joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014ac20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, r8
mov rdi, rdx
mov ecx, 0x30
call fcn.1403195d4
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x20], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14014af10]
xor edx, edx
xor ecx, ecx
call fcn.140342370
mov qword [rdi], rax
test rax, rax
je 0x14014ac9a
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call fcn.1403175f4
int3

Function at 0x14014b1d0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14049e608]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rdx - 1]
mov rdi, rdx
mov rbx, rcx
cmp rax, 0x3f
ja 0x14014b2a1
xorps xmm0, xmm0
mov byte [rsp + 0x20], dil
xor edx, edx
mov word [rsp + 0x21], 0x100
mov r8d, 0xf0
mov byte [rsp + 0x23], 1
movups xmmword [rsp + 0x32], xmm0
mov dword [rsp + 0x24], 0
movups xmmword [rsp + 0x42], xmm0
mov word [rsp + 0x30], 0
call fcn.140338240
movaps xmm0, xmmword [0x140410bc0]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140410bd0]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140410be0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140410bf0]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x14014b2bf
cmp byte [rcx + 0xe8], 0
je 0x14014b2b2
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403195b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14014f790
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0xab0]
mov ecx, dword [0x140736d58]
movdqa xmm4, xmmword [0x14045b7f0]
add rcx, rax
movdqa xmm5, xmmword [0x14045b6b0]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x14045b6f0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x14045b710]
cmp rax, rcx
jae 0x14014f820
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, rcx
jb 0x14014f7f0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
add rsp, 0x28
ret

Function at 0x14014f990
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx + 0xab0]
mov rax, rdx
mov edx, dword [0x140736d58]
mov rcx, rax
jmp 0x14013ed60

Function at 0x140152e20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov ecx, 0x28
call fcn.1403195d4
mov r9, rax
mov rcx, qword [rsp + 0x88]
mov r10d, dword [rcx]
mov dword [rax], r10d
mov rcx, qword [rsp + 0x80]
mov r10d, dword [rcx]
mov dword [rax + 4], r10d
mov rcx, qword [rsp + 0x78]
mov edx, dword [rcx]
mov dword [rax + 8], edx
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
mov qword [rax + 0x10], rdx
mov rax, qword [rbx]
mov qword [r9 + 0x18], rax
mov qword [r9 + 0x20], rdi
mov qword [rsp + 0x50], r9
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
lea r8, [0x1401530e0]
xor edx, edx
xor ecx, ecx
call fcn.140342370
mov qword [rsi], rax
test rax, rax
je 0x140152ecd
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], edi
mov ecx, 6
call fcn.1403175f4
int3
Function at 0x140153450
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov r14, rcx
lea rax, vtable.xmrig::RxQueue.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
add rcx, 0x40
call fcn.140318418
nop
lea rcx, [r14 + 0x88]
lea edx, [rbp + 2]
call fcn.1403178f8
nop
mov qword [r14 + 0xd8], rbp
mov qword [r14 + 0xe0], rbp
xorps xmm0, xmm0
movups xmmword [r14 + 0xe8], xmm0
mov qword [r14 + 0xf8], rbp
mov qword [r14 + 0x100], rbp
mov qword [r14 + 0x108], rbp
lea ecx, [rbp + 0x18]
call fcn.1403195d4
mov rdi, rax
mov qword [rsp + 0x88], rax
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj_class_xmrig::Async_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rdx, r14
mov rcx, rbx
call fcn.140015b60
nop
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x38]
lea rcx, [r14 + 0xd8]
call fcn.140036510
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140153573
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140153573
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140153573
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, reloc.WS2_32.dll_recv
call fcn.1403195d4
mov qword [rax], r14
lea rcx, [0x140153b10]
mov qword [rax + 8], rcx
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400709d0]
xor edx, edx
xor ecx, ecx
call fcn.140342370
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1401535ed
cmp dword [r14 + 0xf0], 0
jne 0x1401535fc
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [r14 + 0xe8], xmm0
