joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f334
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140366528]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140361f6c]
test eax, eax
je 0x14006f37f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140361f6c]
test eax, eax
jne 0x14006f388
call fcn.14001552c
test eax, eax
je 0x14006f3a4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14006f3ac
xor eax, eax
jmp 0x14006f411
test rbx, rbx
jne 0x14006f3cc
lea rcx, str.ImageList_GetImageCount
call fcn.140014f10
mov rbx, rax
test rax, rax
je 0x14006f3df
mov qword [0x140366528], rax
mov rcx, rbx
call fcn.1401ad7ac
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14006f3f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14006f3f6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006f40f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400f5a50
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400f5c20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1400f5c62
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x1400f60ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400f61be
test rbx, rbx
je 0x1400f61c4
test r9, r9
je 0x1400f61ca
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f61a7
cmp dword [rsp + 0x48], 3
jne 0x1400f61a7
test eax, eax
jne 0x1400f61a7
cmp dword [rdi], eax
je 0x1400f61a7
mov ecx, dword [rdi]
call fcn.1400040d4
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f619b
cmp dword [rsp + 0x48], 3
jne 0x1400f619b
test eax, eax
jne 0x1400f619b
mov eax, 1
jmp 0x1400f61a9
mov rcx, qword [rbx]
call fcn.14000543c
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140006968
int3
call fcn.140006968
int3
call fcn.140006968
int3

Function at 0x1400f64f4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400f6505
xor eax, eax
jmp 0x1400f6533
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400f653c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400f654d
xor eax, eax
jmp 0x1400f6571
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14015538c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14036a2a0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140361f6c]
test eax, eax
je 0x1401553d7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140361f6c]
test eax, eax
jne 0x1401553e0
call fcn.14001552c
test eax, eax
je 0x1401553fc
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140155404
xor eax, eax
jmp 0x140155469
test rbx, rbx
jne 0x140155424
lea rcx, str.ChooseColorW
call fcn.140035410
mov rbx, rax
test rax, rax
je 0x140155437
mov qword [0x14036a2a0], rax
mov rcx, rbx
call fcn.1401ad7ac
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14015544c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14015544e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140155467
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140159f84
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14036a3f0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140361f6c]
test eax, eax
je 0x140159fcf
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140361f6c]
test eax, eax
jne 0x140159fd8
call fcn.14001552c
test eax, eax
je 0x140159ff4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140159ffc
xor eax, eax
jmp 0x14015a061
test rbx, rbx
jne 0x14015a01c
lea rcx, str.PrintDlgW
call fcn.140035410
mov rbx, rax
test rax, rax
je 0x14015a02f
mov qword [0x14036a3f0], rax
mov rcx, rbx
call fcn.1401ad7ac
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14015a044
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14015a046
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14015a05f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1401c168c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401c1460
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401c1460
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401c1460
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401c1460
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401c1460
cmp dword [rcx + 0x84], 0xe
jbe 0x1401c1460
cmp dword [rcx + 0xf8], esi
je 0x1401c1460
mov ecx, r14d
call fcn.1401c15a8
mov ecx, 2
call fcn.1401c7098
nop
cmp byte [0x14036c500], 0
jne 0x1401c152a
mov r15d, 1
mov eax, r15d
xchg dword [0x14036c4f4], eax
test ebx, ebx
jne 0x1401c14d3
mov rdi, qword [0x14027b8e8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14036c4f8]
cmp rcx, rax
je 0x1401c14ca
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140002ec8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14036c510]
jmp 0x1401c14df
cmp ebx, r15d
jne 0x1401c14e5
lea rcx, [0x14036c528]
call fcn.1401c1cac
nop
test ebx, ebx
jne 0x1401c14fc
lea rdx, [0x1401dc930]
lea rcx, [0x1401dc910]
call fcn.1401c1320
lea rdx, [0x1401dc940]
lea rcx, [0x1401dc938]
call fcn.1401c1320
movzx eax, byte [0x14036c500]
test esi, esi
cmove eax, r15d
mov byte [0x14036c500], al
jmp 0x1401c152a
mov ecx, 2
call fcn.1401c70ec
test esi, esi
jne 0x1401c1541
mov ecx, r14d
call fcn.1401c155c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1401c13f0
Function at 0x1401c40e8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401c40c5
call fcn.1401b3724
mov dword [rax], 0x16
call fcn.1401b3604
or eax, 0xffffffff
jmp 0x1401c40e2
sub dword [rcx + 0x10], 1
jns 0x1401c40d4
add rsp, 0x28
jmp 0x1401c89d4
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401c40a4
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401c8690
call fcn.1401b3724
mov dword [rax], 0x16
call fcn.1401b3604
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401c8678
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401c8678
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401c86c2
lock or dword [rax + 0x14], 0x10
jmp 0x1401c8678
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401c86df
mov rcx, qword [rbp + 0x10]
call fcn.1401cd2c4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401bf5e4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401c80c8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1401c8736
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401c8678
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401c87a2
mov rcx, qword [rbp + 0x10]
