joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov r9, qword [0x1400db108]
mov rax, qword [r9]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r10, qword [rcx + 8]
mov rax, 0xffffffffffffffff
test r10, r10
je 0x14000e9ee
mov r11, qword [rdx + 8]
test r11, r11
je 0x14000e9ee
cmp r11, 1
jne 0x14000e8c7
cmp r10, r8
jbe 0x14000e9ee
mov rdx, qword [rdx]
movzx edx, byte [rdx]
mov rcx, qword [rcx]
nop word [rax + rax]
cmp byte [rcx + r8], dl
je 0x14000e9e6
inc r8
cmp r10, r8
jne 0x14000e8b0
jmp 0x14000e9ee
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea rsi, [r11 - 1]
mov edx, r11d
and edx, 3
cmp rsi, 3
jae 0x14000e94f
xor esi, esi
jmp 0x14000e990
and r11, 0xfffffffffffffffc
xor esi, esi
nop word cs:[rax + rax]
movzx edi, byte [rax + rsi]
mov byte [rsp + rdi + 0x20], 1
movzx edi, byte [rax + rsi + 1]
mov byte [rsp + rdi + 0x20], 1
movzx edi, byte [rax + rsi + 2]
mov byte [rsp + rdi + 0x20], 1
movzx edi, byte [rax + rsi + 3]
mov byte [rsp + rdi + 0x20], 1
add rsi, 4
cmp r11, rsi
jne 0x14000e960
test rdx, rdx
je 0x14000e9b2
add rax, rsi
xor r11d, r11d
nop dword [rax + rax]
movzx esi, byte [rax + r11]
mov byte [rsp + rsi + 0x20], 1
inc r11
cmp rdx, r11
jne 0x14000e9a0
mov rax, 0xffffffffffffffff
cmp r10, r8
jbe 0x14000e9ee
mov rcx, qword [rcx]
nop word cs:[rax + rax]
movzx edx, byte [rcx + r8]
cmp byte [rsp + rdx + 0x20], 0
jne 0x14000e9eb
inc r8
cmp r10, r8
jne 0x14000e9d0
jmp 0x14000e9ee
cmp r10, r8
je 0x14000e9ee
mov rax, r8
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
mov rdx, qword [r9]
cmp rdx, rcx
jne 0x14000ea0b
add rsp, 0x128
pop rdi
pop rsi
ret
call fcn.1400addd0
int3
Function at 0x14000ec20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov r9, qword [0x1400db108]
mov rax, qword [r9]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r10, qword [rcx + 8]
mov rax, 0xffffffffffffffff
test r10, r10
je 0x14000edb9
mov r11, qword [rdx + 8]
test r11, r11
je 0x14000ec97
cmp r11, 1
jne 0x14000ec9f
cmp r10, r8
jbe 0x14000edb9
mov rdx, qword [rdx]
movzx edx, byte [rdx]
mov rcx, qword [rcx]
nop word cs:[rax + rax]
cmp byte [rcx + r8], dl
jne 0x14000edb6
inc r8
cmp r10, r8
jne 0x14000ec80
jmp 0x14000edb9
mov rax, r11
jmp 0x14000edb9
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea rsi, [r11 - 1]
mov edx, r11d
and edx, 3
cmp rsi, 3
jae 0x14000ed27
xor esi, esi
jmp 0x14000ed60
and r11, 0xfffffffffffffffc
xor esi, esi
nop dword [rax]
movzx edi, byte [rax + rsi]
mov byte [rsp + rdi + 0x20], 1
movzx edi, byte [rax + rsi + 1]
mov byte [rsp + rdi + 0x20], 1
movzx edi, byte [rax + rsi + 2]
mov byte [rsp + rdi + 0x20], 1
movzx edi, byte [rax + rsi + 3]
mov byte [rsp + rdi + 0x20], 1
add rsi, 4
cmp r11, rsi
jne 0x14000ed30
test rdx, rdx
je 0x14000ed82
add rax, rsi
xor r11d, r11d
nop dword [rax + rax]
movzx esi, byte [rax + r11]
mov byte [rsp + rsi + 0x20], 1
inc r11
cmp rdx, r11
jne 0x14000ed70
mov rax, 0xffffffffffffffff
cmp r10, r8
jbe 0x14000edb9
mov rcx, qword [rcx]
nop word cs:[rax + rax]
movzx edx, byte [rcx + r8]
cmp byte [rsp + rdx + 0x20], 0
je 0x14000edb6
inc r8
cmp r10, r8
jne 0x14000eda0
jmp 0x14000edb9
mov rax, r8
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
mov rdx, qword [r9]
cmp rdx, rcx
jne 0x14000edd6
add rsp, 0x128
pop rdi
pop rsi
ret
call fcn.1400addd0
int3
Function at 0x14000f440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x130
mov r9, qword [0x1400db108]
mov rax, qword [r9]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r10, qword [rcx + 8]
test r10, r10
je 0x14000f5d8
dec r10
cmp r10, r8
cmovae r10, r8
mov r8, qword [rdx + 8]
test r8, r8
je 0x14000f5e1
cmp r8, 1
jne 0x14000f4b9
mov rax, qword [rdx]
movzx edx, byte [rax]
mov rcx, qword [rcx]
cmp byte [rcx + r10], dl
jne 0x14000f5e1
mov rax, r10
nop dword [rax]
sub rax, 1
jb 0x14000f5d8
cmp byte [rcx + r10 - 1], dl
mov r10, rax
je 0x14000f4a0
jmp 0x14000f5e4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea r11, [r8 - 1]
mov edx, r8d
and edx, 3
cmp r11, 3
jae 0x14000f542
xor r11d, r11d
jmp 0x14000f584
and r8, 0xfffffffffffffffc
xor r11d, r11d
nop dword [rax]
movzx esi, byte [rax + r11]
mov byte [rsp + rsi + 0x20], 1
movzx esi, byte [rax + r11 + 1]
mov byte [rsp + rsi + 0x20], 1
movzx esi, byte [rax + r11 + 2]
