joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14003b029
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003b0f8
mov dil, 1
test al, 0x10
jne 0x14003b1a4
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14003b1a2
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x48]
mov r8d, 0x227
mov r9d, 2
mov rcx, rdi
call fcn.14001a3f0
lea rcx, [rsp + 0x50]
lea rdx, str.GetFileAttributes
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14003b096
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14003b0cc
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140013130
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140003420
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001a880
jmp 0x14003b1a2
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14003b1a2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x48]
mov r8d, 0x223
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x58]
lea rdx, str.GetFileAttributes
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14003b154
mov rax, qword [rsi]
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14003b18a
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003d610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x70]
cmp eax, edx
jne 0x14003d628
cmp qword [rcx + 0x28], 7
jbe 0x14003d638
mov rcx, qword [rcx + 0x10]
jmp 0x14003d63c
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
add eax, 1
jmp 0x14003d655
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x14003ee60
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x60], rax
test dl, dl
je 0x14003eebb
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x14003eebb
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov dword [rax], 0x18
lea rcx, [0x14006b008]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
jmp 0x14003eebd
xor eax, eax
movzx edx, bl
shl edx, 0x13
or edx, 3
cmp qword [rsi + 0x18], 7
jbe 0x14003eed0
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rax
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov r8d, 6
mov r9d, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140041210
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14003ef20
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x140
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x138], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14003eff3
and eax, 0xfeff
cmp eax, 6
je 0x14003eff3
mov eax, dword [0x1400850f0]
mov ecx, dword [0x140085118]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003f01a
xor edx, edx
mov r8d, 0x10000000
mov rcx, rsi
call qword [0x1400850e8]
mov sil, 1
test eax, eax
jne 0x14003efff
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14003efef
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x21
mov r9d, 2
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x38]
lea rdx, str.InitializeCriticalSectionEx
call fcn.140003420
mov rcx, rsi
call fcn.14001b9f0
xor esi, esi
jmp 0x14003efff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140041210
mov eax, esi
add rsp, 0x140
pop rsi
ret
lea rcx, [0x1400850f0]
call fcn.140041470
mov eax, dword [0x1400850f0]
cmp eax, 0xffffffff
jne 0x14003ef87
lea rcx, str.kernel32.dll
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.14003f250
mov qword [0x1400850e8], rax
lea rcx, [0x1400850f0]
call fcn.140041410
jmp 0x14003ef87
Function at 0x14003f4c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140081338]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0xc]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003f552
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rbp - 0xc]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0xc]
test eax, eax
jne 0x14003f566
mov rcx, rdi
call r15
cmp eax, 3
jne 0x14003f58b
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x14003f524
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14003f56d
cmp eax, 0xffffffff
je 0x14003f590
mov esi, eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
call fcn.140041210
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp - 0xc]
jmp 0x14003f56b
int3

Function at 0x14003fbb0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rdi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14003faf0
test rax, rax
jne 0x14003fc41
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x14003fc41
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14003fc3f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov r8d, 0xf3
mov r9d, 2
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x40]
lea rdx, [0x14006b1d4]
call fcn.140003420
mov rcx, rsi
call fcn.14001b9f0
xor esi, esi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140041210
mov eax, esi
add rsp, 0x148
pop rdi
pop rsi
ret
Function at 0x1400405d0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
jmp 0x1400405e0
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x140040609
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140040642
and eax, 0x410
cmp eax, 0x410
jne 0x140040642
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp 0x140040730
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14004064f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14004070c
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14004070a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x94
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x48]
lea rdx, str.DeleteFile
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400406bc
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400406f2
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x140040759
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x140040816
mov ecx, 2
call fcn.14001a340
test al, al
je 0x140040814
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x2f
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x48]
lea rdx, str.RemoveDirectory
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400407c6
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400407fc
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400405e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
jmp 0x1400405e0
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x140040609
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140040642
and eax, 0x410
cmp eax, 0x410
jne 0x140040642
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp 0x140040730
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14004064f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14004070c
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14004070a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x94
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x48]
lea rdx, str.DeleteFile
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400406bc
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400406f2
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x140040759
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x140040816
mov ecx, 2
call fcn.14001a340
test al, al
je 0x140040814
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x2f
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x48]
lea rdx, str.RemoveDirectory
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400407c6
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400407fc
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x140040730
Capabilities:
Delete directory

Disassembly:
jmp 0x1400405e0
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x140040609
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140040642
and eax, 0x410
cmp eax, 0x410
jne 0x140040642
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp 0x140040730
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14004064f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14004070c
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14004070a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x94
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x48]
lea rdx, str.DeleteFile
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400406bc
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400406f2
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x140040759
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x140040816
mov ecx, 2
call fcn.14001a340
test al, al
je 0x140040814
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x2f
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x48]
lea rdx, str.RemoveDirectory
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400407c6
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400407fc
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x140040ca0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rdx
mov rdi, rcx
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000bcd0
cmp qword [rsp + 0x70], 7
jbe 0x140040ceb
mov rbx, qword [rsp + 0x58]
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x140040d4f
add rax, 1
js 0x140040f08
mov rcx, qword [rsp + 0x58]
add rax, rax
cmp rax, 0x1000
jb 0x140040d4a
test cl, 0x1f
jne 0x140040f08
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140040f08
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x140040f08
call fcn.140041240
test ebp, ebp
je 0x140040e9a
mov r14b, 1
test rsi, rsi
je 0x140040eea
mov ecx, ebp
add rcx, rcx
call fcn.1400418b0
mov rbx, rax
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000bcd0
cmp qword [rsp + 0x70], 7
jbe 0x140040d99
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x140040dfc
add rax, 1
js 0x140040f08
mov rcx, qword [rsp + 0x58]
add rax, rax
cmp rax, 0x1000
jb 0x140040df7
test cl, 0x1f
jne 0x140040f08
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140040f08
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x140040f08
call fcn.140041240
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call fcn.1400478b0
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000bd30
mov rax, qword [rsi + 0x18]
cmp rdi, rsi
je 0x140040e9f
cmp rax, 0x10
jb 0x140040e6d
mov rcx, qword [rsi]
add rax, 1
cmp rax, 0x1000
jb 0x140040e68
test cl, 0x1f
jne 0x140040f08
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140040f08
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x140040f08
call fcn.140041240
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
jmp 0x140040ed9
xor r14d, r14d
jmp 0x140040eea
cmp rax, 0x10
jb 0x140040ed9
mov rcx, qword [rsp + 0x58]
add rax, 1
cmp rax, 0x1000
jb 0x140040ed4
test cl, 0x1f
jne 0x140040f08
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140040f08
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x140040f08
call fcn.140041240
mov qword [rsp + 0x70], 0xf
mov rcx, rbx
call fcn.140042540
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140041210
mov eax, r14d
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400476b0
ud2
Function at 0x140045118
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x1400700f8]
xor ecx, ecx
lea r8, [0x1400700f0]
lea rdx, str.FlsAlloc
call fcn.140044f40
mov rbx, rax
test rax, rax
je 0x140045158
mov rcx, rax
call fcn.1400421c8
mov rcx, rdi
call rbx
jmp 0x14004515e
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400451c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140070108]
mov ecx, 2
lea r8, [0x140070100]
lea rdx, str.FlsGetValue
call fcn.140044f40
mov rdi, rax
test rax, rax
je 0x140045201
mov rcx, rax
call fcn.1400421c8
mov ecx, ebx
call rdi
jmp 0x140045209
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140045214
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140070110]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140070108]
call fcn.140044f40
mov rsi, rax
test rax, rax
je 0x140045260
mov rcx, rax
call fcn.1400421c8
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x14004526b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004dbec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140041b50
sub rsp, rax
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.14004de28
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x14004dc40
mov rax, r14
jmp 0x14004dd5a
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0x865b0]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.140059a94
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0x865b0]
cmp r13, qword [rbx + rcx + 0x30]
je 0x14004dca7
or rax, 0xffffffffffffffff
jmp 0x14004dd5a
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0x865b0]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004dc9e
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.140059a94
test rax, rax
js 0x14004dc9e
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x14004dc9e
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x14004dd4e
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14004dd4e
cmp byte [rcx], 0xd
jne 0x14004dd34
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14004dd43
cmp byte [rcx + 1], 0xa
jne 0x14004dd43
inc rcx
jmp 0x14004dd43
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x817d0]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x14004dd16
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140041210
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret