joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400433b0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401af210]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14004351f
jp 0x14004351f
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401af220]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004353e
mov eax, dword [0x1401af230]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140043578
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x1401af228]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x14015f5b0]
subpd xmm1, xmmword [0x14015f5c0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x140165000]
ucomisd xmm1, xmm0
ja 0x14004351f
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401af218]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x14015f5b0]
subpd xmm1, xmmword [0x14015f5c0]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401af210], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14012cde0
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1401af220]
call fcn.14012cb70
cmp dword [0x1401af220], 0xffffffff
jne 0x140043431
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401af218], rdx
lea rcx, [0x1401af220]
call fcn.14012cc08
jmp 0x140043431
lea rcx, [0x1401af230]
call fcn.14012cb70
cmp dword [0x1401af230], 0xffffffff
jne 0x140043456
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1401af228], rax
lea rcx, [0x1401af230]
call fcn.14012cc08
jmp 0x140043456
Function at 0x140043e60
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rcx
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [0x1401661a0]
mov qword [rcx], rax
add rcx, 8
call fcn.14003ad30
lea rcx, [rsi + 0x10]
call fcn.14003ad30
mov byte [rsi + 0x18], 0
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], 0
call fcn.14003ad30
mov byte [rsi + 0x48], 0
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], 0
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov dword [rsi + 0xd0], 0x3f800000
mov dword [rsi + 0xd8], 0
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], 0x3f800000
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], 0x3f800000
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov qword [rsi + 0x150], 0
mov dword [rsi + 0x158], 0x3f800000
movups xmmword [rsi + 0x160], xmm6
movups xmmword [rsi + 0x170], xmm6
mov dword [rsi + 0x180], 0x3f800000
mov qword [rsi + 0x1a0], 0
movups xmmword [rsi + 0x188], xmm6
mov dword [rsi + 0x198], 0
mov eax, dword [0x14016a358]
mov qword [rsi + 0x1a8], rax
lea rcx, [rsi + 0x1b0]
call fcn.14006a140
movups xmmword [rsi + 0x2e0], xmm6
mov qword [rsi + 0x2f0], 0
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.14005bbb0
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.14005bbb0
lea rcx, [rsi + 0x308]
xor edx, edx
call fcn.14005bbb0
movups xmmword [rsi + 0x310], xmm6
movups xmmword [rsi + 0x320], xmm6
mov dword [rsi + 0x330], 0x3f800000
movups xmmword [rsi + 0x338], xmm6
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
movups xmmword [rsi + 0x361], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
call fcn.1400027b0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x198], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x190], rax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140040630
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140040700
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x130], rax
mov rcx, rdi
call fcn.140040550
mov rcx, rsi
call fcn.140044100
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
je 0x1400440aa
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
call fcn.1400680b0
mov qword [rsp + 0x28], 0
lea r8, str.TraceLog
lea r9, [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.140068220
mov qword [0x1401af608], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012cde0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x14005a8b0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, r9
mov r15, r8
mov edi, edx
mov rbx, rcx
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
cmp dword [rcx + 8], 0
setne al
mov ebp, edx
sar ebp, 0x1f
lea r12d, [rax + rax]
add r12d, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], r8
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [r14], rax
test rax, rax
jne 0x14005a944
call fcn.140097470
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov edx, r12d
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [r14], rax
test rax, rax
jne 0x14005a944
call fcn.140097470
mov rsi, qword [r14]
test rsi, rsi
je 0x14005a9ae
mov rdi, qword [rsp + 0xd0]
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rsp + 0x48]
sub rcx, rsi
add rcx, qword [rsp + 0x38]
test rax, rax
cmove rcx, rax
mov qword [rdi], rcx
mov sil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012cde0
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14005a990

Function at 0x14005ab10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x14005ab8c
cmp r8, 1
jne 0x14005ab22
xor ecx, ecx
jmp 0x14005ab6e
mov r9, r8
and r9, 0xfffffffffffffffe
xor ecx, ecx
lea r10, [0x1401691e0]
nop word cs:[rax + rax]
nop dword [rax]
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r9, rcx
jne 0x14005ab40
test r8b, 1
je 0x14005ab8c
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x1401691e0]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret

Function at 0x14005b5e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ac6b0]
cmp ecx, 0xffffffff
je 0x14005b603
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
jmp 0x14005b605
xor eax, eax
add rsp, 0x28
ret
Function at 0x14005b610
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, rdx
mov r15, rcx
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, dword [0x1401ac6b0]
cmp ecx, 0xffffffff
je 0x14005b645
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14005b64a
call fcn.14005b860
mov eax, dword [0x1401b10b8]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005b816
mov rbx, qword [0x1401b10b0]
mov rcx, rbx
call fcn.140040a20
mov rcx, qword [0x1401af8a8]
add rcx, 1
mov edx, 0x100
lea rax, [0x1401af8b0]
nop word cs:[rax + rax]
nop
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14005b6ca
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14005b6ca
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x14005b6a0
jmp 0x14005b6ef
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1401af8a8], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
movabs r14, 0xaaaaaaaaaaaaaaaa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsp + 0x30], r14
mov edi, dword [r15]
cmp edi, 0xffffffff
je 0x14005b71a
mov qword [rsp + 0x30], 0
jmp 0x14005b782
mov ecx, 0xffffffff
call fcn.140025040
mov rdi, rax
mov ecx, 0xffffffff
call fcn.140025040
lea rdx, str.slot____kInvalidSlotValue
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rdi
call fcn.1400254a0
cmp qword [rsp + 0x30], 0
je 0x14005b77f
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rdi, [rsp + 0x28]
lea r9, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x197
call fcn.140024f10
mov rcx, rdi
call fcn.140024ee0
mov rcx, rdi
call fcn.140024ef0
mov edi, dword [r15]
mov qword [rsp + 0x30], r14
cmp edi, 0xff
jg 0x14005b79a
mov qword [rsp + 0x30], 0
jmp 0x14005b7fc
mov ecx, 0x100
call fcn.140025040
mov rsi, rax
mov ecx, edi
call fcn.140025040
lea rdx, str.slot____kThreadLocalStorageSize
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rsi
call fcn.1400254a0
cmp qword [rsp + 0x30], 0
je 0x14005b7fc
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x198
call fcn.140024f10
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012cde0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1401b10b8]
call fcn.14012cb70
cmp dword [0x1401b10b8], 0xffffffff
jne 0x14005b66f
mov ecx, 8
call fcn.14012c988
mov rbx, rax
mov rcx, rax
call fcn.14003ad30
mov qword [0x1401b10b0], rbx
lea rcx, [0x1401b10b8]
call fcn.14012cc08
jmp 0x14005b66f
Function at 0x14005b860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14012cd70
sub rsp, rax
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1401ac6b0]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x14005b95a
lea rcx, [rsp + 0x2c]
call fcn.140097c20
test al, al
jne 0x14005b8db
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea r9, str.PlatformThreadLocalStorage::AllocTLS_key_
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xd1
call fcn.140024e50
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x14005b938
lea rcx, [rsp + 0x2c]
call fcn.140097c20
test al, al
je 0x14005b8f9
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x14005b92a
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea r9, str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xdb
call fcn.140024e50
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x1401ac6b0], ecx
mov ecx, dword [rsp + 0x2c]
je 0x14005b95a
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401ac6b0]
mov dword [rsp + 0x2c], ecx
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
and esi, 3
je 0x14005b9d8
xor ecx, ecx
call fcn.140025040
mov rdi, rax
mov ecx, esi
call fcn.140025040
lea rdx, str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
lea rcx, [rsp + 0x30]
mov r8, rax
mov r9, rdi
call fcn.1400254a0
cmp qword [rsp + 0x30], 0
je 0x14005b9e1
lea rdx, str..._.._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x20]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xed
call fcn.140024f10
mov rcx, rsi
call fcn.140024ee0
mov rcx, rsi
call fcn.140024ef0
jmp 0x14005b9e1
mov qword [rsp + 0x30], 0
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14012fcf0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14012c9fc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14012f890
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14012cde0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret

Function at 0x14005bb20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401ac6b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005bb50
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14005bb50
mov rax, qword [rax + rcx]
jmp 0x14005bb52
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14005bb60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401ac6b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14005bb88
test rdi, rdi
je 0x14005bba1
call fcn.14005b860
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140064070
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.MapImageToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1b
call fcn.14002c260
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.14003a130
mov rcx, rsi
call fcn.14003f5b0
test al, al
je 0x14006418e
lea rbx, [rsi + 0x40]
mov rcx, rsi
call fcn.14003f5c0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rbx
mov rdx, rax
call fcn.140005bca
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14006418e
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x14006418e
lea rcx, [0x140169e28]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.14009ad76
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.14003a270
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14012cde0
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140066390
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, dword [0x1401b11c0]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400663f0
lea rsi, [0x1401b11b8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14012cde0
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x1401b11c0]
call fcn.14012cb70
cmp dword [0x1401b11c0], 0xffffffff
jne 0x1400663cc
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call fcn.14012fcf0
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14012c988
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x1401b11f8]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400664b1
lea r8, [0x1401b11c8]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov r9d, edi
call fcn.140066660
mov qword [0x1401b11b8], rsi
lea rcx, [0x1401b11c0]
call fcn.14012cc08
jmp 0x1400663cc
lea rcx, [0x1401b11f8]
call fcn.14012cb70
cmp dword [0x1401b11f8], 0xffffffff
jne 0x140066482
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x1401b11e8], xmm2
movups xmmword [0x1401b11d8], xmm1
movups xmmword [0x1401b11c8], xmm0
lea rcx, [0x1401b11f8]
call fcn.14012cc08
jmp 0x140066482

Function at 0x140066540
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401b11f8]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400665c3
movzx eax, word [0x1401b11c8]
cmp rax, 0xc
ja case.0x140066592.1
xor esi, esi
lea rcx, [0x14006662c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov esi, 2
jmp case.0x140066592.0
mov esi, 4
jmp case.0x140066592.0
mov esi, 1
jmp case.0x140066592.0
mov esi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012cde0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401b11f8]
call fcn.14012cb70
cmp dword [0x1401b11f8], 0xffffffff
jne 0x140066575
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [0x1401b11e8], xmm2
movups xmmword [0x1401b11d8], xmm1
movups xmmword [0x1401b11c8], xmm0
lea rcx, [0x1401b11f8]
call fcn.14012cc08
jmp 0x140066575
Function at 0x14008e6c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401b1320]
cmp rsi, 1
ja 0x14008e720
lea rcx, [0x1401b1320]
call fcn.14002bee0
test al, al
je 0x14008e719
mov qword [0x1401b1328], 0
lea rdi, [0x1401b1320]
lea rsi, [0x1401b1328]
mov rcx, rsi
xor edx, edx
call fcn.14005bbb0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14002bf90
jmp 0x14008e720
mov rsi, qword [0x1401b1320]
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14005bb60

Function at 0x140097c20
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140097c39
mov dword [rsi], eax
mov al, 1
jmp 0x140097c3b
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14009ae84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test r8, r8
je 0x14009af9d
mov rdi, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x14009af9d
cmp word [rax + rcx + 0x14], 0x78
jb 0x14009af9d
mov r14, r8
mov r12, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test rax, rax
je 0x14009af9d
cmp r12, 0xffff
ja 0x14009aef3
mov word [r14], r12w
jmp 0x14009afd6
mov rsi, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov edx, dword [rsi + 0x18]
lea rcx, [rdx*4]
test rcx, rcx
je 0x14009af9d
mov qword [rsp + 0x30], rsi
lea rbx, [rax + rdx*4]
lea r13, [r12 + 1]
mov qword [rsp + 0x28], rax
mov rbp, rax
mov rax, rbx
sub rax, rbp
mov rcx, rax
sar rcx, 2
shr rax, 0x3f
add rax, rcx
and rax, 0xfffffffffffffffe
lea r15, [rax*2]
add r15, rbp
mov edx, dword [r15]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov cl, byte [r12]
test cl, cl
je 0x14009af76
mov rdx, r13
cmp cl, byte [rax]
jne 0x14009af78
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14009af66
xor ecx, ecx
movzx ecx, cl
movzx eax, byte [rax]
mov edx, ecx
sub edx, eax
lea rsi, [r15 + 4]
test edx, edx
cmovg rbp, rsi
cmp ecx, eax
cmovs rbx, r15
je 0x14009afb0
xor eax, eax
cmp rbp, rbx
jne 0x14009af2c
jmp 0x14009af9f
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x30]
mov edx, dword [rsi + 0x24]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
sub r15, qword [rsp + 0x28]
sar r15, 1
movzx eax, word [rax + r15]
add ax, word [rsi + 0x10]
mov word [r14], ax
mov al, 1
jmp 0x14009af9f

Function at 0x14009b402
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14009b439
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14009b439
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x14009b439
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x14009b9a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401b1a40]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009b9d5
lea rcx, [0x1401b1a38]
add rsp, 0x28
jmp fcn.14005bb20
lea rcx, [0x1401b1a40]
call fcn.14012cb70
cmp dword [0x1401b1a40], 0xffffffff
jne 0x14009b9c5
mov qword [0x1401b1a38], 0
lea rcx, [0x1401b1a38]
xor edx, edx
call fcn.14005bbb0
lea rcx, [0x1401b1a40]
call fcn.14012cc08
jmp 0x14009b9c5

Function at 0x14009c9e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x88]
mov byte [rsi + 0xdd9], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x50]
test rax, rax
je 0x14009ca44
mov eax, dword [0x1401b1a40]
mov ecx, dword [0x1401af720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009ca4b
lea rcx, [0x1401b1a38]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14005bb60
nop
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401b1a40]
call fcn.14012cb70
cmp dword [0x1401b1a40], 0xffffffff
jne 0x14009ca30
mov qword [0x1401b1a38], 0
lea rcx, [0x1401b1a38]
xor edx, edx
call fcn.14005bbb0
lea rcx, [0x1401b1a40]
call fcn.14012cc08
jmp 0x14009ca30