call fcn.1401bf5e4
cmp eax, 0xffffffff
je 0x1401c8789
mov rcx, qword [rbp + 0x10]
call fcn.1401bf5e4
cmp eax, 0xfffffffe
je 0x1401c8789
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401bf5e4
movsxd rdi, eax
lea rsi, [0x14036c580]
mov rcx, rbx
sar rdi, 6
call fcn.1401bf5e4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401c8790
lea rax, [0x14027bbd0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401c87a2
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401c87d8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401c87d4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401c87d4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401c867b
jmp 0x1401c8648
Function at 0x1401c89dc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401c8842
call fcn.1401b3724
mov dword [rax], 0x16
call fcn.1401b3604
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401c8824
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401c8824
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1401c8874
lock or dword [rax + 0x14], 0x10
jmp 0x1401c8824
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401c8891
mov rcx, qword [rbp + 0x20]
call fcn.1401cd2c4
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1401c88a6
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1401c88ac
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1401bf5e4
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401c80c8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1401c88ff
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1401c8824
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401c896b
mov rcx, qword [rbp + 0x20]
call fcn.1401bf5e4
cmp eax, 0xffffffff
je 0x1401c8952
mov rcx, qword [rbp + 0x20]
call fcn.1401bf5e4
cmp eax, 0xfffffffe
je 0x1401c8952
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1401bf5e4
movsxd rdi, eax
lea r15, [0x14036c580]
mov rcx, rbx
sar rdi, 6
call fcn.1401bf5e4
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1401c8959
lea rax, [0x14027bbd0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401c896b
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1401c89a1
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401c899d
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401c899d
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1401c89bf
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1401c89ca
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1401c8829
jmp 0x1401c87f0
Function at 0x140005240
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x1403882f8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.14012a0f0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1403882f8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x1400053d0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x1400053ec
cmp rcx, r8
jl 0x1400053df
mov qword [rdx + 0x80], rcx
test dword [0x1403814f8], 1
je 0x14000541b
cmp byte [rsp + 0xd0], 0
je 0x14000541b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140004f40
mov rsp, r8
jmp rax
Function at 0x140005420
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1403882f8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140007350
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov esi, ecx
movsxd rbx, edx
lea rcx, [rsp + 0x50]
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov rdi, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.DLL_QueryPerformanceFrequency
mov r14d, 0x1e
mov rdx, rbx
imul rdx, qword [rsp + 0x50]
movabs rax, 0x431bde82d7b634db
imul rdx
mov rbp, rdx
sar rbp, 0x12
mov rax, rbp
shr rax, 0x3f
add rbp, rax
add rbp, rdi
cmp esi, r14d
cmovb r14d, esi
xor edi, edi
test r14d, r14d
jle 0x1400073f2
mov ebx, 1
test ebx, ebx
jle 0x1400073d8
mov eax, ebx
nop dword [rax]
pause
sub rax, 1
jne 0x1400073d0
lea rcx, [rsp + 0x50]
call sub.KERNEL32.DLL_QueryPerformanceCounter
cmp qword [rsp + 0x50], rbp
jg 0x1400073f2
inc edi
rol ebx, 1
cmp edi, r14d
jl 0x1400073c3
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140007410
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x58]
movzx esi, dl
mov r8d, dword [0x1403882f8]
mov rbp, rcx
mov rdi, qword [rax + r8*8]
mov eax, pe_nt_image_headers64
cmp byte [rax + rdi], 0
jne 0x140007450
call fcn.14006a33c
mov ebx, 0x10
add rbx, rdi
mov rcx, rbx
call fcn.140008460
xor r14d, r14d
lea rcx, [rbp + 0x10]
test al, al
cmovne r14, rbx
call fcn.14000d2d0
mov qword [0x140381500], r14
test sil, sil
je 0x14000748e
mov rcx, qword [0x140381760]
mov rax, qword [rcx]
call qword [rax + 0x1c0]
mov eax, dword [0x1403814f8]
or eax, 2
mov dword [0x1403814f8], eax
call sub.KERNEL32.DLL_FlushProcessWriteBuffers
xor r15d, r15d
xor esi, esi
xor dil, dil
movabs r12, 0x431bde82d7b634db
mov ebp, esi
xor esi, esi
call fcn.140008bf0
mov rcx, rax
call fcn.140008c50
mov r8b, 1
lea rcx, [rsp + 0x20]
lea rdx, [rax + 0x10]
call fcn.14000d090
call fcn.140008bf0
mov rcx, rax
call fcn.140008c50
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140007525
mov rax, qword [rbx + 0x58]
mov qword [rsp + 0x30], rax
cmp rbx, r14
je 0x1400074f0
mov rcx, rbx
call fcn.140007b70
test al, al
jne 0x1400074f0
inc esi
test dil, dil
jne 0x1400074f0
mov rcx, rbx
call fcn.140008100
jmp 0x1400074f0
lea rcx, [rsp + 0x20]
call fcn.14000d2b0
test esi, esi
je 0x1400075e0
cmp esi, ebp
jl 0x140007567
test dil, dil
je 0x140007567
mov edx, 0x64
mov ecx, r15d
call fcn.140007350
inc r15d
xor dil, dil
test r15b, 0x7f
jne 0x1400074b4
call sub.KERNEL32.DLL_SwitchToThread
jmp 0x1400074b4
lea rcx, [rsp + 0x70]
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call sub.KERNEL32.DLL_QueryPerformanceFrequency
mov rax, qword [rsp + 0x70]
lea rcx, [rax + rax*4]
mov rax, r12
imul rcx
mov rbp, rdx
sar rbp, 0x12
mov rax, rbp
shr rax, 0x3f
add rbp, rax
add rbp, rbx
mov ebx, 1
xor edi, edi
nop word [rax + rax]
test ebx, ebx
jle 0x1400075be
mov eax, ebx
pause
sub rax, 1
jne 0x1400075b6
lea rcx, [rsp + 0x70]
call sub.KERNEL32.DLL_QueryPerformanceCounter
cmp qword [rsp + 0x70], rbp
jg 0x1400075d8
inc edi
rol ebx, 1
cmp edi, 0x1e
jl 0x1400075b0
mov dil, 1
jmp 0x1400074b4
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret