joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180095830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2d8]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.180084700
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x180095886
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x1800958dd
mov ebp, 0x4b0000
jmp 0x1800958eb
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.180086a90
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x180095901
mov eax, r12d
jmp 0x18009590a
mov edx, edi
mov ecx, ebp
call fcn.180086a90
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x180095926
shl esi, 0x10
mov ecx, esi
jmp 0x180095a15
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x180095984
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.180084700
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x180095974
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.180086960
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.180084700
add ebx, eax
jmp 0x180095a1e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x180095991
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x1800959d0
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.180084700
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x1800959d5
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.180086960
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.180084700
add ebx, eax
jmp 0x180095a1e
cmp eax, r12d
jge 0x180095a0e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.180084700
sub ebp, eax
sub r15d, esi
je 0x180095a0e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.180086960
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.180084700
add ebx, eax
jmp 0x180095a1e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.180084700
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
call fcn.180084700
mov r15, qword [rsp + 0x30]
add eax, 0x8000
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
shr eax, 0x10
cwde
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800ce210
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
mov esi, r14d
mov dword [rcx + 0x3c], r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x1800ce35b
movzx r10d, r14w
mov edi, r14d
mov r8, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + r8]
call fcn.1800ce6d0
test al, al
jne 0x1800ce3f6
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x1800ce2eb
cmp edx, dword [rbx + 0x60]
jl 0x1800ce2eb
cmp edx, dword [rbx + 0x64]
jg 0x1800ce2eb
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1800ce2eb
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rcx + 0x18]
xor cl, byte [rax + 0x18]
test cl, 8
jne 0x1800ce2eb
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x1800ce30e
test byte [r9 + 0x18], 8
je 0x1800ce30e
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x1800ce31f
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.1800cf090
test al, al
jne 0x1800ce3f6
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x1800ce342
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc esi
add rdi, 2
inc r10w
cmp esi, eax
jl 0x1800ce274
movzx edi, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp di, 1
jbe 0x1800ce3fa
test rdx, rdx
je 0x1800ce3fa
mov ebp, 0xffff
nop dword [rax + rax]
lea rsi, [rdx + 8]
cmp di, 1
jbe 0x1800ce398
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x1800ce39b
mov r10, r14
mov qword [rsi], r10
test byte [rdx + 0x18], 8
mov r11d, dword [rdx + 0x20]
mov r8d, r11d
mov eax, dword [rdx + 0x1c]
je 0x1800ce3b6
dec r11d
add r11d, eax
jmp 0x1800ce3cd
sub r8d, eax
inc r8d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.1800cf360
test al, al
jne 0x1800ce3f6
lea edx, [r11 + 1]
mov rcx, rbx
call fcn.1800cf360
test al, al
jne 0x1800ce3f6
mov rdx, qword [rsi]
add di, bp
jne 0x1800ce380
jmp 0x1800ce3fe
mov al, 1
jmp 0x1800ce409
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000be80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1400603a0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, r8
