joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180012370
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1800123ec
lea rbp, [0x180034fb0]
movabs r14, 0x6c00640074006e
cmp rbp, 1
jbe 0x1800123d2
mov rdx, qword [rbx + 0x50]
mov rcx, rbp
call fcn.1800195ec
test eax, eax
je 0x180012409
cmp rbp, 1
jne 0x1800123e4
cmp word [rbx + 0x48], 0x12
jne 0x1800123e4
mov rax, qword [rbx + 0x50]
cmp qword [rax], r14
je 0x180012409
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x1800123b8
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, qword [rbx + 0x20]
jmp 0x1800123ee
Function at 0x180021218
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180021248
xor eax, eax
jmp 0x18002130b
mov rbp, rbx
cmp word [rax], si
je 0x18002126d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180021254
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180021250
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180021138
movsxd r14, eax
test eax, eax
jne 0x1800212ab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180021241
mov rcx, r14
call fcn.18001dca8
mov rdi, rax
test rax, rax
jne 0x1800212c4
xor ecx, ecx
call fcn.18001dc6c
jmp 0x1800212a0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180021138
test eax, eax
jne 0x1800212f5
mov rcx, rdi
call fcn.18001dc6c
jmp 0x1800212ff
xor ecx, ecx
call fcn.18001dc6c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180028700
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180028728
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180028728
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180006ba0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x18
call fcn.180068760
sub rsp, rax
mov rax, qword [0x1800f3238]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r11, rcx
mov r9d, edx
test edx, edx
jne 0x180006bdd
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1800684f0
add rsp, 0x18
ret
mov rcx, qword [r8]
xor edx, edx
mov qword [rsp], rcx
movzx eax, byte [rsp + 1]
movzx r8d, cl
xor r8d, 0x811c9dc5
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 2]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 4]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 6]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul r8d, r8d, 0x1000193
xor r8d, eax
imul r8d, r8d, 0x1000193
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x180006c85
cmp qword [rax + 8], rcx
je 0x180006c85
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x180006c74
test r10, r10
je 0x180006c8d
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1800684f0
add rsp, 0x18
ret
Function at 0x18000c380
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x28
call fcn.180068760
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x18000c3c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180068760
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x18000c3e0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180068760
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x18000c8f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.180068760
sub rsp, rax
xor ebx, ebx
mov rsi, rcx
mov ebp, ebx
test rcx, rcx
je 0x18000c9d7
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov r12d, eax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
lea ecx, [r12 + 1]
add rdx, rcx
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x18000c9da
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp word [rbp + rcx*2], 0x5c
je 0x18000c984
mov ecx, eax
mov edx, 0x5c
inc eax
mov word [rbp + rcx*2], dx
or rcx, 0xffffffffffffffff
movsxd r8, eax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x18000c9d7
add r8, r8
mov rdx, rsi
sub r8, rsi
add r8, rbp
nop word [rax + rax]
movzx eax, word [rdx]
or rcx, 0xffffffffffffffff
inc ebx
mov word [r8 + rdx], ax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, ebx
add rdx, 2
not rcx
dec rcx
cmp rax, rcx
jb 0x18000c9b0
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x18000cb80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.180068760
sub rsp, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x40
mov edx, eax
mov edi, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18000cbeb
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18000cbe0
cmp edi, eax
jb 0x18000cbe0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x30
call fcn.180068760
sub rsp, rax
mov rdi, rcx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x18000f282
mov rcx, rdi
call fcn.18000cab0
test eax, eax
jne 0x18000f282
mov rcx, rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
call fcn.18000ee00
mov rbp, rax
test rax, rax
je 0x18000f1ad
mov qword [rsp + 0x50], r12
call fcn.18000cb80
mov r12, rax
test rax, rax
je 0x18000f19a
mov rcx, rbp
call fcn.18000cab0
test eax, eax
je 0x18000f183
lea rax, str.system32_
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbp
call fcn.18009533c
test eax, eax
je 0x18000f156
lea rax, [rsp + 0x30]
add rbx, 8
cmp rbx, rax
jb 0x18000f120
jmp 0x18000f166
lea rdx, [rbp + rdi*2]
mov rcx, r12
call fcn.18000eab0
mov rsi, rax
lea rax, [rsp + 0x30]
cmp rbx, rax
jne 0x18000f191
mov rcx, rbp
call fcn.18000cb20
test eax, eax
je 0x18000f191
mov rsi, rbp
xor ebp, ebp
jmp 0x18000f191
mov rdx, rbp
mov rcx, r12
call fcn.18000eab0
mov rsi, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x50]
jmp 0x18000f24e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18000f257
mov rcx, rdi
call fcn.18000dd00
mov rbx, rax
test rax, rax
je 0x18000f257
mov ecx, 0x37e4
call fcn.18000d8f0
test eax, eax
je 0x18000f1ec
lea rcx, [0x1800c7050]
call fcn.18000e7e0
jmp 0x18000f1f1
call fcn.18000cb80
mov rdi, rax
test rax, rax
je 0x18000f245
mov rdx, rbx
mov rcx, rax
call fcn.18000eab0
mov rsi, rax
test rax, rax
je 0x18000f23c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000f21e
test al, 0x50
je 0x18000f23c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18000f231
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x18000f257
xor ecx, ecx
jmp 0x18000f264
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18000f26a
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x180035d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rdx, rcx
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x3000
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]

