joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001310
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
lea rcx, [0x140002030]
mov byte [rsp + 0x490], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessHeap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.HeapFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.HeapAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetFileInformationByHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateFileW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400020a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x498], rax
call r12
mov edi, 8
mov rcx, rax
mov edx, edi
lea r8d, [rdi + 0x16]
call rbx
mov rsi, rax
lea rcx, [rsp + 0x40]
xorps xmm0, xmm0
nop dword [rax]
nop word [rax + rax]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm0
sub rdi, 1
jne 0x140001440
movups xmmword [rcx], xmm0
mov byte [rsp + 0x490], 1
lea rdx, [rsp + 0x40]
mov dword [rsi + 0x10], 6
mov r8d, 0x208
mov rax, qword [0x1400021f8]
xor ecx, ecx
mov dword [rsi + 0x14], eax
movzx eax, word [0x1400021fc]
mov word [rsi + 0x18], ax
call qword [rsp + 0x498]
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], edi
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x110000
call r14
lea r9d, [rdi + 0x1e]
mov r8, rsi
lea edx, [rdi + 3]
mov rcx, rax
mov rbx, rax
call rbp
mov rcx, rbx
call r15
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], edi
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x110000
call r14
lea r9d, [rdi + 1]
mov rcx, rax
lea r8, [rsp + 0x490]
mov rbx, rax
lea edx, [rdi + 4]
call rbp
mov rcx, rbx
call r15
call r12
mov rcx, rax
mov r8, rsi
xor edx, edx
call r13
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027e30
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b8b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b8b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f80
cmp rax, 0xffffffffffffffff
je 0x140027f80
xor edi, edi
test rbp, rbp
jle 0x140027f2b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001deb8
mov rbx, rax
test rax, rax
jne 0x140027eb8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027f21
mov edx, 0x8000
mov ecx, r14d
call fcn.140015968
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c590
cmp eax, 0xffffffff
je 0x140027f01
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027ec8
mov edx, r15d
mov ecx, r14d
call fcn.140015968
jmp 0x140027f21
cmp byte [rsi + 0x38], dil
je 0x140027f18
cmp dword [rsi + 0x34], 5
jne 0x140027f18
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027f21
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019f78
jmp 0x140027f94
jns 0x140027f94
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b8b4
cmp rax, 0xffffffffffffffff
jne 0x140027f4c
cmp byte [rsi + 0x30], dil
je 0x140027f94
mov edi, dword [rsi + 0x2c]
jmp 0x140027f94
mov ecx, r14d
call fcn.14001705c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f94
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f8d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f92
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b8b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001640
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
xor r8d, r8d
lea rdx, [0x1400011c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140007134
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006f60
Function at 0x1822a9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1822a91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1822a9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1822a906f
add dl, dl
jne 0x1822a9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1822a90f6
xor eax, eax
add dl, dl
jne 0x1822a90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1822a91ad
add dl, dl
jne 0x1822a90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1822a90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1822a90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1822a90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1822a90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1822a907e
mov eax, 1
add dl, dl
jne 0x1822a9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1822a9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1822a90fb
sub eax, ebx
mov ebx, 1
jne 0x1822a914c
mov ecx, 1
add dl, dl
