joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400027e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400139e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002800
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002808
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140002820
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x1400139e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002840
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002848
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002840
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002840
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002884
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002898
add rax, 0x28
cmp r9, rax
jne 0x140002870
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x1400028b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400139e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400028d2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400028e0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400028d2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400028d2
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400028d2
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14000292d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002940
add rdx, 0x28
cmp r10, rdx
jne 0x140002918
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14000294f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000295f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002936
test ecx, ecx
jg 0x140002948
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140003fd0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x140013a60]
mov rax, qword [rsi]
test rax, rax
je 0x140004060
cmp qword [rax + 0x30], 0
jne 0x140004080
lea rbx, [0x140012078]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140004030
cmp qword [rax + 0x30], 0
jne 0x140004050
lea rdx, [0x140012078]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140004012
test rax, rax
jne 0x140004050
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140004020
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140003ff0
test rax, rax
jne 0x140004080
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140003ffb
Function at 0x140004090
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x1400041a2
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14000417a
add rax, 1
cmp rax, 0x6b
je 0x140004197
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140004170
cmp edx, 0x6a
je 0x140004197
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sym.abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14000418b
Function at 0x140007c50
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140013a60]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x140007d20
cmp qword [rax + 0x60], 0
jne 0x140007d40
lea rcx, [0x140012068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140007d50
cmp qword [rax + 0x1d8], r12
jne 0x140007d50
test byte [rax + 0x40], 0xc
jne 0x140007d50
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140007d50
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140007d50
mov rax, qword [rbx]
test rax, rax
je 0x140007db0
cmp qword [rax + 0x60], 0
jne 0x140007dd0
lea rcx, [0x140012068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x140007de0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140007de8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x140007c7b
test rax, rax
jne 0x140007d40
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007c86
mov rax, qword [rbx]
test rax, rax
je 0x140007d80
cmp qword [rax + 0x60], 0
jne 0x140007da0
lea rcx, [0x140012068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x140007d5f
test rax, rax
jne 0x140007da0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007d6a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x140007cea
test rax, rax
jne 0x140007dd0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007cf5
xor eax, eax
jmp 0x140007d74
mov eax, 0x16
jmp 0x140007d74
Function at 0x140008060
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x1400082c9
test rdi, rdi
je 0x14000809a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140008107
add ebx, 1
cmp ebx, 1
je 0x140008210
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x1400080d5
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000830f
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x1400082b2
xor edx, edx
test rsi, rsi
je 0x14000817f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x1400082e0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008270
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140008240
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140008220
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x1400080d5
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400081ef
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1400081c5
mov edx, 0xf
cmp eax, 0xe
jg 0x1400081c5
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x1400081c5
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140008280
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000830f
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x1400082be
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x140008300
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x14000817f
mov rcx, r12
call sym.push_pthread_mem.part.0
mov eax, 0xb
jmp 0x1400082ce
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140008d50
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008d70
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008db8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008d64
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008da5

Function at 0x140008de0
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x1400172c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008e98
mov rdx, qword [0x140017200]
lea rcx, [0x140017200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008e68
cmp rdx, rcx
jne 0x140008e4a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008e4f
nop dword [rax]
test rax, rax
je 0x140008e7a
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008e38
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008e7a
mov rdx, rax
jmp 0x140008e46
lea rcx, [0x140017300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008eb6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008e7a
Function at 0x140006e00
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140148908]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x120], 0
je 0x140006ebd
mov eax, dword [0x140148908]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x160], 1
je 0x140006eb9
mov ecx, dword [rsi + 0x1928]
test ecx, ecx
jne 0x140006eb9
mov ecx, 1
lock xadd dword [rsi + 0x1928], ecx
cmp ecx, 0x7fffffff
je 0x140006ec7
test rsi, rsi
je 0x140006eca
lea rbx, [rax + 0x160]
call fcn.140063b00
mov edx, 0x568
mov rcx, rax
xor r8d, r8d
call fcn.140006f60
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.14007dcc0
mov ecx, dword [0x14014bed8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rbx], rdi
lock dec dword [rsi + 0x1928]
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x140006eae
call fcn.1400a70d8
jmp 0x140006e2a
int3
int3
Function at 0x14000a210