mov byte [rsp + rsi + 0x20], 1
movzx esi, byte [rax + r11 + 3]
mov byte [rsp + rsi + 0x20], 1
add r11, 4
cmp r8, r11
jne 0x14000f550
test rdx, rdx
je 0x14000f5a3
add rax, r11
xor r8d, r8d
nop
movzx r11d, byte [rax + r8]
mov byte [rsp + r11 + 0x20], 1
inc r8
cmp rdx, r8
jne 0x14000f590
mov rcx, qword [rcx]
movzx eax, byte [rcx + r10]
cmp byte [rsp + rax + 0x20], 0
je 0x14000f5e1
mov rax, r10
nop word cs:[rax + rax]
sub rax, 1
jb 0x14000f5d8
movzx edx, byte [rcx + r10 - 1]
cmp byte [rsp + rdx + 0x20], 0
mov r10, rax
jne 0x14000f5c0
jmp 0x14000f5e4
mov rax, 0xffffffffffffffff
jmp 0x14000f5e4
mov rax, r10
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
mov rdx, qword [r9]
cmp rdx, rcx
jne 0x14000f600
add rsp, 0x130
pop rsi
ret
call fcn.1400addd0
int3
Function at 0x140014d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r14, qword [0x1400db108]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x20], xmm0
mov rsi, qword [rdx + 8]
cmp rsi, qword [rsp + 0x28]
jbe 0x140014dc6
xor ebx, ebx
jmp 0x140014e68
mov ebp, r8d
mov rdi, qword [rdx]
xor ebx, ebx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov r9, rsi
call fcn.14000f6c0
cmp ebp, 1
je 0x140014e0a
test ebp, ebp
jne 0x140014e68
cmp qword [rsp + 0x40], rsi
jne 0x140014dbf
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
sete bl
jmp 0x140014e68
test rsi, rsi
je 0x140014e66
mov rax, qword [rsp + 0x38]
dec rsi
xor ecx, ecx
nop dword [rax]
movzx edx, byte [rdi + rcx]
movzx r8d, byte [rax + rcx]
lea r9d, [rdx - 0x41]
lea r10d, [rdx + 0x20]
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, edx
lea edx, [r8 - 0x41]
lea r10d, [r8 + 0x20]
cmp dl, 0x1a
movzx edx, r10b
cmovae edx, r8d
cmp r9b, dl
sete bl
jne 0x140014e68
lea rdx, [rcx + 1]
cmp rsi, rcx
mov rcx, rdx
jne 0x140014e20
jmp 0x140014e68
mov bl, 1
mov rax, qword [rsp + 0x48]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140014e85
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400addd0
int3

Function at 0x140014fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov ebx, r8d
mov r14, qword [0x1400db108]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rdx + 8]
mov r8, qword [rsp + 0x28]
sub r8, rdi
jb 0x140015030
mov rsi, qword [rdx]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov r9, rdi
call fcn.14000f6c0
cmp ebx, 1
je 0x14001504c
test ebx, ebx
jne 0x140015030
cmp qword [rsp + 0x38], rdi
jne 0x140015030
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
sete al
jmp 0x140015032
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
mov rdx, qword [r14]
cmp rdx, rcx
jne 0x1400150c0
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400150b9
mov rdx, qword [rsp + 0x30]
dec rcx
xor r8d, r8d
nop word cs:[rax + rax]
movzx eax, byte [rdx + r8]
movzx r9d, byte [rsi + r8]
lea r10d, [rax - 0x41]
lea r11d, [rax + 0x20]
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, eax
lea eax, [r9 - 0x41]
lea r11d, [r9 + 0x20]
cmp al, 0x1a
movzx eax, r11b
cmovae eax, r9d
cmp r10b, al
sete al
jne 0x140015032
lea r9, [r8 + 1]
cmp rcx, r8
mov r8, r9
jne 0x140015070
jmp 0x140015032
mov al, 1
jmp 0x140015032
call fcn.1400addd0
int3
Function at 0x1400253f0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x168
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x1400db108]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ecx, dword [section..data]
cmp ecx, 0xffffffff
je 0x14002542c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140025431
call fcn.1400255e0
movzx eax, byte [0x140108f28]
test al, al
je 0x140025593
mov rbx, qword [0x14010af50]
mov rcx, rbx
call fcn.14001a1e0
mov rcx, qword [0x14010a978]
inc rcx
mov edx, 0x100
lea rax, [0x140109170]
nop word cs:[rax + rax]
movzx r8d, cl
lea r9, [r8 + r8*2]
cmp dword [rax + r9*8], 0
je 0x14002549e
lea r8d, [rcx + 1]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rax + r9*8], 0
je 0x14002549e
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x140025470
jmp 0x1400254c2
lea rcx, [rax + r9*8]
mov dword [rcx], 1
lea rcx, [r8 + r8*2]
mov qword [rax + rcx*8 + 8], rdi
mov qword [0x14010a978], r8
mov dword [rsi], r8d
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x24], 0xffffffff
cmp eax, 0xffffffff
jne 0x14002551e
