea rax, [0x14011dc02]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.14006bd20
lea rcx, [rsp + 0x40]
call fcn.14006bdf0
jmp 0x14004c057
Function at 0x14004d140
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r14d, r9d
mov rdi, r8
mov rbx, rdx
mov r15, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xc0]
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x58], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.140087164
mov rsi, rax
mov rax, qword [0x1401372e0]
and rax, rbx
cmp rax, qword [0x1401372c8]
jne 0x14004d1a5
mov rcx, rbx
call fcn.14006dbd0
mov qword [rsi], rbx
test rdi, rdi
setne byte [rsi + 8]
mov dword [rsi + 0xc], r14d
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14004d630]
xor ecx, ecx
mov rdx, r15
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
test rax, rax
je 0x14004d20d
test rdi, rdi
je 0x14004d258
mov qword [rdi], r14
test r14, r14
setne bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400884b0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14004d226
mov edi, eax
cmp eax, 0x5af
je 0x14004d226
cmp edi, 0xe
jne 0x14004d263
mov rcx, r15
call fcn.1400dfc00
test rsi, rsi
je 0x14004d1e9
mov rcx, qword [rsi]
mov rax, qword [0x1401372e0]
and rax, rcx
cmp rax, qword [0x1401372c8]
jne 0x14004d24e
call fcn.14006dd10
mov rcx, rsi
call fcn.1400871a0
jmp 0x14004d1e9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004d1e9
mov eax, dword [0x140146128]
mov ecx, dword [0x1401434ec]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004d2db
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, edi
call fcn.14004ae10
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
cmovs rcx, qword [rbx + 8]
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, qword [0x140146120]
call fcn.140075380
cmp byte [rbx + 0x17], 0
jns 0x14004d22e
mov rcx, qword [rsp + 0x30]
call fcn.1400871a0
jmp 0x14004d22e
lea rcx, [0x140146128]
call fcn.1400872c0
cmp dword [0x140146128], 0xffffffff
jne 0x14004d284
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140051bb0
mov qword [0x140146120], rax
lea rcx, [0x140146128]
call fcn.140087358
jmp 0x14004d284

Function at 0x14004d9a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004da27
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14004da11
cmp dword [rsp + 0x38], 4
jne 0x14004da11
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400884b0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x14004da11
Function at 0x14004da30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140088450
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14008a5d0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004dae3
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14004dae7
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.1400451d0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400884b0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14004dac4
cmp eax, 2
jne 0x14004db2f
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14008a5d0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14004db36
lea rdx, [rsp + 0x40]
jmp 0x14004daba
mov edi, 0x3f4
jmp 0x14004dac4
mov edi, 0xea
jmp 0x14004dac4

Function at 0x14004db40
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400884b0
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor r8d, r8d
test edx, edx
cmovg r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x14004db40
Function at 0x14004e230
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x14011b0b8]
mov qword [rcx], rax
add rcx, 8
call fcn.140071460
lea rcx, [rsi + 0x10]
call fcn.140071460
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140071460
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
mov qword [rsi + 0xc0], rbx
movups xmmword [rsi + 0xc8], xmm6
movups xmmword [rsi + 0xd8], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x1401203bc]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.1400581c0
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.140052690
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.140052690
lea rcx, [rsi + 0x330]
xor edx, edx
call fcn.140052690
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
mov dword [rsi + 0x360], ebp
movups xmmword [rsi + 0x368], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
mov byte [rsi + 0x398], bl
mov dword [rsi + 0x39c], edi
mov byte [rsi + 0x3a0], bl
movups xmmword [rsi + 0x3a8], xmm6
movups xmmword [rsi + 0x3b8], xmm6
call fcn.140039860
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.14004e460
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14004e44b
call fcn.140057ab0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140057b60
mov qword [0x140146568], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x140158008]
jmp 0x14004e419
Function at 0x14004ffe0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x140050010
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x14005001e
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140049f10
lea rax, [rdx - 1]
test rdx, rax
jne 0x140050034
mov rdi, rdx
jmp 0x14004fff5
jae 0x14005011a
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x140050041
cvtsi2ss xmm0, rax
jmp 0x140050056
mov rcx, rdx
call fcn.140068ba0
mov rdi, rax
jmp 0x14004fff5
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.1400a0c60
cvttss2si rcx, xmm0
mov rdx, rcx
subss xmm0, dword [0x14011b56c]
cvttss2si rax, xmm0
sar rdx, 0x3f
and rax, rdx
or rax, rcx
cmp rbx, 3
jb 0x140050102
mov rcx, rbx
shr rcx, 1
movabs r8, 0x5555555555555555
and r8, rcx
mov rdx, rbx
sub rdx, r8
movabs r8, 0x3333333333333333
mov rcx, rdx
shr rcx, 2
and rdx, r8
and rcx, r8
add rcx, rdx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x140050102
cmp rax, 2
jb 0x14005010a
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x14005010a
mov rcx, rax
call fcn.140068ba0
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x14004fffe
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140050f00
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea r14, [rsp + 0x20]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14008a5d0
mov word [r14], 0
lea rcx, str.PROGRAMFILES
mov rdx, r14
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140050f8d
mov edi, eax
sub rdi, 1
jb 0x140050f8d
cmp word [rsp + rdi*2 + 0x20], 0x5c
je 0x140050f5f
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140050f79
mov rcx, qword [rsi]
lea r8, [rdi + 1]
mov rdx, r14
call fcn.14009f008
test eax, eax
je 0x14005105a
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140050fe5
mov edi, eax
sub rdi, 1
jb 0x140050fe5
cmp word [rsp + rdi*2 + 0x20], 0x5c
je 0x140050fb7
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140050fd1
mov rcx, qword [rsi]
lea r8, [rdi + 1]
mov rdx, r14
call fcn.14009f008
test eax, eax
je 0x140051068
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140051039
mov edi, eax
sub rdi, 1
jb 0x140051039
cmp word [rsp + rdi*2 + 0x20], 0x5c
je 0x14005100f
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140051029
mov rcx, qword [rsi]
lea r8, [rdi + 1]
mov rdx, r14
call fcn.14009f008
test eax, eax
je 0x140051076
xor ebx, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400884b0
mov eax, ebx
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140051084
mov rcx, qword [rsi + 8]
jmp 0x140051089
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400510ab
mov rcx, qword [rsi + 8]
jmp 0x1400510b0
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400510d5
mov rcx, qword [rsi + 8]
jmp 0x1400510da
mov ecx, eax
and ecx, 0x7f
dec rcx
mov bl, 1
cmp rcx, rdi
je 0x14005103b
mov rcx, rsi
test al, al
jns 0x14005109d
mov rcx, qword [rsi]
cmp word [rcx + rdi*2 + 2], 0x5c
jne 0x140050f8d
jmp 0x14005103b
mov ecx, eax
and ecx, 0x7f
dec rcx
mov bl, 1
cmp rcx, rdi
je 0x14005103b
mov rcx, rsi
test al, al
jns 0x1400510c4
mov rcx, qword [rsi]
cmp word [rcx + rdi*2 + 2], 0x5c
jne 0x140050fe5
jmp 0x14005103b
mov ecx, eax
and ecx, 0x7f
dec rcx
mov bl, 1
cmp rcx, rdi
je 0x14005103b
test al, al
jns 0x1400510ef
mov rsi, qword [rsi]
cmp word [rsi + rdi*2 + 2], 0x5c
jne 0x140051039
jmp 0x14005103b
Function at 0x140052300
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140143360]
cmp ecx, 0xffffffff
je 0x140052325
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x140052320

Function at 0x140052330
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x140143360]
cmp ecx, 0xffffffff
je 0x140052400
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140052400
mov eax, dword [0x140147f08]
mov ecx, dword [0x1401434ec]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005240a
mov rbx, qword [0x140147f00]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140052450
mov rax, qword [0x1401466f0]
inc rax
xor ecx, ecx
lea rdx, [0x140146700]
lea edi, [rax + rcx]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rdx + rsi*8], 0
jne 0x14005245d
lea rax, [rdx + rsi*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x1401466f0], rdi
mov qword [r15], rdi
mov eax, dword [rax + 0x10]
mov dword [r15 + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [r15], 0x100
jae 0x140052472
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140052480
jmp 0x14005235e
lea rcx, [0x140147f08]
call fcn.1400872c0
cmp dword [0x140147f08], 0xffffffff
jne 0x140052383
mov ecx, 8
call fcn.140087164
mov rbx, rax
mov rcx, rax
call fcn.140071460
mov qword [0x140147f00], rbx
lea rcx, [0x140147f08]
call fcn.140087358
jmp 0x140052383
mov rcx, rbx
call fcn.140071470
jmp 0x14005239b
inc rcx
cmp rcx, 0x100
jne 0x1400523ae
jmp 0x1400523e2
int3