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x140119af0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xac
call fcn.1400824a0
xor edi, edi
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140088a10
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14], rax
mov rcx, qword [rbx]
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rdi, rdi
or rdi, qword [rbx]
mov rcx, rsi
call fcn.140088540
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a77a0
mov rax, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14000c380
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x14000c3fb
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x14000c3d7
call fcn.14007a8b0
mov r14, qword [rdi]
cmp qword [0x14014bb70], 0
je 0x14000c406
mov rcx, qword [0x14014bb70]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x14012eaa8]
mov qword [rdi], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14000c3e9
mov qword [rdi], rsi
call fcn.14007a8b0
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140128172]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c44a
lea rcx, [sym.opera.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14000c444
call qword [0x14012eaa8]
mov rcx, rax
xor edx, edx
call fcn.1400255c0
jmp 0x14000c3ba
xor ecx, ecx
mov dl, 1
jmp 0x14000c43a
xor ecx, ecx
jmp 0x14000c438
Function at 0x14000d320
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14014b988]
mov ecx, dword [0x140148908]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000d380
lea rsi, [0x14014b980]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a77a0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14014b988]
call fcn.1400a56f4
cmp dword [0x14014b988], 0xffffffff
jne 0x14000d35c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400a98e0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1400a5638
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14014b9d0]
mov ecx, dword [0x140148908]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000d440
lea r8, [0x14014b9a0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140011500
mov qword [0x14014b980], rsi
lea rcx, [0x14014b988]
call fcn.1400a5694
jmp 0x14000d35c
lea rcx, [0x14014b9d0]
call fcn.1400a56f4
cmp dword [0x14014b9d0], 0xffffffff
jne 0x14000d411
xorps xmm0, xmm0
movups xmmword [0x14014b9c0], xmm0
movups xmmword [0x14014b9b0], xmm0
movups xmmword [0x14014b9a0], xmm0
lea rcx, [0x14014b9a0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14014b9d0]
call fcn.1400a5694
jmp 0x14000d411
Function at 0x14000f480
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xfffffffc00000000
shl ebp, 0x10
mov ecx, 0x18
call fcn.1400a5638
mov rsi, rax
mov rax, r15
and rax, r12
cmp rax, qword [0x14013c508]
jne 0x14000f4ed
mov rcx, r15
call fcn.14005de80
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x1400017d0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14000f561
test r14, r14
je 0x14000f556
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a77a0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x27a
jle 0x14000f5ab
cmp ebp, 0x5af
je 0x14000f580
cmp ebp, 0x27b
jne 0x14000f5b5
mov rcx, rbx
call fcn.1400f5990
test rsi, rsi
je 0x14000f530
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x14013c508]
jne 0x14000f5a1
call fcn.14005dfe0
mov rcx, rsi
call fcn.1400a5630
jmp 0x14000f530
cmp ebp, 8
je 0x14000f580
cmp ebp, 0xe
je 0x14000f580
mov eax, dword [0x14014b9f0]
mov ecx, dword [0x140148908]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000f662
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.140050770
movzx eax, byte [rbx + 0x17]
test al, al
jns 0x14000f5fb
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
test rax, rax
js 0x14000f63c
je 0x14000f611
test rbx, rbx
je 0x14000f64f
mov rcx, qword [0x14014b9e8]
lea rdx, [rsp + 0x50]
call fcn.140001450
cmp byte [rsp + 0x4f], 0
jns 0x14000f588
mov rcx, qword [rsp + 0x38]
call fcn.1400a5630
jmp 0x14000f588
lea rcx, [0x14011cbdc]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.1400da0b0
lea rcx, [0x14011cbdc]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.1400da0b0
lea rcx, [0x14014b9f0]
call fcn.1400a56f4
cmp dword [0x14014b9f0], 0xffffffff
jne 0x14000f5da
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400088e0
mov qword [0x14014b9e8], rax
lea rcx, [0x14014b9f0]
call fcn.1400a5694
jmp 0x14000f5da
Function at 0x140011c70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1400a7740
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400a98e0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011d23
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140011d27
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.140011d80
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400a77a0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140011d04
cmp eax, 2
jne 0x140011d6f
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400a98e0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x140011d76
lea rdx, [rsp + 0x40]
jmp 0x140011cfa
mov edi, 0x3f4
jmp 0x140011d04
mov edi, 0xea
jmp 0x140011d04
Function at 0x1400130b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14001310d
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x14012eaa8]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
mov qword [rbp - 0x20], rax
lea rcx, [0x14014aae0]
mov qword [rbp - 8], rax
cmp rax, rcx
jne 0x140013238
lea rdx, [0x14014aca8]
lea rcx, [rbp - 0x20]
call fcn.140098dd0
mov r14, rax
lea rax, [0x14014aae0]
cmp qword [rbp - 8], rax
je 0x14001316c
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14001316c
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14012eaa8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x140119af0]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x14012eaa8]
movzx eax, byte [rbx + 0x17]
mov rdx, rax
test al, al
jns 0x1400131b3
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x140013223
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x140013205
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x14012eaa8]
cmp eax, 0xffffffff
jne 0x1400131e1
xor edi, edi
movzx eax, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
mov r8, rax
test al, al
jns 0x1400131fa
mov r8, qword [rbp - 0x18]
mov rdx, rcx
add rdx, r8
inc r14
cmp r14, rdx
je 0x140013223
test rdi, rdi
je 0x1400131df
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400131c7
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x1400131e1
mov qword [rsi], rdi
test al, al
jns 0x1400130fd
call fcn.1400a5630
jmp 0x1400130fd
mov rax, qword [rbp - 8]
lock inc dword [rax + 8]
jmp 0x140013129
Function at 0x14001d5a0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x14013a028]
xor rdx, rsp
mov qword [rsp + 0x38], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x30]
mov qword [r8], rdx
or r9d, 8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14001d660
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x14001d660
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [rdi + 1]
cmp rax, 2
jae 0x14001d659
xor edi, edi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001d631
call fcn.14007a8b0
mov rcx, rsi
mov rdx, rdi
call fcn.14000c380
mov al, 1
mov byte [rsi + 8], al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a77a0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14007a8b0
jmp 0x14001d613
mov byte [rsi], 0
xor eax, eax
jmp 0x14001d63e