joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400891f0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r14d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov esi, 0xffffffff
xor ebx, ebx
cmp r14, 0x201
jae 0x140089270
jmp 0x14008925f
jae 0x14008930d
cmp r14, 0x201
jae 0x140089270
mov edi, 0x200
lea r15, [rsp + 0x48]
mov r12, r14
jmp 0x14008929a
sub r14, rbx
mov rax, r13
sub rax, rbx
cmp r14, rax
ja 0x1400892e9
cmp r13, rsi
mov ebx, 0xffffffff
cmovb rbx, r13
mov qword [rsp + 0x40], rbx
mov rdi, rbx
mov r15, qword [rsp + 0x28]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov edx, r12d
call sub.KERNEL32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400892bb
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140089338
mov r14d, ebp
cmp r12, r14
jne 0x140089250
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140089336
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r14, r12
cmp r14, 0x201
jb 0x14008925f
jmp 0x140089270
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, r14
call fcn.1400d4920
mov r13, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
jmp 0x14008927e
cmp rdi, r14
jb 0x140089336
test ebp, ebp
je 0x140089362
lea rdi, [r14 + r14]
movzx eax, byte [0x1401bb111]
xor ecx, ecx
mov rdx, rdi
call fcn.140089d40
mov rbx, rax
mov rsi, r14
test rax, rax
jne 0x14008936b
ud2
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
test r13, r13
jne 0x14008938e
jmp 0x1400893a1
mov ebx, 2
xor edi, edi
xor esi, esi
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
test r13, r13
je 0x1400893a1
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x1401bb0c8]
xor edx, edx
call fcn.1400fda74
nop
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14008a350
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
test cx, cx
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor edi, edi
mov ecx, ebx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14008a423
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x14008a3ad
mov esi, eax
cmp eax, 0x2726
jne 0x14008a416
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14008a40f
mov rsi, rax
xor edi, edi
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x14008a423
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rsi
call sub.ws2_32.dll_closesocket
mov edi, 1
mov rsi, rbx
jmp 0x14008a423
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov edi, 1
mov rax, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14008a5b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140123060]
test ecx, ecx
je 0x14008a5da
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14008a5f3
add rax, 8
jmp 0x14008a6a8
lea rcx, [0x140123048]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14008a5d1
je 0x14008a60f
test rsi, rsi
je 0x14008a616
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x14008a618
mov rdi, qword [rsi + 8]
jmp 0x14008a618
xor eax, eax
jmp 0x14008a6a8
xor edi, edi
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x14008a6d0
mov rbx, rax
mov rsi, rax
lea rax, [0x140123048]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x140123060]
test ecx, ecx
je 0x14008a6b0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140123060]
test ecx, ecx
je 0x14008a6c0
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14008a6a5
mov rax, qword [rdi + 8]
test rax, rax
je 0x14008a694
lock dec qword [rax]
jne 0x14008a694
mov rcx, rdi
add rcx, 8
call fcn.14008b950
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140123048]
call fcn.140082430
mov ecx, eax
jmp 0x14008a654
lea rcx, [0x140123048]
call fcn.140082430
mov ecx, eax
jmp 0x14008a668
ud2

Function at 0x14008abc0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x58
ret
Function at 0x14008cd20
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x140147470]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x14008cd8a
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14008cdbd
test eax, eax
js 0x14008cd9e
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.140082500
mov rcx, rax
call fcn.1400aa5a0
mov ecx, 7
int 0x29
ud2
Function at 0x14008d4f0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x14008d5c0
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14008d5d0]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x14008d5b3
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x14008d56b
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x14008d58e
cmp qword [rbx + 0x10], 0x11
jb 0x14008d57d
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rsi
call fcn.1400fda74
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x14008f340
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x14008f496
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd r13, dword [rsp + 0x24]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
test r13, r13
je 0x14008f46c
shl r13, 3
mov esi, 8
xor ebp, ebp
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x80]
xor r15d, r15d
jmp 0x14008f3e9
mov rax, qword [rsp + 0x70]
mov qword [rsi + rbp + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + rbp], xmm0
inc r15
mov qword [rsp + 0x38], r15
add rbp, 0x18
add r13, 0xfffffffffffffff8
je 0x14008f46c
mov r12, qword [rdi + r15*8]
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rax, [r12 + rax*2]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rax
mov word [rsp + 0x90], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.140090120
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r15, qword [rsp + 0x28]
jne 0x14008f3c0
lea rcx, [rsp + 0x28]
call fcn.14008fd00
mov rsi, qword [rsp + 0x30]
jmp 0x14008f3c0
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
test rax, rax
jne 0x14008f47e
call sub.KERNEL32.dll_GetLastError
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
jmp 0x14008f4ad
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400903f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401230a0]
test ecx, ecx
je 0x14009041a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140090433
add rax, 8
jmp 0x1400904ca
lea rcx, [0x140123088]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140090411
je 0x1400904c8
test rsi, rsi
je 0x14009044f
cmp dword [rsi], 0
mov dword [rsi], 0
je 0x14009044f
mov rdi, qword [rsi + 4]
jmp 0x140090451
xor edi, edi
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x1400904f2
mov rbx, rax
mov rsi, rax
lea rax, [0x140123088]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x1401230a0]
test ecx, ecx
je 0x1400904d2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1401230a0]
test ecx, ecx
je 0x1400904e2
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x1400904c3
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
jmp 0x1400904ca
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140123088]
call fcn.140082430
mov ecx, eax
jmp 0x14009048d
lea rcx, [0x140123088]
call fcn.140082430
mov ecx, eax
jmp 0x1400904a1
ud2

Function at 0x140090500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140095810
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401230e0]
test ecx, ecx
je 0x14009583a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140095853
add rax, 8
jmp 0x1400958ea
lea rcx, [0x1401230c8]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140095831
je 0x14009586f
test rsi, rsi
je 0x140095873
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
je 0x140095875
mov rdi, qword [rsi + 8]
jmp 0x140095875
xor eax, eax
jmp 0x1400958ea
xor edi, edi
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140095912
mov rbx, rax
mov rsi, rax
lea rax, [0x1401230c8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x1401230e0]
test ecx, ecx
je 0x1400958f2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1401230e0]
test ecx, ecx
je 0x140095902
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x1400958e7
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401230c8]
call fcn.140082430
mov ecx, eax
jmp 0x1400958b1
lea rcx, [0x1401230c8]
call fcn.140082430
mov ecx, eax
jmp 0x1400958c5
ud2
Function at 0x140093290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x820
mov ecx, dword [0x1401230c0]
test ecx, ecx
je 0x1400932ba
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400932d3
add rax, 8
jmp 0x1400934a5
lea rcx, [0x1401230a8]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x1400932b1
je 0x1400934a3
mov rax, qword [0x1401bb030]
cmp rax, 3
jne 0x1400934b0
mov rsi, qword [0x1401bb038]
lock inc qword [rsi]
jle 0x1400934c6
mov eax, 0x60
movups xmm0, xmmword [0x140133c00]
movups xmm1, xmmword [0x140133bf0]
nop
movups xmmword [rsp + rax - 0x30], xmm0
movups xmmword [rsp + rax - 0x40], xmm1
movups xmmword [rsp + rax - 0x20], xmm1
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax], xmm1
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax + 0x20], xmm1
movups xmmword [rsp + rax + 0x30], xmm0
sub rax, 0xffffffffffffff80
cmp rax, 0x860
jne 0x140093310
movzx eax, byte [0x1401bb111]
mov edx, 0x980
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x1400934c6
mov rbx, rax
and rbx, 0xffffffffffffff80
lea rdi, [rbx + 0x80]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], rsi
lea rcx, [rbx + 0x90]
lea rdx, [rsp + 0x20]
mov r8d, 0x800
call sub.msvcrt.dll_memcpy
xorps xmm0, xmm0
movaps xmmword [rbx + 0x890], xmm0
mov qword [rbx + 0x8a0], 1
mov qword [rbx + 0x8a8], 0
mov qword [rbx + 0x900], 0
mov rcx, qword [0x1401bb038]
mov rax, qword [rcx + 0x200]
mov qword [rbx + 0x80], rax
lock cmpxchg qword [rcx + 0x200], rdi
je 0x1400933fe
nop word cs:[rax + rax]
mov qword [rdi], rax
lock cmpxchg qword [rcx + 0x200], rdi
jne 0x1400933f0
movzx eax, byte [0x1401bb111]
mov edx, 0x10
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x1400934c6
mov rbx, rax
mov rsi, rax
lea rax, [0x1401230a8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov ecx, dword [0x1401230c0]
test ecx, ecx
je 0x1400934c8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x1401230c0]
test ecx, ecx
je 0x1400934db
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14009349e
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 0x820]
lea rdx, [rax - 1]
mov qword [rcx + 0x820], rdx
cmp qword [rcx + 0x818], 0
jne 0x14009348d
cmp rax, 1
je 0x1400934ee
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
jmp 0x1400934a5
xor eax, eax
add rsp, 0x820
pop rbx
pop rdi
pop rsi
ret
call fcn.14001dc10
mov rsi, qword [0x1401bb038]
lock inc qword [rsi]
jg 0x1400932fb
ud2
lea rcx, [0x1401230a8]
call fcn.140082430
mov ecx, eax
jmp 0x14009343e
lea rcx, [0x1401230a8]
call fcn.140082430
mov ecx, eax
jmp 0x140093456
call fcn.14001d850
jmp 0x14009348d
Function at 0x1400944e0
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
movaps xmmword [rsp + 0x1c0], xmm7
movaps xmmword [rsp + 0x1b0], xmm6
mov rsi, rcx
xor ecx, ecx
call fcn.140094a00
test rax, rax
je 0x14009479a
movups xmm6, xmmword [rax]
inc qword [rax]
movzx eax, byte [0x1401bb111]
mov edx, 0x56410
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x14009479a
mov rdi, rax
add rdi, 0x56000
mov r8d, 0x410
mov rcx, rdi
mov dl, 0xff
call sub.msvcrt.dll_memset
movzx eax, byte [0x1401bb111]
mov edx, 9
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x14009479a
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
mov qword [rsp + 0x90], 9
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 9
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 1
xorps xmm7, xmm7
movups xmmword [rsp + 0xb8], xmm7
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 8
mov qword [rsp + 0x110], 0
mov byte [rsp + 0x118], 0
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 0x3ff
mov qword [rsp + 0x130], 0x380
mov qword [rsp + 0x138], 0
movups xmmword [rsp + 0x140], xmm6
movups xmmword [rsp + 0x160], xmm7
movups xmmword [rsp + 0x150], xmm7
mov qword [rsp + 0x170], 0
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm7
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x1400946a4
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm7
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x14009473e
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsp + 0x160], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsp + 0x168], rax
lea rdi, [rsp + 0x90]
mov rcx, rdi
call fcn.140095a50
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140095e60
mov r8d, 0x120
mov rcx, rsi
mov rdx, rdi
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1c0]
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x1400947a0
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x1400947e5
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0xc0], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x14009487c
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsi + 0xd0], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsi + 0xd8], rax
mov rcx, rsi
call fcn.140095a50
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140095e60
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rsi
ret

Function at 0x140094920
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x18]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea r14, [rdi + 0x10]
jmp 0x14009496d
tzcnt ecx, eax
shl ecx, 5
mov rdx, rdi
sub rdx, rcx
lea ebp, [rax - 1]
and ebp, eax
mov rcx, qword [rdx - 8]
call sub.pdh.dll_PdhRemoveCounter
mov eax, ebp
sub rbx, 1
jb 0x14009499f
test ax, ax
jne 0x140094950
nop dword [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rdi, 0xfffffffffffffe00
add r14, 0x10
cmp eax, 0xffff
je 0x140094980
not eax
jmp 0x140094950
mov rcx, qword [rsi + 0x38]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400949b6
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x1400949cf
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x1400949e2
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400949c4
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp 0x1400fdcc4
jmp qword [sym.imp.pdh.dll_PdhCloseQuery]
Function at 0x140094a00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140095920
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x14009594f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140095968
add rax, 8
jmp 0x140095a19
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140095946
je 0x140095a17
test rsi, rsi
je 0x140095984
movups xmm6, xmmword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x1400959a0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x1401bb111]
mov edx, 0x18
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140095a46
mov rbx, rax
mov rsi, rax
lea rax, [0x140123108]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x140095a26
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x140095a36
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140095a12
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
jmp 0x140095a19
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
jmp 0x1400959dc
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
jmp 0x1400959f0
ud2