joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018ecd0
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rsi, rcx
mov edi, edx
xor ecx, ecx
call sub.KERNEL32.DLL_SetLastError
mov rcx, rsi
mov qword [rbp - 0x50], rcx
mov edx, edi
mov dword [rbp - 0x3c], edx
lea rcx, [rbp - 0x78]
call fcn.140004f80
mov rcx, qword [rbp - 0x50]
mov edx, dword [rbp - 0x3c]
call sub.KERNEL32.DLL_TerminateProcess
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.140004fd0
call fcn.14000315d
mov rdi, rax
mov qword [rbp - 0x48], rdi
call sub.KERNEL32.DLL_GetLastError
mov rdx, qword [rbp - 0x48]
mov dword [rdx + 8], eax
xor eax, eax
test esi, esi
setne al
movzx eax, al
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14018f250
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
xor ecx, ecx
call sub.KERNEL32.DLL_SetLastError
mov rcx, rsi
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140004f80
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
lea rcx, [rbp - 0x70]
call fcn.140004fd0
call fcn.14000315d
mov rdi, rax
mov qword [rbp - 0x40], rdi
call sub.KERNEL32.DLL_GetLastError
mov rdx, qword [rbp - 0x40]
mov dword [rdx + 8], eax
mov eax, esi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140191bd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.DLL_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140004f80
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.DLL_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140004fd0
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.14000315d
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140008940
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400087a0
lea rax, vtable.asmjit::JitRuntime.0
mov qword [rbx], rax
mov rax, qword [0x1400d1670]
test rax, rax
jne 0x1400089b8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x1400d1660], rax
mov eax, dword [rsp + 0x48]
mov qword [0x1400d1668], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1400d1670], rax
lea rcx, [rbx + 0xc0]
mov qword [rbx + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp qword [0x1400d1670], 0
jne 0x140008a2a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x1400d1660], rax
mov eax, dword [rsp + 0x48]
mov qword [0x1400d1668], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1400d1670], rax
mov rax, qword [0x1400d1668]
mov qword [rbx + 0xe8], rax
xor eax, eax
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], rax
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], rax
mov qword [rbx + 0x120], rax
mov qword [rbx + 0x128], rax
mov qword [rbx + 0x130], rax
mov byte [rbx + 0xf8], al
mov rax, rbx
mov qword [rbx + 0xf0], 0x40
add rsp, 0x50
pop rbx
ret

Function at 0x14000e390
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
cmp qword [0x1400d1670], 0
jne 0x14000e3f2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x1400d1660], rax
mov eax, dword [rsp + 0x48]
mov qword [0x1400d1668], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1400d1670], rax
lea rax, [0x1400d1660]
add rsp, 0x58
ret
Function at 0x14000e400
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14000e4d7
mov rax, qword [0x1400d1670]
test rax, rax
jne 0x14000e481
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x34]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x1400d1660], rax
mov eax, dword [rsp + 0x58]
mov qword [0x1400d1668], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1400d1670], rax
test rsi, rsi
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
cmove rsi, rax
mov rax, qword [0x1400d1660]
dec rdi
xor edx, edx
add rdi, rax
mov rcx, rsi
dec rax
not rax