mov rax, r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], ebp
mov ecx, 6
call fcn.1403175f4
nop
call fcn.14033f788
int3
Function at 0x140159690
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov ecx, 0x18
call fcn.1403195d4
mov rcx, qword [rsp + 0x80]
movzx r10d, byte [rcx]
mov byte [rax], r10b
mov rcx, qword [rsp + 0x78]
movzx r10d, byte [rcx]
mov byte [rax + 1], r10b
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx]
mov dword [rax + 4], edx
mov rcx, qword [rbx]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdi
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140159c10]
xor edx, edx
xor ecx, ecx
call fcn.140342370
mov qword [rsi], rax
test rax, rax
je 0x140159730
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], edi
mov ecx, 6
call fcn.1403175f4
int3

Function at 0x140159920
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov ecx, 0x20
call fcn.1403195d4
mov rcx, qword [rsp + 0x78]
mov r10, qword [rcx]
mov qword [rax], r10
mov rcx, qword [rsp + 0x70]
mov r10d, dword [rcx]
mov dword [rax + 8], r10d
mov rcx, qword [rbx]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdi
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140159c60]
xor edx, edx
xor ecx, ecx
call fcn.140342370
mov qword [rsi], rax
test rax, rax
je 0x1401599b1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], edi
mov ecx, 6
call fcn.1403175f4
int3

Function at 0x140159dc0
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14049e608]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140159de8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x140159e06
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1403195b0
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x70], rdi
mov dil, 1
cmp byte [rbx], sil
jne 0x140159e61
lea r8, [rsp + 0x20]
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
test eax, eax
movzx edi, dil
cmove edi, esi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140159e61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_____e_0m
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
lea ecx, [rsi + 3]
call fcn.1400265c0
xor dil, dil
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov qword [rbx + 0x18], rsi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1403195b0
add rsp, 0x50
pop rbx
ret
Function at 0x140161430
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
mov r8d, 0x80
lea r10, [rcx + 0x3f8]
cmp rcx, rax
ja 0x140161451
xor r9d, r9d
cmp r10, rdx
jae 0x1401614c1
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r10d, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r10, 1
jne 0x140161461
mov r9, r8
cmp r9, r8
jae 0x1401614e1
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1401614d0
ret
Function at 0x140161a30
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x140161c77
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x14049e608]
xor rax, rsp
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [0x140412280]
movabs rax, 0x6a09e667f2bdc948
movaps xmm1, xmmword [0x140412290]
mov edi, r8d
movaps xmmword [rsp + 0x30], xmm0
mov rbx, rdx
movaps xmm0, xmmword [0x1404122a0]
mov rsi, rcx
movaps xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
movaps xmm1, xmmword [0x1404122b0]
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 0x54]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x120], r14
xor r14d, r14d
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], r14
lea r8d, [r14 + 4]
mov qword [rsp + 0x78], r14
mov qword [rbp], r14
mov dword [rsp + 0x20], eax
call fcn.1401686b0
mov eax, dword [rbx + 8]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x50]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x4c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x5c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
lea r8d, [r14 + 4]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x18]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x140161b97
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
test byte [rbx + 0x70], 1
je 0x140161b97
mov ecx, dword [rbx + 0x18]
xor eax, eax
mov rdi, qword [rbx + 0x10]
rep stosb byte [rdi], al
mov dword [rbx + 0x18], r14d
mov eax, dword [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140161bca
mov r8d, dword [rbx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x38]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x140161c12
mov r8d, dword [rbx + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
test byte [rbx + 0x70], 2
je 0x140161c12
mov ecx, dword [rbx + 0x38]
xor eax, eax
mov rdi, qword [rbx + 0x30]
rep stosb byte [rdi], al
mov dword [rbx + 0x38], r14d
mov eax, dword [rbx + 0x48]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x40]
mov r14, qword [rsp + 0x120]
test rdx, rdx
je 0x140161c4d
mov r8d, dword [rbx + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov r8d, 0x40
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.1401687b0
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1403195b0
add rsp, 0x128
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140161a39
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x140161c77
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x14049e608]
xor rax, rsp
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [0x140412280]
movabs rax, 0x6a09e667f2bdc948
movaps xmm1, xmmword [0x140412290]
mov edi, r8d
movaps xmmword [rsp + 0x30], xmm0
mov rbx, rdx
movaps xmm0, xmmword [0x1404122a0]
mov rsi, rcx
movaps xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
movaps xmm1, xmmword [0x1404122b0]
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 0x54]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x120], r14
xor r14d, r14d
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], r14
lea r8d, [r14 + 4]
mov qword [rsp + 0x78], r14
mov qword [rbp], r14
mov dword [rsp + 0x20], eax
call fcn.1401686b0
mov eax, dword [rbx + 8]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x50]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x4c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x5c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
lea r8d, [r14 + 4]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x18]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x140161b97
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
test byte [rbx + 0x70], 1
je 0x140161b97
mov ecx, dword [rbx + 0x18]
xor eax, eax
mov rdi, qword [rbx + 0x10]
rep stosb byte [rdi], al
mov dword [rbx + 0x18], r14d
mov eax, dword [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140161bca
mov r8d, dword [rbx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov eax, dword [rbx + 0x38]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x140161c12
mov r8d, dword [rbx + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
test byte [rbx + 0x70], 2
je 0x140161c12
mov ecx, dword [rbx + 0x38]
xor eax, eax
mov rdi, qword [rbx + 0x30]
rep stosb byte [rdi], al
mov dword [rbx + 0x38], r14d
mov eax, dword [rbx + 0x48]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov rdx, qword [rbx + 0x40]
mov r14, qword [rsp + 0x120]
test rdx, rdx
je 0x140161c4d
mov r8d, dword [rbx + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1401686b0
mov r8d, 0x40
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.1401687b0
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1403195b0
add rsp, 0x128
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14016b680
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
push rsi
push r14
sub rsp, 0xc0
mov rax, qword [0x14049e608]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
movups xmm0, xmmword [0x1404125e0]
movups xmm1, xmmword [0x1404125f0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [r11 - 0x58], xmm1
mov qword [r11 - 0x48], 0
cmp r8, 0x80
jae 0x14016b6de
lea rcx, [rsp + 0x30]
call fcn.14016b3e0
jmp 0x14016b744
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xb0], rdi
mov rdi, rsi
shr rdi, 6
imul rbp, rdi, 0xffffffffffffffc0
add rbp, rsi
nop dword [rax]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140168b60
add rbx, 0x40
sub rdi, 1
jne 0x14016b700
mov rdi, qword [rsp + 0xb0]
test rbp, rbp
je 0x14016b734
mov r8, rbp
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140337e30
add qword [rsp + 0x90], rsi
mov rbp, qword [rsp + 0xb8]
mov r9, r14
lea rcx, [rsp + 0x30]
call fcn.14016b490
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1403195b0
add rsp, 0xc0
pop r14
pop rsi
pop rbx
ret
Function at 0x14016c560
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14049e608]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx esi, r9b
