joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ba0e3
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
xor esi, esi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400ba142
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400ba169
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdx, str.NaClHostDescTruncate:_could_not_truncate_file:_last_error__d._n
mov ecx, 0xfffffffd
mov r8d, eax
call fcn.1400b8218
cmp esi, 0x4c8
jne 0x1400ba15e
lea rdx, str.NaClHostDescTruncate:_this_is_due_to_an_existing_mapping_of_the_same_file._n
mov ecx, 0xfffffffd
call fcn.1400b8218
jmp 0x1400ba15e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdx, str.NaClHostDescTruncate:_SetFilePointerEx_failed:_last_error__d._n
mov ecx, 0xfffffffd
mov r8d, eax
call fcn.1400b8218
mov ecx, esi
call fcn.1400bb35c
mov esi, eax
neg esi
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400ba928
Capabilities:
Create thread
Resume thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov rcx, r9
shr rcx, 0x20
je 0x1400ba957
call fcn.140195058
mov r8d, dword [rax]
lea rdx, str.NaClThreadCtor:__beginthreadex_failed__stack_request_out_of_range_n
mov ecx, 0xfffffffd
call fcn.1400b8218
xor esi, esi
jmp 0x1400ba9ae
mov rax, r8
mov r8, rdx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
xor esi, esi
xor ecx, ecx
mov edx, r9d
mov r9, rax
call fcn.14019162c
test rax, rax
je 0x1400ba995
mov qword [rdi], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, 1
jmp 0x1400ba9ae
call fcn.140195058
mov r8d, dword [rax]
lea rdx, str.NaClThreadCtor:__beginthreadex_failed__errno__d_n
mov ecx, 0xfffffffd
call fcn.1400b8218
mov eax, esi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400babf1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.Entered_NaClCalibrateWindowsClockQpc_n
mov ecx, 5
call fcn.1400b8218
lea rdi, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rdi]
mov esi, dword [rdi + 4]
mov rax, rsi
shl rax, 0x20
or rax, rbx
movabs rcx, 0x346dc5d63886594b
mul rcx
mov r15, rdx
shr r15, 0xb
add r15, 0x3e8
mov r14, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea r12, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call r14
xor ebp, ebp
test eax, eax
je 0x1400bad51
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, r12
call r14
test eax, eax
je 0x1400bad51
mov r8, qword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov rdi, r8
sub rdi, r9
imul rax, rdi, 0x3e8
cqo
idiv qword [r13 + 0x48]
mov r10, rax
mov edx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov ecx, eax
xor ecx, esi
mov ebp, edx
xor ebp, ebx
or ebp, ecx
setne cl
test rdi, rdi
js 0x1400bacd7
cmp r10, 4
jg 0x1400bacd7
test cl, cl
jne 0x1400bad04
test cl, cl
cmovne ebx, edx
cmovne esi, eax
shl rax, 0x20
or rax, rdx
movabs rcx, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
cmp rdx, r15
jb 0x1400bac68
xor ebp, ebp
jmp 0x1400bad21
shl rax, 0x20
or rax, rdx
movabs rcx, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
mov ebp, 1
mov qword [r13 + 0x28], rdx
mov rax, rdi
shr rax, 0x3f
add rax, rdi
sar rax, 1
add rax, r9
mov qword [r13 + 0x50], rax
mov qword [r13 + 0x58], r8
lea rdx, str.Leaving_NaClCalibrateWindowsClockQpc_:__d_n
mov ecx, 5
mov r8d, ebp
call fcn.1400b8218
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140183a80
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400bf636
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, qword [0x140348810]
test rbx, rbx
je 0x1400bf67a
mov r14, rcx
mov rdi, qword [0x140348818]
xor esi, esi
mov rdx, qword [rdi]
mov rcx, r14
call fcn.1401a6490
test eax, eax
je 0x1400bf681
inc rsi
add rdi, 0x28
cmp rsi, rbx
jb 0x1400bf65d
jmp 0x1400bf69c