and rdi, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x14000e4d7
test rbx, rbx
je 0x14000e4d9
mov qword [rbx], rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140011170
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x90
mov r15, r9
mov rbx, rcx
mov rdi, qword [rbp + 0x77]
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov dword [rbx + 0x18], r8d
mov qword [rbx + 0x20], 0xffffffffffffffff
mov rax, qword [rdx]
mov qword [rbp + 0x4f], rax
mov r14d, dword [rbp + 0x7f]
cmp r14d, 0xffffffff
cmove r14d, ecx
cmp r8d, 0x80000000
je 0x1400111f2
cmp r8d, 0xc0000000
je 0x1400112ff
cmp r8d, 0xc0000001
je 0x1400112f5
cmp r8d, 0xc0000002
jne 0x140011342
mov eax, 4
or r14d, eax
mov qword [rbp + 0x57], 0xffffffffffffffff
mov rcx, qword [0x1400cf870]
test rcx, rcx
jne 0x14001121b
lea rcx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x11]
mov rax, r15
cqo
idiv rcx
mov r12, rax
imul r12, rcx
mov rsi, r15
sub rsi, r12
mov r13, rdi
sub r13, rsi
test rdi, rdi
cmove r13, rdi
mov rdi, qword [rbp + 0x6f]
test rdi, rdi
jne 0x14001127b
lea ecx, [rdi + 4]
call fcn.1400201f0
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 0x18]
lea r8, [rbp - 0x51]
xor edx, edx
mov rcx, qword [rbp + 0x4f]
call rax
test eax, eax
jne 0x140011371
mov rdi, qword [rbp - 0x41]
cmp rdi, r15
jl 0x1400113d4
sub rdi, r15
lea rax, [rsi + rdi]
mov r8, r12
shr r8, 0x20
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov edx, r14d
mov r14, qword [rbp + 0x4f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test rax, rax
je 0x1400113a3
add rax, rsi
mov qword [rbx], rax
mov qword [rbx + 0x10], rsi
mov qword [rbx + 8], rdi
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x20]
mov rcx, r14
call fcn.14001de80
test al, al
je 0x140011309
mov rax, rbx
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 1
jmp 0x1400111f7
mov eax, 2
jmp 0x1400111f7
call sub.KERNEL32.dll_GetLastError
mov edx, eax
lea rcx, [rbp + 0x4f]
call fcn.140017620
mov rcx, rbx
call fcn.140019a50
xor r8d, r8d
lea rdx, [rbp + 0x4f]
lea rcx, [rbp - 0x39]
call fcn.140017790
lea rdx, [0x1400c7d30]
lea rcx, [rbp - 0x39]
call fcn.140067efc
int3
mov edx, 0x11
lea rcx, [rbp + 0x4f]
call fcn.140017660
xor r8d, r8d
lea rdx, [rbp + 0x4f]
lea rcx, [rbp - 0x39]
call fcn.140017790
lea rdx, [0x1400c7d30]
lea rcx, [rbp - 0x39]
call fcn.140067efc
nop
call sub.KERNEL32.dll_GetLastError
nop
mov edx, eax
lea rcx, [rbp + 0x4f]
call fcn.140017620
xor r8d, r8d
lea rdx, [rbp + 0x4f]
lea rcx, [rbp - 0x39]
call fcn.140017790
lea rdx, [0x1400c7d30]
lea rcx, [rbp - 0x39]
call fcn.140067efc
int3
call sub.KERNEL32.dll_GetLastError
mov edx, eax
lea rcx, [rbp + 0x4f]
call fcn.140017620
xor r8d, r8d
lea rdx, [rbp + 0x4f]
lea rcx, [rbp - 0x39]
call fcn.140017790
lea rdx, [0x1400c7d30]
lea rcx, [rbp - 0x39]
call fcn.140067efc
int3
mov edx, 0x12
lea rcx, [rbp + 0x4f]
call fcn.140017660
xor r8d, r8d
lea rdx, [rbp + 0x4f]
lea rcx, [rbp - 0x39]
call fcn.140017790
lea rdx, [0x1400c7d30]
lea rcx, [rbp - 0x39]
call fcn.140067efc
int3
Function at 0x140015cd0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Get system information on windows

Disassembly:
push r14
push r15
sub rsp, 0x98
mov r14, rcx
xor eax, eax
mov r15d, 1
lock cmpxchg dword [rcx], r15d
mov edx, dword [rcx]
cmp edx, r15d
jne 0x140015cfa
test eax, eax
je 0x140015ead
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rbp
xor ebp, ebp
mov qword [rsp + 0x80], rsi
mov ebx, ebp
mov qword [rsp + 0x78], rdi
mov esi, ebp
mov qword [rsp + 0x70], r12
mov edi, ebp
movabs r12, 0x38d7ea4c67fff
nop
xor eax, eax
lock cmpxchg dword [r14], r15d
mov ecx, dword [r14]
cmp ecx, r15d
jne 0x140015d47
test eax, eax
je 0x140015e8b
test ebx, ebx
jne 0x140015d6f
mov eax, dword [0x1400cf868]
test eax, eax
jne 0x140015d64
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
cmp eax, r15d
mov ebx, 0x20
cmova ebx, ebp
cmp ebx, 8
jb 0x140015e45
cmp ebx, 0x20
jae 0x140015d83
pause
inc ebx
jmp 0x140015d30
jne 0x140015e2a
mov ecx, 7
call fcn.1400201f0
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xc8]
call rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x140015dd3
mov ecx, dword [rsp + 0xb8]
mov eax, 0xd1b71759
dec ecx
mul ecx
mov eax, edx
shr eax, 0xd
jmp 0x140015df8
mov eax, dword [rsp + 0xb8]
imul r8, rax, 0x5f5e100
mov rax, r12
cqo
idiv qword [rsp + 0x30]
lea rcx, [rax + 1]
lea rax, [r8 - 1]
cqo
idiv rcx
lea rcx, [rsp + 0x20]
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140015e1e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
inc ebx
mov qword [rsp + 0x20], rdi
jmp 0x140015d30
mov rdi, qword [rsp + 0x20]
inc ebx
jmp 0x140015d30
test esi, esi
jne 0x140015e4c
test r15b, bl
je 0x140015e7b
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x140015e45
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x140015d30
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140015e6a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov qword [rsp + 0x28], rcx
jmp 0x140015e6f
mov rcx, qword [rsp + 0x28]
sub rcx, rdi
mov eax, esi
cmp rcx, rax
jb 0x140015e33
mov esi, ebp
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x140015d30
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x70]
add rsp, 0x98
pop r15
pop r14
ret
Function at 0x140019d60
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov r14, rdx
mov rbp, rcx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
xor edx, edx
lea r8d, [r15 + 2]
add rcx, 0x10
call fcn.1400241a0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x10]
call fcn.140025210
mov rsi, qword [rax + 8]
add rsi, qword [rax]
lea eax, [rsi + 1]
mov edi, eax
mov ecx, eax
call fcn.140066cfc
mov rbx, rax
mov qword [rsp + 0xc0], rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140069420
lea rcx, [rbp + 0x18]
lea rdx, [rsp + 0x68]
call fcn.140024990
lea rdx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov r8d, esi
mov rcx, rbx
call fcn.140068d80
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x140019e3b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019fac
call fcn.140066cf4
mov byte [r14], 0
mov dword [r14 + 0x88], r15d
mov qword [r14 + 0x90], 0xffffffffffffffff
lea rsi, [r14 + 0x70]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
lea rdi, [r14 + 8]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
mov qword [rdi + 0x60], rax
mov dword [rdi], 0x68
mov dword [rsp + 0x50], 3
cmp byte [rbp + 0x131], al
je 0x140019ef2
mov dword [rsp + 0x68], 0x18
mov dword [rsp + 0x78], 1
mov qword [rsp + 0x70], r15
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x60], rax
mov rax, qword [rsp + 0x58]
mov qword [r14 + 0x90], rax
or dword [r14 + 0x44], 0x100
cmp qword [rbp + 0x108], 0
jbe 0x140019f0f
lea rdx, [rbp + 0xf8]
cmp qword [rdx + 0x18], 0x10
jb 0x140019f12
mov rdx, qword [rdx]
jmp 0x140019f12
mov rdx, r15
mov eax, dword [rbp + 0x12c]
mov ecx, dword [rbp + 0x128]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9, qword [rbp + 0x120]
mov r8, qword [rbp + 0x118]
mov rdx, rbx
xor ecx, ecx
call fcn.14001d760
cmp eax, 1
sete al
mov byte [r14], al
cmp qword [rbp + 0x138], 0xffffffffffffffff
je 0x140019f6f
mov rcx, qword [r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [r14], 0
jne 0x140019f7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov dword [r14 + 0x88], r15d
test rbx, rbx
je 0x140019f92
mov rcx, rbx
call fcn.140066cf4
mov rax, r14
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140075c54
int3
Function at 0x140025340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rbx, rdx
mov rdi, rcx
mov r10, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140025366
mov rdx, qword [rdx]
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
test r10, r10
je 0x1400253a4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor r9, rax
imul r9, rcx
inc r8
cmp r8, r10
jb 0x140025390
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 8]
call fcn.140011f90
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400253c2
mov rcx, qword [rdi + 0x10]
cmp rcx, qword [rdi + 0x10]
jne 0x1400253dd
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov r8, rbx
lea rdx, str.logger_with_name_
lea rcx, [rsp + 0x40]
call fcn.140011840
nop
lea r8, str._already_exists
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400117d0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140018170
lea rdx, [0x1400c7d90]
lea rcx, [rsp + 0x60]
call fcn.140067efc
int3
Function at 0x140025e80
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Get system information on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov eax, dword [rcx + 0xc]
xor edi, edi
mov rbx, rcx
test eax, eax
jne 0x140025eba
mov ecx, dword [0x1400cf868]
test ecx, ecx
jne 0x140025eac
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
cmp ecx, 1
mov eax, 0x20
cmova eax, edi
mov dword [rbx + 0xc], eax
cmp eax, 8
jb 0x140025fa2
cmp eax, 0x20
jae 0x140025ed4
pause
inc dword [rbx + 0xc]
add rsp, 0x58
pop rdi
pop rbx
ret
jne 0x140025f87
mov ecx, 7
call fcn.1400201f0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x80]
call rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x140025f1c
mov ecx, dword [rsp + 0x70]
mov eax, 0xd1b71759
dec ecx
mul ecx
shr edx, 0xd
jmp 0x140025f4b
mov eax, dword [rsp + 0x70]
imul r8, rax, 0x5f5e100
movabs rax, 0x38d7ea4c67fff
cqo
idiv qword [rsp + 0x88]
lea rcx, [rax + 1]
lea rax, [r8 - 1]
cqo
idiv rcx
mov rdx, rax
lea eax, [rdx + 1]
lea rcx, [rsp + 0x70]
mov dword [rbx + 8], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140025f75
call qword [sym.imp.KERNEL32.dll_GetTickCount]
inc dword [rbx + 0xc]
mov eax, eax
mov qword [rbx], rax
add rsp, 0x58
pop rdi
pop rbx
ret
mov rax, qword [rsp + 0x70]
inc dword [rbx + 0xc]
mov qword [rbx], rax
add rsp, 0x58
pop rdi
pop rbx
ret
cmp dword [rbx + 8], edi
jne 0x140025fac
test al, 1
je 0x140025fd8
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x140025fa2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [rbx + 0xc]
add rsp, 0x58
pop rdi
pop rbx
ret
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140025fc5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
jmp 0x140025fca
mov rcx, qword [rsp + 0x70]
sub rcx, qword [rbx]
mov eax, dword [rbx + 8]
cmp rcx, rax
jb 0x140025f90
mov dword [rbx + 8], edi
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [rbx + 0xc]
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x14002a480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r13
sub rsp, 0x58
mov qword [rax + 8], rbp
xor r13d, r13d
mov rbp, qword [r8 + 0x10]
mov rdi, r8
mov qword [rax + 0x10], r12
mov rsi, rdx
mov qword [rax - 0x28], r15
mov r9, rcx
mov r15, qword [r8 + 0x18]
cmp r15, 0x10
jb 0x14002a4b5
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
mov rcx, r13
test rbp, rbp
je 0x14002a4e5
movabs r10, 0x100000001b3
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, rbp
