joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018bda0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x14018bef1
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x14047fb40]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [case.0x14012d181.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [case.0x14012d181.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [case.0x14012d181.0]
test r14, r14
je 0x14018be83
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x14018be73
lea r14, [rsi + 0xf8]
mov ecx, 1
call fcn.140280fd0
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x14018bef5
call fcn.140003260
lea rax, [fcn.140001d60]
test r14, r14
je 0x14018bec2
lea rcx, [fcn.140001000]
mov qword [r14], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14018bed4
bt eax, 9
jae 0x14018bf15
call fcn.140004350
lea rax, [fcn.140004820]
test r14, r14
je 0x14018bec2
lea rcx, [fcn.140004520]
jmp 0x14018bebf
call fcn.1403b95e0
lea rax, [0x1403ba280]
test r14, r14
je 0x14018bec2
lea rcx, [0x1403b9320]
jmp 0x14018bebf
Function at 0x14018bf40
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x28], r9
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov esi, 1
test rdx, rdx
je 0x14018c10b
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov rsi, qword [rsp + 0x150]
mov r13d, dword [rsi + 4]
xor r14d, r14d
movaps xmm7, xmmword [0x1404eabc0]
movaps xmm8, xmmword [0x1404eabd0]
lea r12, [rsp + 0x30]
mov eax, r14d
bswap eax
mov dword [rsp + 0x5c], eax
cmp qword [rsp + 0x30], rsi
je 0x14018c002
mov ecx, dword [rsi + 0x2c]
call fcn.140286340
test rax, rax
je 0x14018c16e
mov rbp, rax
mov rcx, qword [rsp + 0x38]
call fcn.140286410
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rsi
mov rax, qword [rsi + 0x10]
lea rcx, [0x1403d0e80]
cmp rax, rcx
jne 0x14018c15e
mov rax, qword [rsp + 0x38]
movups xmmword [rax + 0x5c], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax], xmm7
movups xmmword [rax + 0x10], xmm8
mov dword [rax + 0x6c], 0x20
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov rdx, r15
mov r8, qword [rsp + 0x28]
call qword [case.0x14012d181.0]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov r8d, 4
mov rcx, r12
lea rdx, [rsp + 0x5c]
call qword [case.0x14012d181.0]
cmp rdi, r13
jb 0x14018c0b2
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, r12
mov rdx, rbx
call qword [case.0x14012d181.0]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x2c]
call fcn.140286450
add rbx, r13
inc r14d
sub rdi, r13
jne 0x14018bfca
jmp 0x14018c106
movaps xmm0, xmmword [0x14047fb40]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea r15, [rsp + 0x30]
mov rax, qword [r15]
mov rax, qword [rax + 0x20]
mov rcx, r15
mov rdx, r14
call qword [case.0x14012d181.0]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov edx, dword [rax + 0x2c]
call fcn.140286450
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.1402e0660
mov esi, 1
mov rcx, qword [rsp + 0x38]
call fcn.140286410
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14018c172
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x30]
call qword [case.0x14012d181.0]
jmp 0x14018c03e
xor esi, esi
jmp 0x14018c10b
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [case.0x14012d181.0]
jmp 0x14018c11f
Function at 0x14018e020
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14018e115
cmp qword [rsi], 0
jne 0x14018e115
cmp dword [rsi + 0x14], 0
jne 0x14018e115
cmp qword [rsi + 8], 0
jne 0x14018e115
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x14018e094
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14018e0fc
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14018e08c
mov qword [rsi], r14
call fcn.14026d530
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x14018e0ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14018e0e4
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14018e0c6
mov qword [rsi + 8], r14
call fcn.14026d530
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14026d530
mov rcx, qword [rsi + 8]
call fcn.140252540
mov qword [rsi + 8], 0
jmp 0x14018e0b3
call fcn.14026d530
mov rcx, qword [rsi]
call fcn.140252540
mov qword [rsi], 0
jmp 0x14018e07a
mov rcx, rsi
call fcn.1403d6870
mov rax, qword [rsi]
jmp 0x14018e05a
Function at 0x1401941e0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140194241
test r12, r12
je 0x140194358
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1401942a6
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x14019428f
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1402e0660