xor edi, edi
jmp 0x1400bf879
lea rdx, str.NaClFaultInject:_found__s_n
mov ecx, 6
mov r8, r14
call fcn.1400b8218
mov rbx, qword [0x140348810]
xor edi, edi
cmp rsi, rbx
je 0x1400bf879
mov r15, qword [0x140348818]
lea r12, [rsi + rsi*4]
cmp dword [r15 + r12*8 + 8], 0
je 0x1400bf799
lea rdx, str.NaClFaultInject:_thread_specific_counter_n
mov ecx, 6
call fcn.1400b8218
cmp qword [0x140348810], rsi
ja 0x1400bf702
lea rax, str.counter_ix___gNaClNumFaultInjectInfo
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0x168
call fcn.1400b8218
cmp dword [0x140348808], 0
je 0x1400bf879
mov ecx, dword [0x140348824]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1400bf7c4
mov r14, qword [0x140348810]
mov rcx, r14
shl rcx, 4
call fcn.140095b30
mov rbx, rax
test rax, rax
jne 0x1400bf773
lea rax, str.NULL___counters
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0x177
call fcn.1400b8218
mov r14, qword [0x140348810]
test r14, r14
je 0x1400bf789
shl r14, 4
mov rcx, rbx
xor edx, edx
mov r8, r14
call fcn.1401867a0
mov ecx, dword [0x140348824]
mov rdx, rbx
call fcn.1400bf988
jmp 0x1400bf7c4
lea rdx, str.NaClFaultInject:_global_counter_n
mov ecx, 6
call fcn.1400b8218
mov rcx, rsi
shl rcx, 4
add rcx, qword [0x140348800]
call fcn.1400b82d8
mov rbx, qword [0x1403487f8]
test rbx, rbx
je 0x1400bf879
lea r14, [r15 + r12*8]
add r14, 8
shl rsi, 4
mov r8, qword [rbx + rsi]
mov r9, qword [rbx + rsi + 8]
lea rdx, str.NaClFaultInject:_counter__I64x__I64x__n
mov ecx, 6
call fcn.1400b8218
mov rax, qword [rbx + rsi]
xor edi, edi
cmp rax, qword [r14 + 0x10]
jae 0x1400bf864
lea r13, [rbx + rsi]
add r13, 8
mov r15, qword [r15 + r12*8 + 0x10]
lea r12, [rax + rax*2]
xor edi, edi
cmp dword [r15 + r12*8], 0
jne 0x1400bf844
mov r8, qword [r15 + r12*8 + 8]
lea rdx, str.NaClFaultInject:_should_fail__value__I64x_n
mov ecx, 6
call fcn.1400b8218
mov rdx, qword [r15 + r12*8 + 8]
mov ecx, dword [0x140348828]
call fcn.1400bf988
mov edi, 1
mov rax, qword [r13]
inc rax
mov qword [r13], rax
cmp rax, qword [r15 + r12*8 + 0x10]
jb 0x1400bf864
add rbx, rsi
mov qword [r13], 0
inc qword [rbx]
cmp dword [r14], 0
jne 0x1400bf879
add rsi, qword [0x140348800]
mov rcx, rsi
call fcn.1400b82ff
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400bf88b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x140348808], 0
je 0x1400bf8a6
mov ecx, dword [0x140348828]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x1400bf8a8
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400bf988
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x140348808], 0
je 0x1400bf9c9
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400bf9c9
lea rax, str.status
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0xf6
call fcn.1400b8218
nop
add rsp, 0x28
ret

Function at 0x1400c0564
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rsp + 0x5c]
xor esi, esi
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1401867a0
mov dword [rdi - 4], 0x114
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400c05dd
cmp dword [rsp + 0x5c], 5
jb 0x1400c05dd
jne 0x1400c05bc
cmp dword [rsp + 0x60], 0
je 0x1400c05dd
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rdi]
cmp ax, 9
je 0x1400c05d8
test ax, ax
jne 0x1400c05dd
mov esi, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140183a80
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x1400c0fbb
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140348838]
test rcx, rcx
jne 0x1400c0ffc
lea rax, str.g_socket_binding___NULL
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_debug_stub_nacl_debug.cc
mov ecx, 0xfffffffc
mov r9d, 0x97
call fcn.1400b8218
mov rcx, qword [0x140348838]