lea r8, str.slot____kInvalidSlotValue
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x24]
call fcn.140002950
test rax, rax
je 0x14002551e
lea rdx, str._var_tmp_build_firefox_c932accff593_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x196
mov r9, rax
call fcn.1400034d0
mov rcx, rdi
call fcn.1400036b0
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x24], 0x100
cmp eax, 0xff
jle 0x140025573
lea r8, str.slot____kThreadLocalStorageSize
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x24]
call fcn.140002950
test rax, rax
je 0x140025573
lea rdx, str._var_tmp_build_firefox_c932accff593_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x197
mov r9, rax
call fcn.1400034d0
mov rcx, rsi
call fcn.1400036b0
mov rax, qword [rsp + 0x160]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x1400255d4
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140108f28]
call fcn.1400ac804
test eax, eax
je 0x140025440
mov ecx, 8
call fcn.1400aca30
mov rbx, rax
mov rcx, rax
call fcn.14001a1a0
mov qword [0x14010af50], rbx
lea rcx, [0x140108f28]
call fcn.1400ac8df
jmp 0x140025440
call fcn.1400addd0
int3
mov eax, 0xffffffff
mov qword [rcx], rax
jmp 0x1400253f0
Function at 0x140025990
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [section..data]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400259c0
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400259c0
mov rax, qword [rax + rcx]
jmp 0x1400259c2
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400259d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [section..data]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x1400259f8
test rdi, rdi
je 0x140025a11
call fcn.1400255e0
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140025a20
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x168
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x1400db108]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ecx, dword [section..data]
cmp ecx, 0xffffffff
je 0x14002542c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140025431
call fcn.1400255e0
movzx eax, byte [0x140108f28]
test al, al
je 0x140025593
mov rbx, qword [0x14010af50]
mov rcx, rbx
call fcn.14001a1e0
mov rcx, qword [0x14010a978]
inc rcx
mov edx, 0x100
lea rax, [0x140109170]
nop word cs:[rax + rax]
movzx r8d, cl
lea r9, [r8 + r8*2]
cmp dword [rax + r9*8], 0
je 0x14002549e
lea r8d, [rcx + 1]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rax + r9*8], 0
je 0x14002549e
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x140025470
jmp 0x1400254c2
lea rcx, [rax + r9*8]
mov dword [rcx], 1
lea rcx, [r8 + r8*2]
mov qword [rax + rcx*8 + 8], rdi
mov qword [0x14010a978], r8
mov dword [rsi], r8d
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x24], 0xffffffff
cmp eax, 0xffffffff
jne 0x14002551e
lea r8, str.slot____kInvalidSlotValue
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x24]
call fcn.140002950
test rax, rax
je 0x14002551e
lea rdx, str._var_tmp_build_firefox_c932accff593_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x196
mov r9, rax
call fcn.1400034d0
mov rcx, rdi
call fcn.1400036b0
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x24], 0x100
cmp eax, 0xff
jle 0x140025573
lea r8, str.slot____kThreadLocalStorageSize
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x24]
call fcn.140002950
test rax, rax
je 0x140025573
lea rdx, str._var_tmp_build_firefox_c932accff593_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x197
mov r9, rax
call fcn.1400034d0
mov rcx, rsi
call fcn.1400036b0
mov rax, qword [rsp + 0x160]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x1400255d4
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140108f28]
call fcn.1400ac804
test eax, eax
je 0x140025440
mov ecx, 8
call fcn.1400aca30
mov rbx, rax
mov rcx, rax
call fcn.14001a1a0
mov qword [0x14010af50], rbx
lea rcx, [0x140108f28]
call fcn.1400ac8df
jmp 0x140025440
call fcn.1400addd0
int3
mov eax, 0xffffffff
mov qword [rcx], rax
jmp 0x1400253f0

Function at 0x140025a40
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140025a55
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x140027440
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, qword [0x1400db108]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm0, qword [0x14010afc0]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x140027584
jp 0x140027584
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx eax, byte [0x140108f58]
test al, al
je 0x1400275a5
movzx eax, byte [0x140108f60]
test al, al
je 0x1400275da
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r15, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r15, qword [0x14010afb8]
movq xmm0, r15
punpckldq xmm0, xmmword [0x1400dd2e0]
subpd xmm0, xmmword [0x1400dd2f0]
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x20]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1400dd300]
ucomisd xmm2, xmm1
ja 0x140027584
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x14010afb0]
movq xmm2, rdi
punpckldq xmm2, xmmword [0x1400dd2e0]
subpd xmm2, xmmword [0x1400dd2f0]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x14010afc0], xmm0
mov rax, qword [rsp + 0x28]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x1400275a0
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400addd0
lea rcx, [0x140108f58]
call fcn.1400ac804
test eax, eax
je 0x1400274ac
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x14010afb0], rdx
lea rcx, [0x140108f58]
call fcn.1400ac8df
jmp 0x1400274ac
lea rcx, [0x140108f60]
call fcn.1400ac804
test eax, eax
je 0x1400274bb
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x14010afb8], rax
lea rcx, [0x140108f60]
call fcn.1400ac8df
jmp 0x1400274bb
Function at 0x1400290d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400291e0
mov rbx, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x1400291e0
cmp word [rax + rcx + 0x14], 0x78
jb 0x1400291e0
mov rsi, r8
mov rdi, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test rax, rax
je 0x1400291e0
cmp rdi, 0xffff
jbe 0x140029212
mov r14, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov ecx, dword [r14 + 0x18]
test rcx, rcx
je 0x1400291e0
lea r15, [rax + rcx*4]
lea r13, [rdi + 1]
mov qword [rsp + 0x20], rax
mov rbp, rax
nop word cs:[rax + rax]
mov r12, r15
sub r12, rbp
mov rax, r12
sar rax, 2
shr r12, 0x3f
add r12, rax
and r12, 0xfffffffffffffffe
mov edx, dword [rbp + r12*2]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
movzx ecx, byte [rdi]
test cl, cl
je 0x1400291b1
mov rdx, r13
cmp cl, byte [rax]
jne 0x1400291b3
inc rax
movzx ecx, byte [rdx]
inc rdx
test cl, cl
jne 0x1400291a0
xor ecx, ecx
lea r12, [r12*2]
add r12, rbp
movzx eax, byte [rax]
cmp cl, al
je 0x1400291f3
movzx ecx, cl
lea rdx, [r12 + 4]
cmp ecx, eax
cmovg rbp, rdx
cmovs r15, r12
xor eax, eax
cmp rbp, r15
jne 0x140029170
jmp 0x1400291e2
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [r14 + 0x24]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
sub r12, qword [rsp + 0x20]
sar r12, 1
movzx edi, word [rax + r12]
add di, word [r14 + 0x10]
mov word [rsi], di
mov al, 1
jmp 0x1400291e2

Function at 0x140029b50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140029b87
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140029b87
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140029b87
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x14002b9c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rdi, qword [0x1400db108]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1400aca30
mov rsi, rax
movzx eax, byte [0x140108fb0]
test al, al
je 0x14002ba7a
mov r9d, dword [rsp + 0x2c]
lea r8, [0x14010b078]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14002bc50
mov rax, qword [rsp + 0x180]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x14002badc
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x140108fb0]
call fcn.1400ac804
test eax, eax
je 0x14002ba41
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x14010b098], xmm2
movups xmmword [0x14010b088], xmm1
movups xmmword [0x14010b078], xmm0
lea rcx, [0x140108fb0]
call fcn.1400ac8df
jmp 0x14002ba41
call fcn.1400addd0
int3

Function at 0x140035bf0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rax, [rcx + 8]
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
mov qword [rcx], rax
lea rdi, [rcx + 0x18]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x18], 0
mov rcx, rdi
mov rdx, rax
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140008150