jne 0x1822a912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1822a913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1822a9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1822a907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1822a9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1822a9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1822a915d
cmp eax, 0x7d00
jae 0x1822a919b
cmp eax, 0x500
jb 0x1822a9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1822a907e
cmp eax, 0x7f
ja 0x1822a919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1822a907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1822a91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1822a907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140626058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406261df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140626089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14062606f
add dl, dl
jne 0x140626096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406260f6
xor eax, eax
add dl, dl
jne 0x1406260a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406261ad
add dl, dl
jne 0x1406260b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406260c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406260d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406260dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406260ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14062607e
mov eax, 1
add dl, dl
jne 0x140626106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140626113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406260fb
sub eax, ebx
mov ebx, 1
jne 0x14062614c
mov ecx, 1
add dl, dl
jne 0x14062612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14062613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140626123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140626168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140626175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14062615d
cmp eax, 0x7d00
jae 0x14062619b
cmp eax, 0x500
jb 0x140626196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062607e
cmp eax, 0x7f
ja 0x14062619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406261d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14062607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400016f0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov edx, 0x5b0
mov ecx, 1
call fcn.14008f864
mov rbx, rax
test rax, rax
je 0x140001738
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
jne 0x14000174a
mov rcx, rbx
call fcn.14008f86c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rax, [fcn.14000a720]
mov qword [rbx + 0x10], rdi
mov dword [rbx + 8], 1
mov dword [rbx + 0x40], esi
mov dword [rbx + 0x2c], 0
test rax, rax
je 0x1400017bc
lea rcx, [rdi + 0x20]
mov dword [rbx + 0x58], 1
test rcx, rcx
je 0x140001787
mov rcx, qword [rcx]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbx + 0x30]
add rdx, 0x10
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rcx
mov qword [rdx + 8], rcx
mov rcx, qword [rbx + 0x10]
add rcx, 0x20
je 0x1400017bc
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001ea0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
movzx r8d, byte [rcx + 0x18]
lea r9, str.open__d._d
movzx eax, byte [rcx + 0x28]
mov r14, rdx
mov rsi, qword [rcx + 0x10]
mov rdi, rcx
mov dword [rsp + 0x28], eax
mov edx, 4
mov dword [rsp + 0x20], r8d
xor ecx, ecx
lea r8, str.libusb_open
call fcn.140003000
cmp dword [rdi + 0x58], 0
jne 0x140001f02
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov ecx, 0x2b8
mov qword [rsp + 0x50], rbx
call fcn.1400839b0
mov rbx, rax
test rax, rax
jne 0x140001f21
lea eax, [rbx - 0xb]
jmp 0x140002027
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
jne 0x140001f48
mov rcx, rbx
call fcn.14008f86c
mov eax, 0xffffff9d
jmp 0x140002027
mov rcx, qword [rdi]
or edx, 0xffffffff
mov qword [rsp + 0x58], rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc dword [rdi + 8]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov qword [rbx + 0x20], rdi
lea rcx, [rbx + 0x2c]
mov dword [rbx + 0x28], eax
xor edx, edx
mov dword [rbx + 8], eax
mov r8d, 0x288
call fcn.140081f50
mov rcx, rbx
call fcn.14000b730
mov ebp, eax
test eax, eax
jns 0x140001fdc
movzx ecx, byte [rdi + 0x28]
lea r8, str.libusb_open
movzx r9d, byte [rdi + 0x18]
mov edx, 4
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], r9d
lea r9, str.open__d._d_returns__d
call fcn.140003000
mov rcx, rdi
call fcn.140001d90
mov rcx, rbx
call fcn.1400060c0
mov rcx, rbx
call fcn.14008f86c