mov edi, edx
mov r14, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
test eax, eax
jns 0x14000bf02
call fcn.14000cd90
test al, al
je 0x14000befe
mov r8d, ebx
lea rdx, str.DPP_F:DevelopmentpdfxchangeEditorProcessPoolProcessPoolLibProcessPoolWorker.cpp_103_:_hr___08x._n
lea rcx, [rsp + 0x48]
call fcn.14000bca0
mov rcx, qword [rax]
lea rax, [0x140046790]
test rcx, rcx
cmovne rax, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000befe
call fcn.140030ac0
mov eax, ebx
jmp 0x14000bf77
mov r8, rsi
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.14000ccb0
movzx r8d, byte [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.14000c120
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.14000cd90
test al, al
je 0x14000bf73
mov r8d, dword [rsp + 0x20]
lea rdx, str.DPP_F:DevelopmentpdfxchangeEditorProcessPoolProcessPoolLibProcessPoolWorker.cpp_114_:_hr___08x._n
lea rcx, [rsp + 0x48]
call fcn.14000bca0
mov rdx, qword [rax]
lea rcx, [0x140046790]
test rdx, rdx
cmovne rcx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000bf73
call fcn.140030ac0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14001bac0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
Function at 0x14000cd90
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x58]
mov ecx, dword [0x1400612e8]
mov edx, 0x10
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140061080], eax
jg 0x14000cdc3
movzx eax, byte [0x14006107c]
add rsp, 0x28
ret
lea rcx, [0x140061080]
call fcn.14001c240
cmp dword [0x140061080], 0xffffffff
jne 0x14000cdb7
xor r8d, r8d
lea rcx, str.DPP_ENABLE_LOG
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 1
lea rcx, [0x140061080]
seta byte [0x14006107c]
call fcn.14001c1e0
movzx eax, byte [0x14006107c]
add rsp, 0x28
ret

Function at 0x14000f7a0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1400603a0]
xor rax, rsp
mov qword [rbp + 0xa8], rax
movzx ebx, dl
mov rsi, rcx
test rcx, rcx
jne 0x14000f7e9
mov eax, 0x80070057
jmp 0x14000fe75
xor r15d, r15d
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x40], r15
mov dword [rbp + 8], r15d
mov rax, qword [rcx]
lea rcx, [rbp + 8]
lea ecx, [rbp + 8]

Function at 0x140015860
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1400603a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rdx
xor ebx, ebx
test rdx, rdx
je 0x140015897
mov dword [rdx + 8], ebx
mov rax, qword [rdx]
test rax, rax
je 0x140015897
mov word [rax], bx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x20]
call fcn.140015130
cmp dword [rsp + 0x28], 0
jne 0x1400158c4
mov ebx, 0xffffffff
jmp 0x14001596c
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov r9d, 0x40
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x27]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140015929
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140015670
test eax, eax
jns 0x14001593c
lea rdx, [0x14004a0f8]
lea rcx, [rsp + 0x20]
call fcn.140015670
test eax, eax
cmovns ebx, eax
test rdi, rdi
je 0x14001596c
mov rax, qword [rsp + 0x20]
mov r9, qword [rax + rbx*8]
mov rax, qword [r9 + 0x10]
lea rdx, [0x140048b00]
test rax, rax
cmovne rdx, rax
mov r8d, dword [r9 + 0x18]
mov rcx, rdi
call fcn.140010d00
nop
lea rcx, [rsp + 0x20]
call fcn.140011050
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140015985
call fcn.140030ac0
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14001bac0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x1400159b0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x1400603a0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rdx + 8], r14d
mov rax, qword [rdx]
test rax, rax
je 0x1400159f0
mov word [rax], r14w
test rsi, rsi
je 0x140015ade
cmp word [rcx], r14w
je 0x140015ade
lea rbx, [0x14004b810]
lea rbp, [0x14004c4c0]
mov rdx, rsi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140015a37
mov rdx, qword [rbx + 8]
mov rcx, rdi
call fcn.1400118c0
cmp dword [rdi + 8], r14d
jne 0x140015abd
add rbx, 0x10
cmp rbx, rbp
jne 0x140015a11
lea rcx, [0x140062628]
call fcn.140033810
mov ebp, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
mov ebx, r14d
test eax, eax
je 0x140015ad5
nop word [rax + rax]
mov edx, ebx
lea rcx, [0x140062628]
call fcn.140033850
mov word [rsp + 0x30], r14w
mov r9d, 0x80
lea r8, [rsp + 0x30]
lea edx, [r9 - 0x19]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [rsp + 0x30], 0
je 0x140015ab5
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140015ac1
inc ebx
cmp ebx, ebp
jae 0x140015ad5
jmp 0x140015a70
mov al, 1
jmp 0x140015ae0
xor r9d, r9d
mov r8, rdi
mov edx, ebx
lea rcx, [0x140062628]
call fcn.1400338c0
cmp dword [rdi + 8], 0
setne al
jmp 0x140015ae0
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14001bac0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140024c1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140024a48
Function at 0x140033250
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x70
mov r14d, r8d
mov r9, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400332b5
test rdx, rdx
je 0x1400333e2
cmp word [rdx], 0
je 0x1400333e2
test r14b, 0xc
jne 0x1400333e2
cmp byte [rcx + 1], 0
jne 0x14003329f
mov eax, r8d
shr eax, 5
not al
test al, 1
je 0x1400333e2
xor edx, edx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
mov ebx, eax
mov dword [rsp + 0x90], eax
jmp 0x140033307
mov dword [rsp + 0xa8], 0
test r9, r9
je 0x1400332dc
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400332d0
jmp 0x1400332de
xor eax, eax
lea r8, [rsp + 0xa8]
mov edx, eax
mov rcx, r9
call fcn.140037020
mov ebx, eax
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0xa8], 0
je 0x1400333e2
test ebx, ebx
je 0x1400333e2
mov rax, qword [rdi + 0x38]
mov rdx, qword [rdi + 0x30]
cmp rdx, rax
je 0x140033355
mov rcx, rdx
nop
cmp dword [rcx], ebx
je 0x14003332f
add rcx, 0x28
cmp rcx, rax
jne 0x140033320
jmp 0x140033355
sub rcx, rdx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test edx, edx
jns 0x1400333e2
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm1
mov r9d, 0x10
lea r8, [rsp + 0x50]
lea edx, [r9 + 0x49]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, 0x10
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x4a]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop
mov rdx, qword [rdi + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x90]
lea rcx, [rdi + 0x30]
mov qword [rsp + 0x20], rax
cmp rdx, qword [rdi + 0x40]
je 0x1400333d6
call fcn.140032f00
mov rcx, qword [rdi + 0x38]
lea rax, [rcx + 0x28]
mov qword [rdi + 0x38], rax
jmp 0x1400333de
call fcn.140031390
mov rcx, rax
mov dword [rcx + 4], r14d
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x140034d40
Capabilities:
Get system information on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
xor ebx, ebx
mov qword [rcx + 0x490], 0x100
lea rax, [rcx + 0x8a0]
mov qword [rcx], rbx
mov qword [rcx + 0x47c], rbx
mov rdi, rcx
mov qword [rcx + 0x488], rbx
mov qword [rcx + 0x498], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 4
mov dword [rdi + 0x5c], ebx
nop word [rax + rax]
lea rcx, [rdx + 3]
cmp rdx, 0x4c
ja 0x140034da0
shr rcx, 4
jmp 0x140034dba
mov rax, rcx
shr rcx, 5
add rcx, 9
shr rax, 4
cmp rdx, 0x10c
cmovbe rcx, rax
mov rax, rdx
shr rax, 2
mov dword [rdi + rax*4 + 0x5c], ecx
mov word [rdi + rcx*2 + 8], dx
add rdx, 4
cmp rdx, 0x41c
jbe 0x140034d90
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x1d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140034e0e
xor edx, edx
mov rcx, rax
call fcn.140034f90
test rax, rax
je 0x140034e11
lock inc dword [rax + 0x1cc]
jmp 0x140034e11
mov rax, rbx
mov rsi, qword [rdi]
mov qword [rdi], rax
test rsi, rsi
je 0x140034f83
mov rax, qword [0x140062570]
test rax, rax
je 0x140034e41
mov rbx, qword [rax]
test rbx, rbx
je 0x140034e41
lea rcx, [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 0xffffffff
lock xadd dword [rsi + 0x1cc], eax
cmp eax, 1
jne 0x140034f71
mov rcx, qword [0x140062570]
mov qword [rsp + 0x50], r15
test rcx, rcx
je 0x140034e70
mov rdx, rsi
call fcn.140036670
lea rcx, [rsi + 0x1a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsi + 0x1c8], 0
jne 0x140034eeb
mov qword [rsp + 0x90], rbp
mov rbp, rsi
mov qword [rsp + 0x58], r14
mov r14d, 0x2a
mov qword [rsp + 0x88], rsi
nop dword [rax]
nop dword [rax + rax]
mov rdx, rbp
lea rcx, [rsp + 0x88]
call fcn.140035420
add rbp, 8
sub r14, 1
jne 0x140034eb0
lea rdx, [rsi + 0x150]
lea rcx, [rsp + 0x88]
call fcn.140035420
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsi + 0x158]
test rcx, rcx
je 0x140034f3e
nop word [rax + rax]
mov rax, qword [rcx]
mov qword [rsi + 0x158], rax
mov rdx, qword [0x140062570]
test rdx, rdx
je 0x140034f36
lock dec dword [rdx + 0x480]
add rcx, 0xffffffffffffffd6
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsi + 0x158]
mov rcx, rax
test rax, rax
jne 0x140034f00
lea rcx, [rsi + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsi + 0x1a0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [rsp + 0x50]
test rbx, rbx
je 0x140034f83
lea rcx, [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140035110
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rdi, rcx
call fcn.140037520
call fcn.1400370b0
xor ebp, ebp
mov qword [rdi], rbp
mov qword [rdi + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xorps xmm0, xmm0
lea edx, [rbp + 1]
mov ebx, eax
lea rcx, [rsp + 0x58]
xor eax, eax
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea edx, [rbp + 1]
xor r8d, r8d
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], ebx
lea rsi, [rdi + 8]
mov qword [rsp + 0x28], rbp
mov rcx, rsi
mov qword [rsp + 0x48], rax
lea r9, [0x14004e494]
mov qword [rsp + 0x40], 0x18
lea r8, [0x14004e494]
mov qword [rsp + 0x50], rbp
lea rdx, str.s.dscrt.mks._s_s._d._d._X
mov dword [rsp + 0x20], 2
call fcn.140034ce0
mov r8, rsi
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x48], rax
test rax, rax
je 0x140035297
mov byte [rsi], 0x6d
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8d, [rbp + 4]
mov dword [rsp + 0x20], 0x10b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x14003528d
xor r9d, r9d
mov qword [rsp + 0x20], 0x10b0
xor r8d, r8d
lea edx, [rbp + 6]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x14003528d
mov rcx, qword [rbx]
test rcx, rcx
je 0x140035271
add rcx, 0x10
mov qword [rdi], rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140035284
lea rcx, [rbx + 0x10]
mov qword [rbx + 8], rsi
mov qword [rbx], rbx
call fcn.140034d40
mov qword [rdi], rax
mov rax, qword [rdi]
inc dword [rax + 0x47c]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400370b0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xorps xmm0, xmm0
mov dword [0x140062670], 0x94
lea rcx, [0x140062670]
movups xmmword [0x140062674], xmm0
movups xmmword [0x140062684], xmm0
movups xmmword [0x140062694], xmm0
movups xmmword [0x1400626a4], xmm0
movups xmmword [0x1400626b4], xmm0
movups xmmword [0x1400626c4], xmm0
movups xmmword [0x1400626d4], xmm0
movups xmmword [0x1400626e4], xmm0
movups xmmword [0x1400626f4], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xorps xmm0, xmm0
lea rcx, [0x140062638]
movups xmmword [0x140062638], xmm0
movups xmmword [0x140062648], xmm0
movups xmmword [0x140062658], xmm0
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetSystemInfo]
Function at 0x140039e20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140039fe2
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140039bd0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140039fa7
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x140039f13
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140039f96
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x140039f50
mov r10, qword [rax]
cmp r10, rcx
je 0x140039f4a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140039f96
mov r8, rax
cmp r10, rax
je 0x140039f72
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x140039fbc
cmp r10, rax
jne 0x140039f60
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140039ec0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140039f96
lea rcx, str.invalid_hash_bucket_count
call fcn.14001cda8
int3