joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d4200
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
shr r14, 3
sub rbx, rdx
je 0x1400d42ee
movabs rax, 0x7ffffffffffffff8
cmp rbx, rax
ja 0x1400d43e6
mov rdi, rdx
movzx eax, byte [0x140188180]
xor ecx, ecx
mov rdx, rbx
call fcn.1400f2120
test rax, rax
je 0x1400d43e6
cmp rbx, 0xa0
jae 0x1400d430a
xor edx, edx
mov rcx, rdx
or rcx, 1
test bl, 8
je 0x1400d4290
mov r8d, dword [rdi + rdx*8]
mov r9d, dword [rdi + rdx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rdx*8], r10d
mov dword [rax + rdx*8 + 4], r9d
mov rdx, rcx
cmp r14, rcx
je 0x1400d42f5
nop word cs:[rax + rax]
mov ecx, dword [rdi + rdx*8]
mov r8d, dword [rdi + rdx*8 + 4]
cmp ecx, r8d
mov r9d, r8d
cmovb r9d, ecx
cmova r8d, ecx
mov dword [rax + rdx*8], r9d
mov dword [rax + rdx*8 + 4], r8d
mov ecx, dword [rdi + rdx*8 + 8]
mov r8d, dword [rdi + rdx*8 + 0xc]
cmp ecx, r8d
mov r9d, r8d
cmovb r9d, ecx
cmova r8d, ecx
mov dword [rax + rdx*8 + 8], r9d
mov dword [rax + rdx*8 + 0xc], r8d
add rdx, 2
cmp r14, rdx
jne 0x1400d42a0
mov rcx, rdx
jmp 0x1400d42f5
xor ecx, ecx
mov eax, 4
mov qword [rsi], r14
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rax + r14*8]
add rcx, 0xfffffffffffffff8
xor edx, edx
cmp rcx, rax
jb 0x1400d4261
lea rcx, [rax + 4]
lea r8, [rax + r14*8]
add r8, 0xfffffffffffffffc
cmp r8, rcx
jb 0x1400d4261
movabs rcx, 0x1ffffffffffffffe
lea r8, [r14 - 1]
lea r9, [rcx + 1]
cmp r8, r9
ja 0x1400d4261
mov rdx, rbx
and rdx, 0xfffffffffffffff8
lea r8, [rdi + rdx]
cmp rax, r8
jae 0x1400d436c
mov r8, rax
add r8, rdx
cmp r8, rdi
ja 0x1400d425f
and rcx, r14
xor edx, edx
movdqa xmm0, xmmword [0x14011b850]
nop dword [rax]
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400d4380
mov rdx, rcx
cmp r14, rcx
je 0x1400d42f5
jmp 0x1400d4261
ud2
Function at 0x1400e6130
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x140188180]
mov edx, 0x10
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x1400e61f8
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400e6200]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x1400e61eb
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400e61c6
cmp qword [rbx + 0x10], 0x11
jb 0x1400e61b5
mov rdi, qword [rdi - 8]
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x1400e6730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140117098]
test ecx, ecx
je 0x1400e6760
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400e6779
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400e6779
add rdi, 0x10
jmp 0x1400e6835
lea rcx, [0x140117080]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400e674d
mov ecx, dword [0x140117098]
test ecx, ecx
je 0x1400e6816
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400e6833
mov rsi, rax
test rax, rax
jne 0x1400e67e5
movzx eax, byte [0x140188180]
mov edx, 0x18
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x1400e684f
mov rsi, rax
lea rax, [0x140117080]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140117098]
test ecx, ecx
je 0x1400e683f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400e6835
test rcx, rcx
je 0x1400e6835
lock dec qword [rcx]
jne 0x1400e6835
call fcn.1400f4120
jmp 0x1400e6835
lea rcx, [0x140117080]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400e6798
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140117080]
call fcn.1400f37b0
mov ecx, eax
jmp 0x1400e67dd
ud2
Function at 0x1400e6860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1401170e0]
test ecx, ecx
je 0x1400e6890
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400e68a9
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400e68a9
add rdi, 0x10
jmp 0x1400e6965
lea rcx, [0x1401170c8]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400e687d
mov ecx, dword [0x1401170e0]
test ecx, ecx
je 0x1400e6946
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400e6963
mov rsi, rax
test rax, rax
jne 0x1400e6915
movzx eax, byte [0x140188180]
mov edx, 0x18
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x1400e697f
mov rsi, rax
lea rax, [0x1401170c8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1401170e0]
test ecx, ecx
je 0x1400e696f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x1400e6965
test rcx, rcx
je 0x1400e6965
lock dec qword [rcx]
jne 0x1400e6965
call fcn.1400484a0
jmp 0x1400e6965
lea rcx, [0x1401170c8]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400e68c8
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401170c8]
call fcn.1400f37b0
mov ecx, eax
jmp 0x1400e690d
ud2
Function at 0x1400e9d90
Capabilities:
Create process on windows
Encode data using base64
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x608
movdqa xmmword [rsp + 0x5f0], xmm6
mov rbp, rcx
mov dword [rsp + 0x1e0], 0
movzx eax, byte [rdx + 0xa0]
test al, al
sete cl
mov qword [rsp + 0xd8], rdx
mov r8, qword [rdx + 0x98]
test r8, r8
sete dl
and dl, cl
mov byte [rsp + 0x198], dl
mov qword [rsp + 0x70], rbp
je 0x1400e9df2
xor esi, esi
jmp 0x1400eab68
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x180], 0
test al, al
je 0x1400e9e2b
mov rax, qword [rsp + 0xd8]
mov rax, qword [rax + 0x88]
test rax, rax
jne 0x1400ea035
jmp 0x1400ea9f4
mov qword [rsp + 0x68], r8
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x1400ed8e2
mov rsi, rax
cmp word [rax], 0
je 0x1400ea010
lea rbx, [rsp + 0x210]
lea r15, [rsp + 0xe0]
lea r12, [rsp + 0xa0]
mov rdi, rsi
jmp 0x1400e9e7e
cmp word [rbp], 0
mov rdi, rbp
je 0x1400ea010
mov rcx, 0xfffffffffffffffe
xor edx, edx
nop word [rax + rax]
mov r14, rdx
mov rax, rcx
inc rdx
add rcx, 2
cmp word [rdi + r14*2], 0
jne 0x1400e9e90
lea rbp, [rdi + rdx*2]
cmp r14, 1
je 0x1400e9e70
test r14, r14
je 0x1400ed888
xor r13d, r13d
nop dword [rax + rax]
cmp word [rdi + r13*2 + 2], 0x3d
je 0x1400e9ee0
inc r13
add rax, 0xfffffffffffffffe
jne 0x1400e9ec0
jmp 0x1400e9e70
cmp r13, r14
jae 0x1400ed888
lea r8, [r13 + 1]
mov rcx, r15
mov rdx, rdi
call fcn.1400f43d0
add r13, 2
sub r14, r13
jb 0x1400ed888
lea rdx, [rdi + r13*2]
mov rcx, rbx
mov r8, r14
call fcn.1400f43d0
movups xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x200], xmm1
movaps xmmword [rsp + 0x1f0], xmm0
mov rdi, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
movdqa xmm6, xmmword [rsp + 0x200]
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbx + 0x10]
movdqa xmmword [rsp + 0xa0], xmm0
movdqa xmmword [rsp + 0xb0], xmm1
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x1400ea010
movq rax, xmm6
add rax, r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], rax
mov word [rsp + 0xf0], 0
lea rcx, [rsp + 0x210]
mov rdx, r15
call fcn.1400f1b10
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x1f8], r14
movdqu xmmword [rsp + 0x200], xmm6
mov rcx, r15
lea rdx, [rsp + 0x170]
lea r8, [rsp + 0x1f0]
mov r9, r12
call fcn.1400ef3e0
mov rax, qword [rsp + 0xe0]
shl rax, 1
test rax, rax
je 0x1400e9e70
mov r8, qword [rsp + 0xe8]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e9e70
mov rcx, rsi
call sub.KERNEL32.dll_FreeEnvironmentStringsW
mov r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0xd8]
mov rax, qword [rax + 0x88]
test rax, rax
je 0x1400ea9f4
test r8, r8
je 0x1400ea9f4
mov rcx, qword [rsp + 0xd8]
mov r9, qword [rcx + 0x90]
xor ebp, ebp
jmp 0x1400ea080
Function at 0x1400f0410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.1400f0e80
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
cmp rcx, r14
je 0x1400f0473
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.1400ee1d0
mov rbx, qword [rsp + 0x28]
cmp rbx, r14
jne 0x1400f04dc
mov rax, qword [rsp + 0x30]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400f04cd
test rcx, rcx
je 0x1400f04cd
lea rdi, [rax - 1]
mov rbx, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, rbx
call qword [r15]
cmp qword [r15 + 8], 0
je 0x1400f04bc
cmp qword [r15 + 0x10], 0x11
jb 0x1400f04ab
mov rbx, qword [rbx - 8]
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov qword [rsi], r14
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1400f0500
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x1400f04d0
mov qword [rsi], r14
test rbx, rbx
je 0x1400f04d0
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree

Function at 0x1400f1de0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1401170b8]
test ecx, ecx
je 0x1400f1e7d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400f1e09
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1400f1e77
mov ecx, dword [0x1401170b8]
test ecx, ecx
je 0x1400f1e9f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400f1ebc
mov rsi, rax
test rax, rax
jne 0x1400f1e71
movzx eax, byte [0x140188180]
mov edx, 0x10
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x1400f1ed7
mov rsi, rax
lea rax, [0x1401170a0]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x1401170b8]
test ecx, ecx
je 0x1400f1ec7
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1400f1ebe
lea rcx, [0x1401170a0]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400f1e00
jmp 0x1400f1e09
lea rcx, [0x1401170a0]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400f1e28
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401170a0]
call fcn.1400f37b0
mov ecx, eax
jmp 0x1400f1e69
ud2
Function at 0x1400f3140
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1400f316e
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400e6720
ud2

Function at 0x1400f3180
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x140117110]
test ecx, ecx
je 0x1400f31b3
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400f31cc
mov rcx, rax
cmp qword [rax + 8], 0
je 0x1400f31cc
add rcx, 0x10
jmp 0x1400f32c3
lea rcx, [0x1401170f8]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400f31a0
mov ecx, dword [0x140117110]
test ecx, ecx
je 0x1400f32a4
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400f32c1
mov rdi, rax
test rax, rax
jne 0x1400f323c
movzx eax, byte [0x140188180]
mov edx, 0x20
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x1400f32e0
mov rdi, rax
lea rax, [0x1401170f8]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x140117110]
test ecx, ecx
je 0x1400f32cd
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x1400f3259
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x1400f328e
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1400f3289
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400f328e
call fcn.1400f3140
mov qword [rdi + 8], 1
lea rcx, [rdi + 0x10]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rdx
jmp 0x1400f32c3
lea rcx, [0x1401170f8]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400f31eb
xor ecx, ecx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x1401170f8]
call fcn.1400f37b0
mov ecx, eax
jmp 0x1400f3234
ud2
Function at 0x1400f37b0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x1400f3835
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x1400f386c
cmp dword [rsp + 0x2c], 0
je 0x1400f385d
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400f386e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x140188158]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x140188158], rsi
jne 0x1400f3810
mov byte [0x140188150], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x1400f3862
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400f386c
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x1400f3862
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x1400f3862
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2
Function at 0x140100a80
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x140100bee
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd rbp, dword [rsp + 0x24]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
test rbp, rbp
je 0x140100bc4
shl rbp, 3
mov r15d, 8
xor esi, esi
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x80]
xor r12d, r12d
jmp 0x140100b32
lea rax, [r12 + r12*2]
mov rcx, qword [rsp + 0x70]
mov qword [r15 + rax*8 + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [r15 + rax*8], xmm0
mov r12, qword [rsp + 0x38]
inc r12
mov qword [rsp + 0x38], r12
add rsi, 8
cmp rbp, rsi
je 0x140100bc4
mov r13, qword [rdi + rsi]
mov rcx, r13
call sub.msvcrt.dll_wcslen
lea rax, [rax*2]
add rax, r13
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], rax
mov word [rsp + 0x90], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.1401081d0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r12, qword [rsp + 0x28]
jne 0x140100b00
lea rcx, [rsp + 0x28]
mov rdx, r12
call fcn.1400d4760
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
jmp 0x140100b00
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
test rax, rax
jne 0x140100bd6
call sub.KERNEL32.dll_GetLastError
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
jmp 0x140100c05
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140104670
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x18]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea r14, [rdi + 0x10]
jmp 0x1401046be
tzcnt ecx, eax
shl rcx, 5
mov rdx, rdi
sub rdx, rcx
lea ebp, [rax - 1]
and ebp, eax
mov rcx, qword [rdx - 8]
call sub.pdh.dll_PdhRemoveCounter
mov eax, ebp
sub rbx, 1
jb 0x1401046ef
test ax, ax
jne 0x1401046a0
nop dword [rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rdi, 0xfffffffffffffe00
add r14, 0x10
cmp eax, 0xffff
je 0x1401046d0
not eax
jmp 0x1401046a0
mov rcx, qword [rsi + 0x38]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140104706
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x14010471f
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x140104732
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140104714
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp 0x140114e88
jmp qword [sym.imp.pdh.dll_PdhCloseQuery]
Function at 0x1401060a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140117038]
test ecx, ecx
je 0x1401060dc
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1401060f5
cmp qword [rax + 8], 0
je 0x1401060f5
add rax, 0x10
jmp 0x14010619d
lea rcx, [0x140117020]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1401060cc
mov ecx, dword [0x140117038]
test ecx, ecx
je 0x140106119
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140106131
mov r14, rax
cmp rax, 1
jne 0x14010617a
jmp 0x1401062b6
lea rcx, [0x140117020]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x14010610b
movzx eax, byte [0x140188180]
mov edx, 0x28
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x1401062b6
mov r14, rax
lea rax, [0x140117020]
mov qword [r14], rax
mov qword [r14 + 8], 0
mov ecx, dword [0x140117038]
test ecx, ecx
je 0x1401062a0
dec ecx
mov rdx, r14
call sub.KERNEL32.dll_TlsSetValue
mov qword [r14 + 8], 1
lea rax, [r14 + 0x10]
mov qword [r14 + 0x10], 0
mov word [r14 + 0x18], 0
mov qword [r14 + 0x20], 0
mov rcx, qword [rbx + 0x50]
mov qword [rsp + 0x98], rcx
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rsp + 0x88], xmm0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx + 0x20]
movups xmm3, xmmword [rbx + 0x30]
movups xmmword [rsp + 0x78], xmm3
movups xmmword [rsp + 0x68], xmm2
movups xmmword [rsp + 0x58], xmm1
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], 0
lea rdx, [0x1401069c0]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140047620
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
movzx eax, byte [rdi + 8]
test al, al
jne 0x1401062b6
cmp byte [rdi + 9], 0
jne 0x140106242
lea rbx, [rdi + 0x10]
mov rcx, rbx
mov rdx, rdi
mov r8d, 0xffffffff
xor r9d, r9d
call sub.KERNEL32.dll_SleepConditionVariableSRW
movzx eax, byte [rdi + 8]
test al, al
jne 0x1401062b6
cmp byte [rdi + 9], 0
je 0x140106220
mov byte [rdi + 9], 0
mov rcx, rdi
call fcn.140114c68
mov rax, qword [rsp + 0xa0]
cmp rax, 1
jne 0x1401062b3
movups xmm0, xmmword [rsp + 0xa8]
movups xmm1, xmmword [rsp + 0xb8]
movups xmm2, xmmword [rsp + 0xc8]
movaps xmmword [rsp + 0x30], xmm2
movaps xmmword [rsp + 0x20], xmm1
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm1
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140117020]
call fcn.1400f37b0
mov ecx, eax
jmp 0x140106172
test rax, rax
ud2
Function at 0x140107c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x140117160]
test ecx, ecx
je 0x140107c90
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140107ca9
cmp qword [rax + 8], 0
je 0x140107ca9
add rax, 0x10
jmp 0x140107d62
lea rcx, [0x140117148]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140107c80
mov ecx, dword [0x140117160]
test ecx, ecx
je 0x140107d43
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140107d60
mov rdi, rax
test rax, rax
jne 0x140107d15
movzx eax, byte [0x140188180]
mov edx, 0x18
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140107d79
mov rdi, rax
lea rax, [0x140117148]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x140117160]
test ecx, ecx
je 0x140107d69
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x140107d2f
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x140107d31
mov rcx, qword [rsi + 8]
jmp 0x140107d31
xor ecx, ecx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rcx
jmp 0x140107d62
lea rcx, [0x140117148]
call fcn.1400f37b0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140107cc8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140117148]
call fcn.1400f37b0
mov ecx, eax
jmp 0x140107d0d
ud2