mov eax, ebp
jmp 0x140002022
lea rdi, [rsi + 0x38]
test rdi, rdi
je 0x140001ff1
mov rcx, qword [rdi]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsi + 0x30]
lea r8, [rsi + 0x28]
mov qword [rbx + 0x18], rax
lea rdx, [rbx + 0x10]
mov qword [rdx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdx
mov qword [r8 + 8], rdx
test rdi, rdi
je 0x14000201d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [r14], rbx
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400044f0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea r14, [rcx + 0x68]
mov rbx, rcx
test r14, r14
je 0x140004528
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [r14], rax
lea rsi, [rbx + 0x88]
test rsi, rsi
je 0x140004544
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi], rax
lea r15, [rbx + 0x98]
test r15, r15
je 0x140004560
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [r15], rax
lea rdi, [rbx + 0xa0]
test rdi, rdi
je 0x14000457e
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rax + 8], rax
mov qword [rax], rax
lea rbp, [rbx + 0xc0]
test rbp, rbp
je 0x14000459b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp], rax
lea r12, [rbx + 0x94]
test r12, r12
je 0x1400045b1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [r12], eax
lea rax, [rbx + 0x58]
mov qword [rax + 8], rax
lea rcx, [rbx + 8]
mov qword [rax], rax
lea rax, [rbx + 0xd0]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0xf0]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0x100]
mov qword [rax + 8], rax
mov qword [rax], rax
call fcn.140006820
test eax, eax
jns 0x1400045fb
mov r13d, 0xffffff9d
jmp 0x140004623
mov edx, dword [rbx + 8]
mov r8d, 1
mov rcx, rbx
call fcn.140005d80
mov r13d, eax
test eax, eax
jns 0x140004692
mov ecx, dword [rbx + 8]
call fcn.140007360
mov ecx, dword [rbx + 0xc]
call fcn.140007360
xor ebx, ebx
test r14, r14
je 0x14000463a
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000463a
mov qword [r14], rbx
test rsi, rsi
je 0x14000464f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000464f
mov qword [rsi], rbx
test r15, r15
je 0x140004664
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140004664
mov qword [r15], rbx
mov rcx, rdi
call fcn.140006100
test rbp, rbp
je 0x140004683
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140004683
mov qword [rbp], rbx
mov ecx, dword [r12]
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, r13d
jmp 0x140004694
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000c420
Capabilities:
Check if file exists

Disassembly:
push r14
push r15
sub rsp, 0x48
mov rax, qword [rdx + 0x20]
mov r15, qword [rax + 0x10]
lea r14, [rax + 0x5c]
cmp ecx, 0xffffffff
jne 0x14000c43d
mov ecx, dword [r14 + 0x20]
movsxd rax, ecx
imul rcx, rax, 0xb0
lea rax, [0x140107f90]
cmp dword [rcx + rax], 0
jne 0x14000c462
mov eax, 0xfffffffd
add rsp, 0x48
pop r15
pop r14
ret
mov qword [rsp + 0x60], rbx
lea rbx, [r14 + 0x28]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
lea rdi, [rdx + 0x34]
mov qword [rsp + 0x40], r12
xor r12d, r12d
mov ebp, r12d
mov esi, r12d
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000c4d1
mov rax, qword [rbx + 8]
cmp byte [rax], 3
jne 0x14000c4d1
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x40000080
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000c508
mov qword [rdi], rax
inc ebp
inc rsi
add rbx, 0x28
add rdi, 0x10
cmp rsi, 0x20
jl 0x14000c490
xor eax, eax
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r14
ret
xor ecx, ecx
call fcn.140010990
mov r8, rax
movsxd rdx, ebp
mov qword [rsp + 0x30], r8
lea r9, str.could_not_open_device__s__interface__d_:__s
inc rdx
mov dword [rsp + 0x28], ebp
lea r8, str.winusbx_open
mov rcx, r15
lea rax, [rdx + rdx*4]
mov edx, 1
mov rax, qword [r14 + rax*8]
mov qword [rsp + 0x20], rax
call fcn.140003000
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 2
je 0x14000c566
or edx, 0xffffffff
mov eax, 0xfffffffd
cmp ecx, 5
cmovne eax, edx
jmp 0x14000c4e6
mov eax, 0xfffffffc
jmp 0x14000c4e6
Function at 0x1400107a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x20]
mov rdi, rcx
mov dword [rsp + 0x48], 0
movzx esi, r9w
mov rdx, qword [rax + 0x10]
mov ecx, dword [rdx + 0x94]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400107eb
mov eax, 0xfffffffa
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x40], rbx
call fcn.1400048b0
mov rbx, rax
test rax, rax
je 0x140010819
mov ecx, 8
call fcn.1400839b0
mov rcx, rax
test rax, rax
jne 0x14001082e