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
add rcx, 0x70
xor edx, edx
mov r8d, 0x200
call fcn.140338240
xor r14d, r14d
mov dword [rbp + 0x270], r14d
mov byte [rbp + 0x274], r14b
mov byte [rbp + 0x275], r14b
mov qword [rbp + 0x278], rbx
mov dword [rbp + 0x280], edi
mov byte [rbp + 0x284], sil
mov qword [rbp + 0x288], r14
mov rcx, rbp
call fcn.1402f4f10
lea rcx, [rbp + 0x28]
call fcn.1402f4e60
lea ecx, [r14 + 0x10]
call fcn.1403195d4
mov rbx, rax
mov qword [rsp + 0x38], rax
lea ecx, [r14 + 0x10]
call fcn.1403195d4
mov qword [rax], rbp
lea rcx, [0x14016c7c0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400709d0]
xor edx, edx
xor ecx, ecx
call fcn.140342370
mov qword [rbx], rax
test rax, rax
je 0x14016c7a9
mov qword [rbp + 0x288], rbx
movabs rsi, 0x311cdad160000
movabs r14, 0x112e0be826d694b3
movsd xmm6, qword [0x14045b4c8]
nop dword [rax]
call fcn.140317990
mov rbx, rax
call fcn.140317974
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdi, r8, 0x3b9aca00
lea rcx, [rax + 0xf4240]
add rdi, rcx
call fcn.140317990
mov rbx, rax
call fcn.140317974
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jge 0x14016c770
nop word [rax + rax]
mov rbx, rdi
sub rbx, rax
call fcn.140317a80
imul rdx, rax, 0x64
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
comisd xmm0, xmm6
jbe 0x14016c706
lea rcx, [rdx + rsi]
mov rbx, rsi
jmp 0x14016c70a
lea rcx, [rbx + rdx]
add rdx, rbx
mov rax, r14
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x48], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rsp + 0x50], ecx
lea rcx, [rsp + 0x48]
call fcn.140317dfc
call fcn.140317990
mov rbx, rax
call fcn.140317974
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jl 0x14016c6e0
movzx ecx, byte [rbp + 0x274]
test cl, cl
je 0x14016c670
mov rax, rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1403195b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
movaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [rdi], r14d
mov ecx, 6
call fcn.1403175f4
int3
Function at 0x14016c900
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov eax, 1
xchg dword [0x140743ec0], eax
test eax, eax
jne 0x14016cab6
lea ecx, [rax + 1]
call fcn.1403195d4
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14016eed0]
xor edx, edx
xor ecx, ecx
call fcn.140342370
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14016cad2
cmp dword [rsp + 0x48], ebx
je 0x14016cae1
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x48], eax
je 0x14016caec
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140317d94
test eax, eax
jne 0x14016caf7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
cmp dword [0x140732900], eax
jbe 0x14016c9f3
lea rdx, str._____________________________________________
lea ecx, [rbx + 6]
call fcn.1400265c0
cmp dword [0x140732900], ebx
jbe 0x14016c9f3
lea rdx, str._________GhostRider_tuning_results_________
lea ecx, [rbx + 6]
call fcn.1400265c0
cmp dword [0x140732900], ebx
jbe 0x14016c9f3
lea rdx, str._____________________________________________
lea ecx, [rbx + 6]
call fcn.1400265c0
lea rdi, str.cn_dark__512_KB_
mov esi, 6
lea rbp, [0x140000000]
cmp dword [0x140732900], 0
jbe 0x14016ca45
movsd xmm0, qword [rbx + rbp + 0x49fc80]
movsd qword [rsp + 0x28], xmm0
mov eax, dword [rbx + rbp + 0x49fc8c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + rbp + 0x49fc88]
mov r8, qword [rdi]
lea rdx, str._24s___ux_u___.2f_h_s
mov ecx, 6
call fcn.1400265c0
mov r9d, dword [rbx + rbp + 0x49fc28]
cmp r9d, dword [rbx + rbp + 0x49fc88]
jne 0x14016ca67
mov eax, dword [rbx + rbp + 0x49fc8c]
cmp dword [rbx + rbp + 0x49fc2c], eax
je 0x14016ca9e
cmp dword [0x140732900], 0
jbe 0x14016ca9e
movsd xmm0, qword [rbx + rbp + 0x49fc20]
movsd qword [rsp + 0x28], xmm0
mov eax, dword [rbx + rbp + 0x49fc2c]
mov dword [rsp + 0x20], eax
mov r8, qword [rdi]
lea rdx, str._24s___ux_u___.2f_h_s
mov ecx, 6
call fcn.1400265c0
add rbx, 0x10
add rdi, 8
sub rsi, 1
jne 0x14016ca06
cmp dword [rsp + 0x48], esi
jne 0x14016cacc
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14033f788
nop
mov dword [rsp + 0x48], ebx
mov ecx, 6
call fcn.1403175f4
nop
mov ecx, 1
call fcn.1403175f4
int3
mov ecx, 5
call fcn.1403175f4
int3
mov ecx, 2
call fcn.1403175f4
int3