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
jmp 0x14019420e
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x140194384
lea rcx, [r15*8]
call fcn.1402dd130
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x140194323
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140194358
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14019430b
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1403d7e60
mov r12, qword [rsi + 0x10]
jmp 0x14019420e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
call fcn.14031db10
int3
Function at 0x1401abdf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov ebx, dword [rdx + 4]
test ebx, ebx
jle 0x1401abe97
test rsi, rsi
je 0x1401abea5
mov rdi, rcx
movsxd rax, dword [rdx]
add rax, rax
add rdi, rax
je 0x1401abed1
mov rcx, rsi
call fcn.140303550
cmp rax, rbx
jne 0x1401abe93
add rbx, rbx
lea rcx, [rax - 1]
xor edx, edx
movzx r8d, byte [rsi + rdx]
movzx r9d, word [rdi + rdx*2]
lea r10d, [r9 - 0x41]
lea r11d, [r9 + 0x20]
cmp r10w, 0x1a
cmovae r11d, r9d
movzx r9d, r11w
lea r10d, [r8 - 0x41]
lea r11d, [r8 + 0x20]
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r8d
movsx r8d, r10b
cmp r9d, r8d
jne 0x1401abe93
lea r8, [rbx - 2]
lea r9, [rdx + 1]
cmp rbx, 2
je 0x1401abe8b
mov rbx, r8
cmp rcx, rdx
mov rdx, r9
jne 0x1401abe36
xor rax, r9
or r8, rax
jmp 0x1401abe9a
xor eax, eax
jmp 0x1401abe9d
cmp byte [rsi], 0
sete al
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.14032ac00
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.14032ac00
int3
Function at 0x1401aedf0
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x14047fb40]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x1401aeedc
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, VarUI4FromDisp
mov rcx, rdi
xor edx, edx
call fcn.1402e0d10
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x1401aeee3
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], SafeArrayCopy
xor ecx, ecx
call fcn.1401aef40
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x1401aeee3
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x1401aeeec
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401b2740
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1401b2768
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401b27a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1401b27c3
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1402ddd70
mov rcx, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.1401b28a0
mov sil, 1
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x1401b27d5
xor esi, esi
jmp 0x1401b27a6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.14031d7c0
mov rdi, rax
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1401b2825
and r8d, 0x7f
jmp 0x1401b282c
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.1402297f0
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.140260610
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1401b285c
and r8d, 0x7f
jmp 0x1401b2866
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.14031d7c0
cmp byte [rsp + 0x57], 0
jns 0x1401b2882
mov rcx, qword [rsp + 0x40]
call fcn.1402dd16c
lea rcx, [rsp + 0x58]
call fcn.14037edb0
jmp 0x1401b27d1
Function at 0x1401b28a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1401b28c7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401b28f5
mov dil, 1
test al, 0x10
je 0x1401b2907
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1402ddd70
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x1401b2976
xor edi, edi
jmp 0x1401b28d9
mov ecx, 2
call fcn.14026cdd0
test al, al
je 0x1401b2903
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.14015a460
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, reloc.WS2_32.dll_select
call fcn.14031d7c0
mov rcx, rax
mov rdx, rsi
call fcn.14037fc70
lea rdx, str.:_not_a_directory
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rax
call fcn.14031d7c0
mov rcx, rdi
call fcn.14015aab0
jmp 0x1401b2903
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, reloc.WS2_32.dll_select
call fcn.14031d7c0
mov rcx, rax
mov rdx, rsi
call fcn.14037fc70
mov rcx, rdi
call fcn.14037edb0
jmp 0x1401b2903
Function at 0x1401b3e10
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1401b2a60
mov rax, qword [rsi]
test rax, rax
je 0x1401b3e87
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x1401b3e8e
lea rcx, [rsp + 0x28]
call fcn.1401b34e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x1401b3e60
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x1401b3ea6