add rsp, 0x28
jmp fcn.14011890e

Function at 0x1400c1518
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140348848]
test rax, rax
je 0x1400c152d
add rsp, 0x28
ret
lea rcx, [0x140348850]
call fcn.1400253d6
mov rcx, rax
add rsp, 0x28
jmp fcn.140081650

Function at 0x1400c41f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140348a08]
mov ecx, dword [0x1403488a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1400c4225
lea rcx, [0x140348a00]
add rsp, 0x28
jmp fcn.140081650
lea rcx, [0x140348a08]
call fcn.140183810
cmp dword [0x140348a08], 0xffffffff
jne 0x1400c4215
mov qword [0x140348a00], 0
lea rcx, [0x140348a00]
xor edx, edx
call fcn.1400816e0
lea rcx, [0x140348a08]
call fcn.1401838a8
jmp 0x1400c4215
Function at 0x1400c5420
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x88]
mov byte [rsi + 0xdd9], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x50]
test rax, rax
je 0x1400c5484
mov eax, dword [0x140348a08]
mov ecx, dword [0x1403488a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1400c548b
lea rcx, [0x140348a00]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140081690
nop
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140348a08]
call fcn.140183810
cmp dword [0x140348a08], 0xffffffff
jne 0x1400c5470
mov qword [0x140348a00], 0
lea rcx, [0x140348a00]
xor edx, edx
call fcn.1400816e0
lea rcx, [0x140348a08]
call fcn.1401838a8
jmp 0x1400c5470

Function at 0x1400c6740
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rdi, rcx
mov rcx, r8
call fcn.1401215d0
test al, al
je 0x1400c68c3
movsd xmm0, qword [rdi + 0x50]
mov r9b, 1
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x1400c68e3
movsd xmm0, qword [rdi + 0xad0]
subsd xmm0, qword [rdi + 0xac8]
mov rcx, qword [rdi + 0xac0]
lea rax, [rcx + 1]
shr rax, 3
movabs r10, 0xd20d20d20d20d21
mul r10
shr rdx, 1
imul rax, rdx, 0x138
neg rax
lea r8, [rcx + rax]
add r8, 1
mov rax, 0xffffffff80000000
and rax, qword [rdi + rcx*8 + 0x100]
mov rbx, qword [rdi + r8*8 + 0x100]
mov esi, ebx
and esi, 0x7ffffffe
or rsi, rax
lea rax, [rcx + 0x9c]
shr rax, 3
mul r10
shr rdx, 1
imul rax, rdx, 0x138
neg rax
add rax, rcx
add rax, 0x9c
and ebx, 1
movabs rdx, 0xb5026f5aa96619e9
imul rdx, rbx
xor rdx, qword [rdi + rax*8 + 0x100]
shr rsi, 1
xor rdx, rsi
mov qword [rdi + rcx*8 + 0x100], rdx
mov rax, qword [rdi + 0xac0]
mov rax, qword [rdi + rax*8 + 0x100]
mov rcx, rax
shr rcx, 0x1d
movabs rdx, 0x555555555
and rdx, rcx
xor rdx, rax
mov qword [rdi + 0xac0], r8
mov rax, rdx
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rcx, rax
xor rcx, rdx
mov eax, ecx
and eax, 0x7ffbf77
shl rax, 0x25
xor rax, rcx
mov rcx, rax
shr rcx, 0x2b
xor rcx, rax
movq xmm1, rcx
punpckldq xmm1, xmmword [0x1401bb3e0]
subpd xmm1, xmmword [0x1401bb3f0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
mulsd xmm2, qword [0x1401d3430]
mulsd xmm2, xmm0
addsd xmm2, qword [rdi + 0xac8]
movsd xmm0, qword [rdi + 0x50]
ucomisd xmm0, xmm2
seta r8b
jmp 0x1400c68e6
cmp dword [rdi + 0x80], 0
jne 0x1400c68e0
mov rax, qword [rdi + 0xd30]
cmp rax, qword [rdi + 0xd38]
jne 0x1400c675f
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov edx, r9d
call fcn.140123d90
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400cb670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x1400cb6eb
mov r9d, r8d
and r9d, 1
cmp r8, 1
jne 0x1400cb689
xor ecx, ecx
jmp 0x1400cb6ce
sub r8, r9
xor ecx, ecx
lea r10, [0x1401d39d0]
nop word cs:[rax + rax]
nop
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r8, rcx
jne 0x1400cb6a0
test r9, r9
je 0x1400cb6eb
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x1401d39d0]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret
Function at 0x1400d4100
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140348ac0]
mov ecx, dword [0x1403488a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1400d413d
lea rcx, [0x140348ab8]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140081690
lea rcx, [0x140348ac0]
call fcn.140183810
cmp dword [0x140348ac0], 0xffffffff
jne 0x1400d4129
mov qword [0x140348ab8], 0
lea rcx, [0x140348ab8]
xor edx, edx
call fcn.1400816e0
lea rcx, [0x140348ac0]
call fcn.1401838a8
jmp 0x1400d4129

Function at 0x1400d4180
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140348ac0]
mov ecx, dword [0x1403488a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1400d41b5
lea rcx, [0x140348ab8]
add rsp, 0x28
jmp fcn.140081650
lea rcx, [0x140348ac0]
call fcn.140183810
cmp dword [0x140348ac0], 0xffffffff
jne 0x1400d41a5
mov qword [0x140348ab8], 0
lea rcx, [0x140348ab8]
xor edx, edx
call fcn.1400816e0
lea rcx, [0x140348ac0]
call fcn.1401838a8
jmp 0x1400d41a5

Function at 0x1400d45f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400d4609
mov dword [rsi], eax
mov al, 1
jmp 0x1400d460b
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1400dfa64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test r8, r8
je 0x1400dfb7d
mov rdi, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x1400dfb7d
cmp word [rax + rcx + 0x14], 0x78
jb 0x1400dfb7d
mov r14, r8
mov r12, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
test rax, rax
je 0x1400dfb7d
cmp r12, 0xffff
ja 0x1400dfad3
mov word [r14], r12w
jmp 0x1400dfbb6
mov rsi, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov edx, dword [rsi + 0x18]
lea rcx, [rdx*4]
test rcx, rcx
je 0x1400dfb7d
mov qword [rsp + 0x30], rsi
lea rbx, [rax + rdx*4]
lea r13, [r12 + 1]
mov qword [rsp + 0x28], rax
mov rbp, rax
mov rax, rbx
sub rax, rbp
mov rcx, rax
sar rcx, 2
shr rax, 0x3f
add rax, rcx
and rax, 0xfffffffffffffffe
lea r15, [rax*2]
add r15, rbp
mov edx, dword [r15]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov cl, byte [r12]
test cl, cl
je 0x1400dfb56
mov rdx, r13
cmp cl, byte [rax]
jne 0x1400dfb58
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400dfb46
xor ecx, ecx
movzx ecx, cl
movzx eax, byte [rax]
mov edx, ecx
sub edx, eax
lea rsi, [r15 + 4]
test edx, edx
cmovg rbp, rsi
cmp ecx, eax
cmovs rbx, r15
je 0x1400dfb90
xor eax, eax
cmp rbp, rbx
jne 0x1400dfb0c
jmp 0x1400dfb7f
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x30]
mov edx, dword [rsi + 0x24]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
sub r15, qword [rsp + 0x28]
sar r15, 1
movzx eax, word [rax + r15]
add ax, word [rsi + 0x10]
mov word [r14], ax
mov al, 1
jmp 0x1400dfb7f

Function at 0x1400dfc5e
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400dfc95
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400dfc95
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x1400dfc95
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x1400e2161
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x1400e2195
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400e21c4
bt ebx, 8
jae 0x1400e21a9
mov eax, ebx
and eax, 0x200
jne 0x1400e21c4
cmp edi, 2
lea rax, [0x140348e40]
lea rcx, [0x140349040]
cmove rcx, rax
cmp word [rcx], 0
je 0x1400e21e3
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140183a80
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400e21c4
cmp byte [0x140348e30], 0
setne al
bt ebx, 8
jb 0x1400e21c4
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400e21c4
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
js 0x1400e2244
mov rdi, r12
jmp 0x1400e224d
mov rdi, qword [r12]
mov rbp, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rbx, qword [rsi + 8]
mov r13, rbp
sub r13, rbx
jb 0x1400e228a
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.14019ceb0
test eax, eax
je 0x1400e2298
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x1400e226c
jmp 0x1400e230a
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x1400e22a7
test dx, dx
jne 0x1400e228a
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x1400e22d5
cmp ebp, 2
jne 0x1400e22cb
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x1400e22d5
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x1400e22ed
dec r13
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x1400e22df
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x1400e2291
cmp dword [rsp + 0x2c], 0
je 0x1400e21c4
cmp byte [r12 + 0x17], 0
js 0x1400e2322
mov rax, r12
jmp 0x1400e2326
mov rax, qword [r12]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.1400663e4
jmp 0x1400e21c4
Function at 0x1400e48f0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14007e7c0
cmp byte [rsp + 0x67], 0
jns 0x1400e4935
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
cmp byte [rsp + 0x67], 0
js 0x1400e49de
test ebp, ebp
je 0x1400e49f0
mov r14b, 1
test rsi, rsi
je 0x1400e4a57
mov ecx, ebp
add rcx, rcx
call fcn.14018369c
mov rbx, rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14007e7c0
cmp byte [rsp + 0x67], 0
jns 0x1400e4997
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x67], 0
jns 0x1400e49b7
mov rcx, qword [rsp + 0x50]
call fcn.140183668
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x1400e49f5
xor eax, eax
nop word cs:[rax + rax]
nop
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400e49d0
jmp 0x1400e49f7
mov rcx, qword [rsp + 0x50]
call fcn.140183668
test ebp, ebp
jne 0x1400e4958
xor r14d, r14d
jmp 0x1400e4a57
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x20]
call fcn.14007ef90
cmp byte [rsi + 0x17], 0
js 0x1400e4a1a
mov byte [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x1400e4a3e
mov rax, qword [rsi]
mov byte [rax], 0
mov qword [rsi + 8], 0
cmp byte [rsi + 0x17], 0
jns 0x1400e4a3e
mov rcx, qword [rsi]
call fcn.140183668
mov qword [rsi + 0x10], 0
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1401836a4
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140183a80
mov eax, r14d
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400e7083
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x1403494a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400e70b2
Capabilities:
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov ebp, ecx
lea rcx, [0x140349498]
lea rdx, [0x1400e7060]
call fcn.1400e6f08
cmp dword [0x1403494a0], 0
je 0x1400e70e9
mov rcx, rsi
call rdi
xor eax, eax
jmp 0x1400e7126
call fcn.1400e7083
mov rbx, rax
test rax, rax
je 0x1400e7131
lea r14, [0x1403494a8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbp, ebp
lea rax, [0x1403494b0]
mov qword [rax + rbp*8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rbx + rbp*8], rsi
mov eax, 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x18
call fcn.14009c6a0
test rax, rax
je 0x1400e70e0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov ecx, dword [0x1403494a4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400e70f6
mov rcx, rbx
call fcn.14009c6c7
jmp 0x1400e70e0

Function at 0x1400e74a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e74c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x1400e7500
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e7520
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x1400e7560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e7583
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret