joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401206c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140120721
test r12, r12
je 0x140120838
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ad700
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140120786
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x14012076f
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401af190
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
jmp 0x1401206ee
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x140120864
lea rcx, [r15*8]
call fcn.1401abf00
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x140120803
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140120838
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1401207eb
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.140238a80
mov r12, qword [rsi + 0x10]
jmp 0x1401206ee
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401f6bb0
call fcn.1401e8fd0
int3
Function at 0x140123190
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x70]
mov qword [r9], 0
lea rcx, [0x1402a1758]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140123279
mov rdx, qword [rsp + 0x70]
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.1401e8e60
movzx eax, byte [rdi + 0x17]
test al, al
js 0x1401231f0
and eax, 0x7f
jmp 0x1401231fa
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rax
test rax, rax
js 0x140123285
test rdi, rdi
jne 0x140123217
test rax, rax
jne 0x1401232b1
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14018d560
mov rcx, rsi
mov rdx, rdi
call fcn.14018d730
mov rcx, rdi
call fcn.14018d6b0
cmp byte [rsp + 0x47], 0
jns 0x14012324d
mov rcx, qword [rsp + 0x30]
call fcn.1401abf3c
mov bl, 1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14012325f
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.140239760
mov ebx, eax
jmp 0x14012324f
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.1401f6bb0
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.1401f6bb0
int3
Function at 0x140123390
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1401233b8
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401233f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140123413
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401ad700
mov rcx, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.1401234f0
mov sil, 1
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x140123425
xor esi, esi
jmp 0x1401233f6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401e9050
mov rdi, rax
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140123475
and r8d, 0x7f
jmp 0x14012347c
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14016a4e0
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.140183fd0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1401234ac
and r8d, 0x7f
jmp 0x1401234b6
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1401e9050
cmp byte [rsp + 0x57], 0
jns 0x1401234d2
mov rcx, qword [rsp + 0x40]
call fcn.1401abf3c
lea rcx, [rsp + 0x58]
call fcn.140227540
jmp 0x140123421

Function at 0x1401234f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140123517
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140123545
mov dil, 1
test al, 0x10
je 0x140123557
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ad700
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x1401235c6
xor edi, edi
jmp 0x140123529
mov ecx, 2
call fcn.14018cad0
test al, al
je 0x140123553
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.1400ff950
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401e9050
mov rcx, rax
mov rdx, rsi
call fcn.140228100
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1401e9050
mov rcx, rdi
call fcn.1400fffa0
jmp 0x140123553
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401e9050
mov rcx, rax
mov rdx, rsi
call fcn.140228100
mov rcx, rdi
call fcn.140227540
jmp 0x140123553
Function at 0x140124a60
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1401236b0
mov rax, qword [rsi]
test rax, rax
je 0x140124ad7
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140124ade
lea rcx, [rsp + 0x28]
call fcn.140124130
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140124ab0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140124af6
add rbx, 0x70
cmp rbx, r15
je 0x140124ab0
jmp 0x140124ae5
cmp byte [rbx + 0x27], 0
jns 0x140124b02
mov rcx, qword [rbx + 0x10]
jmp 0x140124b06
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x140124aeb
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x140124b2c
mov rcx, r14
mov rdx, rbx
call fcn.140125980
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140124aeb
mov rcx, rdi
mov rdx, rbx
call fcn.1401257b0
mov r14, rax
jmp 0x140124b26

Function at 0x140124b40
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1401236b0
mov rax, qword [rsi]
test rax, rax
je 0x140124bb7
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140124bbe
lea rcx, [rsp + 0x28]
call fcn.140124130
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140124b90
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x140124bff
cmp byte [rbx + 0x27], 0
js 0x140124bd7
lea rcx, [rbx + 0x10]
jmp 0x140124bdb
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x140124bff
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x140124c0a
mov rcx, r14
mov rdx, rbx
call fcn.140125980
add r14, 0x68
mov qword [rdi + 8], r14
add rbx, 0x70
cmp rbx, r15
je 0x140124b90
jmp 0x140124bc5
mov rcx, rdi
mov rdx, rbx
call fcn.1401257b0
mov r14, rax
jmp 0x140124bfb
Function at 0x140126250
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140305aa8]
mov ecx, dword [0x1402fa5e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401262b0
lea rsi, [0x140305aa0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401ad700
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140305aa8]
call fcn.1401ac060
cmp dword [0x140305aa8], 0xffffffff
jne 0x14012628c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1401af840
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401abf00
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140305af0]
mov ecx, dword [0x1402fa5e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140126370
lea r8, [0x140305ac0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140126470
mov qword [0x140305aa0], rsi
lea rcx, [0x140305aa8]
call fcn.1401ac0f8
jmp 0x14012628c
lea rcx, [0x140305af0]
call fcn.1401ac060
cmp dword [0x140305af0], 0xffffffff
jne 0x140126341
xorps xmm0, xmm0
movups xmmword [0x140305ae0], xmm0
movups xmmword [0x140305ad0], xmm0
movups xmmword [0x140305ac0], xmm0
lea rcx, [0x140305ac0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140305af0]
call fcn.1401ac0f8
jmp 0x140126341

Function at 0x1401263c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140305af0]
mov ecx, dword [0x1402fa5e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401263fb
movzx eax, word [0x140305ac0]
cmp eax, 9
jne 0x140126443
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140305af0]
call fcn.1401ac060
cmp dword [0x140305af0], 0xffffffff
jne 0x1401263e5
xorps xmm0, xmm0
movups xmmword [0x140305ae0], xmm0
movups xmmword [0x140305ad0], xmm0
movups xmmword [0x140305ac0], xmm0
lea rcx, [0x140305ac0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140305af0]
call fcn.1401ac0f8
jmp 0x1401263e5
test eax, eax
je 0x1401263f6
cmp eax, 6
jne 0x140126453
mov eax, 2
jmp 0x1401263f6
cmp eax, 0xc
jne 0x14012645f
mov eax, 3
jmp 0x1401263f6
mov eax, 4
jmp 0x1401263f6
Function at 0x140126c10
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1402a1778]
lea r9, [0x1402c8180]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140126dc5
mov qword [rsp + 0x60], 0
movzx eax, byte [r14 + 0x17]
test al, al
js 0x140126c82
and eax, 0x7f
jmp 0x140126c89
mov rax, qword [r14 + 8]
mov r14, qword [r14]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rax
test rax, rax
js 0x140126dfb
test r14, r14
jne 0x140126caf
test rax, rax
jne 0x140126e27
lea r14, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.1400ef800
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [0x14031b008]
mov ebp, eax
mov rcx, r14
call fcn.1400ef850
test ebp, ebp
js 0x140126db3
test bl, bl
je 0x140126d4b
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140126dbb
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x140126dd1
mov byte [rsi], 0
xor eax, eax
mov byte [rsi + 4], al
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x140126de0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140126d96
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14031b008]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ad700
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsi], 1
jmp 0x140126dc1
mov dword [rsi], 2
mov al, 1
jmp 0x140126d69
mov dword [rsi], 0
mov byte [rsi + 4], 1
jmp 0x140126d76
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14031b008]
jmp 0x140126d64
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14031b008]
jmp 0x140126d76
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.1401f6bb0
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.1401f6bb0
int3
Function at 0x14012bc70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x14012bdc1
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x1402af0f0]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [0x14031b008]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [0x14031b008]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x14031b008]
test r14, r14
je 0x14012bd53
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x14012bd43
lea r14, [rsi + 0xf8]
mov ecx, 1
call fcn.140195f40
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x14012bdc5
call fcn.140090c60
lea rax, [0x14008f760]
test r14, r14
je 0x14012bd92
lea rcx, [0x14008ea00]
mov qword [r14], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14012bda4
bt eax, 9
jae 0x14012bde5
call fcn.140091d50
lea rax, [0x140092220]
test r14, r14
je 0x14012bd92
lea rcx, [0x140091f20]
jmp 0x14012bd8f
call fcn.140240110
lea rax, [0x140240910]
test r14, r14
je 0x14012bd92
lea rcx, [0x14023fff0]
jmp 0x14012bd8f
Function at 0x14012c1a0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14012c295
cmp qword [rsi], 0
jne 0x14012c295
cmp dword [rsi + 0x14], 0
jne 0x14012c295
cmp qword [rsi + 8], 0
jne 0x14012c295
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x14012c214
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14012c27c
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14012c20c
mov qword [rsi], r14
call fcn.14018d230
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x14012c24e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14012c264
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14012c246
mov qword [rsi + 8], r14
call fcn.14018d230
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14018d230
mov rcx, qword [rsi + 8]
call fcn.14017db10
mov qword [rsi + 8], 0
jmp 0x14012c233
call fcn.14018d230
mov rcx, qword [rsi]
call fcn.14017db10
mov qword [rsi], 0
jmp 0x14012c1fa
mov rcx, rsi
call fcn.140241970
mov rax, qword [rsi]
jmp 0x14012c1da

Function at 0x14012fbb0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402fa2c8]
cmp ecx, 0xffffffff
je 0x14012fc8a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14012fc8a
mov eax, dword [0x140307580]
mov ecx, dword [0x1402fa5e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14012fc94
mov rbx, qword [0x140307578]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14012fcda
mov rax, qword [0x140305d60]
inc rax
xor ecx, ecx
lea rdx, [0x140305d70]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14012fce7
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x140307570]
inc ecx
mov dword [0x140307570], ecx
mov dword [rax + 0x14], ecx
mov qword [0x140305d60], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14012fcfc
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14012fd00
jmp 0x14012fbda
lea rcx, [0x140307580]
call fcn.1401ac060
cmp dword [0x140307580], 0xffffffff
jne 0x14012fbff
mov ecx, 8
call fcn.1401abf00
mov rbx, rax
mov rcx, rax
call fcn.14017e680
mov qword [0x140307578], rbx
lea rcx, [0x140307580]
call fcn.1401ac0f8
jmp 0x14012fbff
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14012fc17
inc rcx
cmp rcx, 0x100
jne 0x14012fc2a
jmp 0x14012fc70
int3
Function at 0x14012fd00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1401ad6a0
sub rsp, rax
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1402fa2c8]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14012fdb4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14012fe17
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1401af840
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1401abf7c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1401af190
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401ad700
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140146070
test al, al
je 0x14012fe1a
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14012fdf2
mov eax, 0xffffffff
lock cmpxchg dword [0x1402fa2c8], ecx
je 0x14012fd38
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1402fa2c8]
mov dword [rsp + 0x2c], ecx
jmp 0x14012fd38
lea rcx, [rsp + 0x2c]
call fcn.140146070
test al, al
je 0x14012fe1d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14012fe1d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14012fdcb
int3
int3
int3

Function at 0x14012fe30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402fa2c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14012fe6e
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14012fe67
call fcn.14012fd00
jmp 0x14012fe4e
Function at 0x140134b00
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1402af0f0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x140134c7c
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x140307a40]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1401d15c0
mov rcx, rbx
call fcn.1401cfa44
sub r14, rax
lea rdx, [0x1402b5610]
mov rcx, rbx
mov r8, r14
call fcn.1401d15c0
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1401af840
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140134bdc
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401d1608
test eax, eax
je 0x140134ca0
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140134c17
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401d1608
test eax, eax
je 0x140134ca0
xor eax, eax
mov byte [0x140307631], al
mov dword [rsp + 0x30], 0
lea rcx, [0x1402bb02c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402cc6ce]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140134ca7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14031b008]
test eax, eax
je 0x140134ca7
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x140307c40], al
mov byte [0x140307630], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x140134c19
xor eax, eax
jmp 0x140134c6f