jb 0x14002a4d1
mov rcx, qword [r9 + 0x38]
mov rax, qword [r9 + 0x20]
and rcx, rdx
mov r12, qword [r9 + 0x10]
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r12
jne 0x14002a506
mov rbx, r13
jmp 0x14002a565
mov qword [rsp + 0x90], r14
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x14002a532
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0x10
jb 0x14002a53e
mov rcx, qword [rdi]
cmp rbp, rax
jne 0x14002a54f
mov r8, rbp
call fcn.140068c80
test eax, eax
je 0x14002a55d
cmp rbx, r14
je 0x14002a55a
mov rbx, qword [rbx + 8]
jmp 0x14002a520
mov rbx, r13
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
test rbx, rbx
mov rbp, qword [rsp + 0x80]
cmove rbx, r12
cmp rbx, r12
mov r12, qword [rsp + 0x88]
jne 0x14002a59a
mov qword [rsi], r13
mov rax, rsi
mov qword [rsi + 8], r13
add rsp, 0x58
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x14002a5a7
lock inc dword [rax + 8]
mov rax, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x38]
mov qword [rsi], rax
mov rax, rsi
mov qword [rsi + 8], rcx
add rsp, 0x58
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x140034d50
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, rcx
lea r9, [rsp + 0x90]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400adf48]
call sub.SHELL32.dll_SHGetKnownFolderPath
xor r14d, r14d
test eax, eax
js 0x140034eb8
mov rbx, qword [rsp + 0x90]
lea ecx, [r14 + 0x18]
call fcn.140066cb8
mov rdi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140034dca
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140034dcd
test rbx, rbx
jne 0x140034f8a
jmp 0x140034dcd
mov rdi, r14
mov qword [rsp + 0x88], rdi
test rdi, rdi
je 0x140034f95
mov rax, qword [rdi + 8]
test rax, rax
jne 0x140034df3
mov rcx, qword [rdi]
call fcn.140096370
mov qword [rdi + 8], rax
mov rbp, 0xffffffffffffffff
mov r8, rbp
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140034e00
mov rdx, rax
mov rcx, rsi
call fcn.14001c630
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x140034e5c
lea rax, [rcx + 6]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140034e3d
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8d, 6
lea rdx, [0x1400a05c4]
mov rcx, rbx
call fcn.140068d80
mov byte [rbx + 6], 0
jmp 0x140034e7c
mov qword [rsp + 0x20], 6
lea r9, [0x1400a05c4]
xor r8d, r8d
lea edx, [r8 + 6]
mov rcx, rsi
call fcn.140012560
nop
lock xadd dword [rdi + 0x10], ebp
cmp ebp, 1
jne 0x140034ecd
mov rcx, qword [rdi]
test rcx, rcx
je 0x140034e97
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r14
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140034ea9
call fcn.140066cf4
mov qword [rdi + 8], r14
mov edx, 0x18
mov rcx, rdi
call fcn.140066cf4
jmp 0x140034ecd
mov r8d, 0x14
lea rdx, str.C:ProgramDataUSVFS
mov rcx, rsi
call fcn.14001c630
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], 7
cmp qword [rsi + 0x18], 0x10
jb 0x140034ef1
mov rdx, qword [rsi]
add rdx, qword [rsi + 0x10]
mov rsi, qword [rsi]
jmp 0x140034ef8
mov rdx, qword [rsi + 0x10]
add rdx, rsi
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.140062580
nop
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x98]
call fcn.140065540
cmp dword [rax], 1
ja 0x140034f3b
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140064ba0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140034f79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034f74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140034f84
call fcn.140066cf4
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140075c54
nop
mov ecx, 0x8007000e
call fcn.140096360
nop
mov ecx, 0x8007000e
call fcn.140096360
int3