Function at 0x180035fe0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x238
mov rax, qword [0x1800f3238]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r8d, 0x200
lea rdx, [rsp + 0x20]
lea rcx, str._PROGRAMFILES_NVIDIA_CorporationNVSMI_nvml.dll
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, [0x1800f6818]
lea rcx, [rsp + 0x20]
call sub.node.dll_uv_dlopen
cmp eax, 0xffffffff
jne 0x18003603f
lea rdx, [0x1800f6818]
lea rcx, str.nvml.dll
call sub.node.dll_uv_dlopen
cmp eax, 0xffffffff
je 0x18003605e
lea r8, [0x1800f6828]
lea rdx, str.nvmlInit_v2
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
cmp eax, 0xffffffff
jne 0x180036078
xor al, al
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1800684f0
add rsp, 0x238
ret
lea r8, [0x1800f6880]
lea rdx, str.nvmlShutdown
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f6888]
lea rdx, str.nvmlDeviceGetHandleByIndex_v2
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f6890]
lea rdx, str.nvmlDeviceGetTemperature
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f6898]
lea rdx, str.nvmlDeviceGetPowerUsage
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f68a0]
lea rdx, str.nvmlDeviceGetFanSpeed
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f68a8]
lea rdx, str.nvmlDeviceGetClockInfo
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f68b0]
lea rdx, str.nvmlSystemGetNVMLVersion
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f68b8]
lea rdx, str.nvmlDeviceGetCount_v2
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
lea r8, [0x1800f68c0]
lea rdx, str.nvmlDeviceGetPciInfo_v2
lea rcx, [0x1800f6818]
call sub.node.dll_uv_dlsym
call qword [0x1800f6828]
mov r8, qword [0x1800f68b0]
test eax, eax
sete al
mov byte [0x1800f6810], al
test r8, r8
je 0x180036195
mov edx, 0x50
lea rcx, [0x1800f6830]
call r8
movzx eax, byte [0x1800f6810]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1800684f0
add rsp, 0x238
ret
Function at 0x180036450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1800f3238]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [rcx]
lea rdi, [rcx + 0x3c]
mov dword [rbp - 0x79], eax
lea rdx, [rbp - 0x39]
mov eax, dword [rcx + 4]
mov rbx, rcx
mov dword [rbp - 0x75], eax
xor r8d, r8d
mov eax, dword [rcx + 8]
mov dword [rbp - 0x71], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp - 0x6d], eax
mov eax, dword [rcx + 0x10]
mov dword [rbp - 0x69], eax
mov eax, dword [rcx + 0x14]
mov dword [rbp - 0x65], eax
mov eax, dword [rcx + 0x18]
mov dword [rbp - 0x61], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbp - 0x5d], eax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x59], eax
mov eax, dword [rcx + 0x24]
mov dword [rbp - 0x55], eax
mov eax, dword [rcx + 0x28]
mov dword [rbp - 0x51], eax
mov eax, dword [rcx + 0x2c]
mov dword [rbp - 0x4d], eax
mov eax, dword [rcx + 0x30]
mov dword [rbp - 0x49], eax
mov eax, dword [rcx + 0x34]
mov dword [rbp - 0x45], eax
mov eax, dword [rcx + 0x38]
lea rcx, [rbp - 0x79]
mov dword [rbp - 0x41], eax
mov eax, dword [rdi]
mov dword [rbp - 0x3d], eax
call fcn.180036650
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.180036650
mov r8d, 2
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.180036650
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.180036650
mov r8d, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.180036650
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.180036650
mov r8d, 6
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.180036650
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.180036650
mov r8d, 8
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.180036650
mov r8d, 9
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.180036650
lea rax, [rbp - 0x3d]
mov edx, 0x10
cmp rbx, rax
ja 0x1800365ae
xor ecx, ecx
lea rax, [rbp - 0x79]
cmp rdi, rax
jae 0x1800365f7
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbp - 0x69]
pxor xmm0, xmmword [rbp - 0x79]
movdqu xmmword [rbx], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm0, xmmword [rbx + 0x20]
movdqu xmm1, xmmword [rbp - 0x59]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm1, xmmword [rbp - 0x49]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
mov rcx, rdx
cmp rcx, rdx
jae 0x180036620
lea r8, [rbp - 0x79]
sub r8, rbx
lea rax, [rbx + rcx*4]
sub rdx, rcx
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x180036610
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800684f0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180038a10
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1800f3238]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.180038ad0
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.1800387b0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800684f0
add rsp, 0xb0
pop rbx
ret
Function at 0x18004c720
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
pshufd xmm0, xmmword [rdx], 0x55
lea rdi, [0x1800bed40]
mov r11, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov rbx, rdx
mov r9d, eax
movdqu xmm5, xmmword [r11]
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
ror eax, 8
or r8d, ecx
xor eax, 2
mov ecx, r8d
ror ecx, 8
xor ecx, 2
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r9d, eax
movdqu xmm5, xmmword [rbx]
mov eax, edx
shr rax, 8
movzx ecx, al
pshufd xmm0, xmm1, 0xff
shl r9d, 8
pslldq xmm5, 4
movzx eax, byte [rcx + rdi]
movdqa xmm4, xmm5
pxor xmm4, xmmword [rbx]
or r9d, eax
movzx eax, dl
shl r9d, 8
pslldq xmm5, 4
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov rdi, qword [rsp + 0x10]
or r8d, ecx
mov eax, r8d
mov ecx, r9d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 8]
ret
Function at 0x180065130
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x48
test ecx, ecx
jle 0x180065214
mov qword [rsp + 0x40], rbx
movsxd rbx, ecx
cmp ecx, 0x64
jle 0x1800651a4
imul rax, rbx, 0xfffffffffffffff6
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [rsp + 0x68]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movss xmm6, dword [0x1800c1810]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x58]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jl 0x1800651c7
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret

Function at 0x18006bdc4
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18006bdd7
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18006c3e4
lea rdx, [0x1800f0258]
lea rcx, [rsp + 0x20]
call fcn.180085f48
int3

Function at 0x180076660
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800fc350]
xor edx, edx
jmp fcn.18006bdc4

Function at 0x180076ff8
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800fc350]
jmp fcn.18006bdc4

Function at 0x180082c40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180082cfc]
mov r9, qword [r9 + 8]
jmp fcn.180074018

Function at 0x180082cd4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180082d0c]
mov r9, qword [r9 + 8]
jmp fcn.180074018
Function at 0x18008ff38
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18008fe0f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18008fe0f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18008fe0f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18008fe0f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18008fe0f
cmp dword [rcx + 0x84], 0xe
jbe 0x18008fe0f
cmp dword [rcx + 0xf8], 0
je 0x18008fe0f
mov ecx, ebx
call fcn.18008feb0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.18008fc8c
cmp dword [rbp + 0x20], 0
je 0x18008fe5c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18008fe64
int3
xor r8d, r8d
xor edx, edx
jmp 0x18008fda8
Function at 0x140006320
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
sub rsp, 0x80
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x34], ecx
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dl, 0x60
call fcn.140006f60
mov rcx, rsi
call fcn.1400030d0
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rax + 0x20]
nop word cs:[rax + rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x48]
je 0x140006403
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x1400063e0
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
je 0x1400063f9
jmp 0x14000640b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 2
cmp dword [rsp + 0x24], 0
jne 0x14000640b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x140006390
mov dword [rsp + 0x24], 2
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x78], rcx
mov r8d, dword [rsp + 0x34]
call fcn.140006f90
mov rsi, rax
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x68]
call fcn.140007220
mov rcx, qword [rax]
call rsi
mov dword [rsp + 0x24], 1
add rsp, 0x80
pop rsi
ret