add rbx, 0x70
cmp rbx, r15
je 0x1401b3e60
jmp 0x1401b3e95
cmp byte [rbx + 0x27], 0
jns 0x1401b3eb2
mov rcx, qword [rbx + 0x10]
jmp 0x1401b3eb6
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x1401b3e9b
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x1401b3edc
mov rcx, r14
mov rdx, rbx
call fcn.1401b4d30
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x1401b3e9b
mov rcx, rdi
mov rdx, rbx
call fcn.1401b4b60
mov r14, rax
jmp 0x1401b3ed6

Function at 0x1401b3ef0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1401b2a60
mov rax, qword [rsi]
test rax, rax
je 0x1401b3f67
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x1401b3f6e
lea rcx, [rsp + 0x28]
call fcn.1401b34e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x1401b3f40
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x1401b3faf
cmp byte [rbx + 0x27], 0
js 0x1401b3f87
lea rcx, [rbx + 0x10]
jmp 0x1401b3f8b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x1401b3faf
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x1401b3fba
mov rcx, r14
mov rdx, rbx
call fcn.1401b4d30
add r14, 0x68
mov qword [rdi + 8], r14
add rbx, 0x70
cmp rbx, r15
je 0x1401b3f40
jmp 0x1401b3f75
mov rcx, rdi
mov rdx, rbx
call fcn.1401b4b60
mov r14, rax
jmp 0x1401b3fab
Function at 0x1401c11e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1401c11b0]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x140540ae8]
lea rdx, [0x1401c1000]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1401c12f0
cmp dword [0x140540af0], 0
jne 0x1401c12e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x140540af4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x1401c128c
mov ecx, 1
mov edx, 0x28
call fcn.140225f50
test rax, rax
je 0x1401c12e0
mov r14, rax
mov ecx, dword [0x140540af4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401c12d8
lea r15, [0x140540af8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x140540b00]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, r14
call fcn.140225eb0
mov rcx, rsi
mov rax, rdi
call qword [case.0x14012d181.0]
xor esi, esi
jmp 0x1401c12bc
call fcn.1402f9360
int3

Function at 0x1401c2170
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14052eb68]
cmp ecx, 0xffffffff
je 0x1401c2195
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1401c2190
Function at 0x1401c21a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14052eb68]
cmp ecx, 0xffffffff
je 0x1401c227a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x1401c227a
mov eax, dword [0x140542360]
mov ecx, dword [0x14052f0f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401c2284
mov rbx, qword [0x140542358]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1401c22ca
mov rax, qword [0x140540b40]
inc rax
xor ecx, ecx
lea rdx, [0x140540b50]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x1401c22d7
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x140542350]
inc ecx
mov dword [0x140542350], ecx
mov dword [rax + 0x14], ecx
mov qword [0x140540b40], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x1401c22ec
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1401c22f0
jmp 0x1401c21ca
lea rcx, [0x140542360]
call fcn.1402dd290
cmp dword [0x140542360], 0xffffffff
jne 0x1401c21ef
mov ecx, 8
call fcn.1402dd130
mov rbx, rax
mov rcx, rax
call fcn.1402386c0
mov qword [0x140542358], rbx
lea rcx, [0x140542360]
call fcn.1402dd328
jmp 0x1401c21ef
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x1401c2207
inc rcx
cmp rcx, 0x100
jne 0x1401c221a
jmp 0x1401c2260
int3

Function at 0x1401c22f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1402ddd10
sub rsp, rax
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x14052eb68]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1401c23a4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1401c2407
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1402e0d10
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1402dd1ac
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1402e0660
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1401ee4e0
test al, al
je 0x1401c240a
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x1401c23e2
mov eax, 0xffffffff
lock cmpxchg dword [0x14052eb68], ecx
je 0x1401c2328
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14052eb68]
mov dword [rsp + 0x2c], ecx
jmp 0x1401c2328
lea rcx, [rsp + 0x2c]
call fcn.1401ee4e0
test al, al
je 0x1401c240d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x1401c240d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x1401c23bb
int3
int3
int3