mov rcx, rbx
call fcn.140004950
mov eax, 0xfffffff5
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov word [rax], 0x900
movzx eax, si
shr ax, 8
mov byte [rsp + 0x51], al
mov byte [rsp + 0x50], sil
movzx eax, word [rsp + 0x50]
mov word [rcx + 2], ax
mov word [rsp + 0x50], 0
movzx eax, word [rsp + 0x50]
mov word [rcx + 4], ax
mov word [rsp + 0x50], 0
movzx eax, word [rsp + 0x50]
mov word [rcx + 6], ax
mov qword [rbx + 0x30], rcx
mov qword [rbx], rdi
mov word [rbx + 9], 0
mov dword [rbx + 0xc], 0x3e8
movzx ecx, word [rcx + 6]
movzx eax, cx
mov byte [rsp + 0x50], cl
shr ax, 8
mov rcx, rbx
mov byte [rsp + 0x51], al
movzx eax, word [rsp + 0x50]
add eax, 8
mov byte [rbx + 8], 2
mov dword [rbx + 0x14], eax
lea rax, [rsp + 0x48]
mov qword [rbx + 0x28], rax
lea rax, [0x1400106b0]
mov qword [rbx + 0x20], rax
call fcn.140004b00
mov esi, eax
mov rcx, rbx
test eax, eax
jns 0x1400108de
call fcn.140004950
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.1400106f0
movsxd rdx, dword [rbx + 0x10]
cmp edx, 6
ja case.default.0x1400108fe
lea r8, [0x140000000]
mov ecx, dword [r8 + rdx*4 + 0x1096c]
add rcx, r8
jmp rcx
mov edi, dword [rbx + 0x18]
jmp 0x14001094f
mov edi, 0xfffffff9
jmp 0x14001094f
mov edi, 0xfffffff7
jmp 0x14001094f
mov edi, 0xfffffffc
jmp 0x14001094f
mov edi, 0xfffffff8
jmp 0x14001094f
or edi, 0xffffffff
jmp 0x14001094f
mov rcx, qword [rdi + 0x20]
lea r9, str.unrecognised_status_code__d
mov dword [rsp + 0x20], edx
lea r8, str.libusb_control_transfer
mov edx, 2
mov rcx, qword [rcx + 0x10]
call fcn.140003000
mov edi, 0xffffff9d
mov rcx, rbx
call fcn.140004950
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140010c90
Capabilities:
Hash data using djb2

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rcx
mov edx, 0x1505
mov r8, rcx
test rcx, rcx
jne 0x140010cae
xor eax, eax
add rsp, 0x30
pop rbp
ret
movsx eax, byte [rcx]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], r14
test eax, eax
je 0x140010ce1
nop dword [rax]
nop dword [rax + rax]
imul edx, edx, 0x21
lea r8, [r8 + 1]
add edx, eax
movsx eax, byte [r8]
test eax, eax
jne 0x140010cd0
mov r11d, dword [0x1401081c8]
test edx, edx
mov r14d, 1
mov qword [rsp + 0x50], rdi
mov eax, r14d
cmovne eax, edx
xor edx, edx
div r11d
test edx, edx
mov esi, edx
cmove esi, r14d
mov r10d, esi
mov ebx, esi
shl r10, 4
add r10, qword [0x140107f58]
mov eax, dword [r10]
test eax, eax
je 0x140010e02
cmp eax, esi
jne 0x140010d61
mov rax, qword [r10 + 8]
lea r9, str._NULL_
test rax, rax
cmovne r9, rax
sub r9, rbp
nop dword [rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x140010d55
inc rcx
test edx, edx
jne 0x140010d40
test r8d, r8d
jne 0x140010d61
mov eax, esi
jmp 0x140010ec8
mov rax, qword [r10 + 8]
lea r9, str.hash_collision___s_vs__s_
mov qword [rsp + 0x28], rax
lea r8, str.htab_hash
mov edx, 4
mov qword [rsp + 0x20], rbp
xor ecx, ecx
call fcn.140003000
mov r11d, dword [0x1401081c8]
xor edx, edx
mov rdi, qword [0x140107f58]
mov eax, esi
lea ecx, [r11 - 2]
div ecx
lea r9d, [rdx + 1]
cmp ebx, r9d
ja 0x140010db4
mov eax, r11d
sub eax, r9d
add ebx, eax
jmp 0x140010db7
sub ebx, r9d
cmp ebx, esi
je 0x140010e02
mov eax, ebx
add rax, rax
mov r10d, dword [rdi + rax*8]
cmp r10d, esi
jne 0x140010dfd
mov rax, qword [rdi + rax*8 + 8]
lea r8, str._NULL_
test rax, rax
cmovne r8, rax
mov rax, rbp
sub r8, rbp
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140010df5
inc rax
test ecx, ecx
jne 0x140010de2
test edx, edx
je 0x140010ec6
test r10d, r10d
jne 0x140010da5
cmp dword [0x1401081cc], r11d
jb 0x140010e2f
lea r9, str.hash_table_is_full___d_entries_
mov dword [rsp + 0x20], r11d
lea r8, str.htab_hash
mov edx, r14d
xor ecx, ecx
call fcn.140003000
xor eax, eax
jmp 0x140010ec8
mov rcx, qword [0x140107f80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [0x140107f58]
mov edi, ebx
shl rdi, 4
add rdx, rdi
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x140010e6f
call fcn.14008f86c
mov rdx, qword [0x140107f58]
add rdx, rdi
mov qword [rdx + 8], 0
mov rcx, rbp
mov dword [rdx], esi
call fcn.140090768
mov rcx, qword [0x140107f58]
mov qword [rdi + rcx + 8], rax
test rax, rax
jne 0x140010eb3
lea r9, str.could_not_duplicate_string_for_hash_table
mov edx, r14d
lea r8, str.htab_hash
xor ecx, ecx
call fcn.140003000
mov rcx, qword [0x140107f80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x140010ec8
inc dword [0x1401081cc]
mov rcx, qword [0x140107f80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret