joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004020
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov r12, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x140004079
cmp byte [r12 + rbx - 1], 0xa
je 0x140004054
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
xchg dword [0x14001a3a0], eax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, 1
mov r9, rax
mov r8, rbx
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x20
pop rbx
pop r12
pop rbp
ret

Function at 0x1400043e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r13
push r12
sub rsp, 0x40
lea rbp, [rsp + 0x40]
lea rax, [rbp - 8]
mov dword [r8], 0
mov r13, rdx
lea r9, [rbp - 4]
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov dword [rbp - 8], 4
mov qword [rsp + 0x28], rax
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r12d, eax
test eax, eax
je 0x140004480
cmp eax, 2
je 0x1400044a8
test byte [0x14001a040], 2
jne 0x140004440
mov eax, r12d
add rsp, 0x40
pop r12
pop r13
pop rbp
ret
mov rcx, r13
call sym.wine_dbgstr_wn.constprop.0_2
mov dword [rsp + 0x20], r12d
lea r9, str.Error__ld_while_reading_value__s_n
lea r8, str.load_reg_dword
mov qword [rsp + 0x28], rax
lea rdx, [0x14001a040]
mov ecx, 1
call sym.wine_dbg_log.constprop.0_2
mov eax, r12d
add rsp, 0x40
pop r12
pop r13
pop rbp
ret
mov eax, dword [rbp - 4]
sub eax, 3
cmp eax, 1
ja 0x140004491
cmp dword [rbp - 8], 4
je 0x140004433
mov r12d, 0x70c
test byte [0x14001a040], 2
je 0x140004433
jmp 0x140004440
xor r12d, r12d
mov eax, r12d
add rsp, 0x40
pop r12
pop r13
pop rbp
ret
Function at 0x1400044c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rdi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov qword [r9], 0
mov rbx, r9
mov r15, rcx
mov r13, rdx
lea r9, [rbp - 4]
lea r14, [rbp - 8]
mov esi, r8d
xor r8d, r8d
mov qword [rbp - 0x18], r9
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
call rdi
mov r9, qword [rbp - 0x18]
test eax, eax
mov r12d, eax
je 0x140004588
xor esi, esi
cmp eax, 2
je 0x140004610
test byte [0x14001a040], 2
jne 0x140004550
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_free]
mov eax, r12d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, r13
call sym.wine_dbgstr_wn.constprop.0_2
mov dword [rsp + 0x20], r12d
lea r9, str.Error__ld_while_reading_value__s_n
lea r8, str.load_reg_multisz
mov qword [rsp + 0x28], rax
lea rdx, [0x14001a040]
mov ecx, 1
call sym.wine_dbg_log.constprop.0_2
jmp 0x14000452d
mov eax, dword [rbp - 4]
cmp eax, 7
je 0x1400045b0
test esi, esi
je 0x140004599
cmp eax, 1
je 0x1400045b0
mov r12d, 0x70c
xor esi, esi
test byte [0x14001a040], 2
je 0x14000452d
jmp 0x140004550
mov ecx, dword [rbp - 8]
mov qword [rbp - 0x18], r9
add rcx, 4
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x18]
mov rsi, rax
mov rcx, r15
mov qword [rbp - 0x20], rax
call rdi
mov r12d, eax
test eax, eax
jne 0x140004524
mov eax, dword [rbp - 8]
mov r10, qword [rbp - 0x20]
xor ecx, ecx
xor r8d, r8d
shr eax, 1
mov qword [rbx], r10
mov edx, eax
inc eax
mov word [r10 + rdx*2], cx
mov word [r10 + rax*2], r8w
jmp 0x140004536
mov edx, 2
mov ecx, 1
xor r12d, r12d
call qword [sym.imp.ucrtbase.dll_calloc]
mov qword [rbx], rax
jmp 0x140004536
Function at 0x140004630
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rdi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov qword [r9], 0
mov rbx, r9
mov r14, rcx
mov r13, rdx
lea r9, [rbp - 4]
lea r15, [rbp - 8]
mov esi, r8d
xor r8d, r8d
mov qword [rbp - 0x18], r9
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
call rdi
mov r9, qword [rbp - 0x18]
test eax, eax
mov r12d, eax
je 0x1400046c0
cmp eax, 2
je 0x140004770
xor esi, esi
test byte [0x14001a040], 2
jne 0x1400046e0
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_free]
mov eax, r12d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp - 4]
cmp eax, 1
je 0x140004718
cmp eax, 2
jne 0x1400046d1
test esi, esi
jne 0x140004718
mov r12d, 0x70c
jmp 0x140004692
mov rcx, r13
call sym.wine_dbgstr_wn.constprop.0_2
mov dword [rsp + 0x20], r12d
lea r9, str.Error__ld_while_reading_value__s_n
lea r8, str.load_reg_string
mov qword [rsp + 0x28], rax
lea rdx, [0x14001a040]
mov ecx, 1
call sym.wine_dbg_log.constprop.0_2
jmp 0x14000469d
mov ecx, dword [rbp - 8]
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
mov qword [rbp - 0x18], r9
add rcx, 2
mov qword [rbp - 0x20], rax
call rax
mov qword [rsp + 0x28], r15
mov r9, qword [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rsi, rax
mov rdx, r13
mov rcx, r14
call rdi
mov r12d, eax
test eax, eax
jne 0x140004694
mov eax, dword [rbp - 8]
xor edx, edx
shr eax, 1
cmp dword [rbp - 4], 2
mov word [rsi + rax*2], dx
je 0x140004780
mov qword [rbx], rsi
jmp 0x1400046a6
xor r12d, r12d
jmp 0x1400046a6
mov r14, qword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call r14
mov dword [rbp - 8], eax
mov edi, eax
test eax, eax
jne 0x1400047b0
mov rax, qword gs:[0x30]
mov r12d, dword [rax + 0x68]
jmp 0x140004694
mov ecx, eax
mov rax, qword [rbp - 0x20]
add rcx, rcx
call rax
mov r8d, edi
mov rcx, rsi
mov r13, rax
mov rdx, rax
call r14
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_free]
mov qword [rbx], r13
jmp 0x1400046a6

Function at 0x1400047e0
Capabilities:
Terminate process

Disassembly:
push rbp
push r13
push r12
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, 1
call sym._configure_narrow_argv
call sym._initialize_narrow_environment
call sym.__p___argc
mov r12d, dword [rax]
call sym.__p___argv
mov r13, qword [rax]
call sym._get_initial_narrow_environment
xor ecx, ecx
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
cmp word [rax + rdx + 0x5c], 2
sete cl
inc ecx
call sym._set_app_type
mov ecx, r12d
mov r8, rbx
mov rdx, r13
call sym.main
mov ecx, eax
call sym.exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140005980
Capabilities:
Terminate process

Disassembly:
push rbp
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, qword [rcx + 0x10]
lea r12, [rdi + 0x30]
add rdi, 0x20
mov rsi, rcx
mov rcx, r12
call qword [sym.imp.kernel32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x28]
xor edx, edx
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rbx, qword [rdi]
cmp rdi, rbx
jne 0x1400059c8
jmp 0x1400059f6
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x1400059f6
cmp qword [rbx + 0xb0], rsi
jne 0x1400059c0
mov dword [rbx + 0x2c], 1
mov rcx, rsi
mov qword [rbx + 0xb0], 0
dec dword [rsi + 0x1c]
call sym.release_process
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400059c8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
jmp qword [sym.imp.kernel32.dll_LeaveCriticalSection]

Function at 0x140005a10
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r10, rdx
test r8, r8
je 0x140005a7d
cmp word [r8], 0
mov rdx, r8
mov eax, 2
je 0x140005a5c
nop
mov rax, rdx
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140005a38
sub rax, rdx
sar rax, 1
inc eax
cdqe
lea rdx, [rdx + rax*2]
cmp word [rdx], 0
jne 0x140005a30
sub rdx, r8
lea eax, [rdx + 2]
mov qword [rsp + 0x20], r8
mov r9d, 7
xor r8d, r8d
mov rdx, r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
mov edx, 0
cmp eax, 2
cmove eax, edx
add rsp, 0x30
pop rbp
ret

Function at 0x140005aa0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
test r8, r8
je 0x140005af8
cmp word [r8], 0
mov rax, r8
je 0x140005b10
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140005ac0
sub rax, r8
sar rax, 1
lea eax, [rax + rax + 2]
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
mov edx, 0
cmp eax, 2
cmove eax, edx
add rsp, 0x30
pop rbp
ret
mov eax, 2
jmp 0x140005ad4

Function at 0x140005bc0
Capabilities:
Delete registry key

Disassembly:
push rbp
push r13
push r12
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rbx, qword [rcx + 0x10]
lea r13, [rbx + 0x30]
mov r12, rcx
mov rcx, r13
call qword [sym.imp.kernel32.dll_EnterCriticalSection]
lock dec dword [r12 + 0x18]
jne 0x140005bf7
mov eax, dword [r12 + 0xc0]
test eax, eax
jne 0x140005c10
mov rcx, r13
add rsp, 0x28
pop rbx
pop r12
pop r13
pop rbp
jmp qword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov rdx, qword [r12 + 0x20]
mov rcx, qword [rbx]
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov rdx, qword [r12]
mov rax, qword [r12 + 8]
mov rcx, r12
mov qword [rdx + 8], rax
mov rdx, qword [r12]
mov qword [rax], rdx
mov qword [r12 + 8], 0
mov qword [r12], 0
call sym.free_service_entry
jmp 0x140005bf7
Function at 0x180009590
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x18
call fcn.180043d80
sub rsp, rax
mov rax, qword [0x1800d0050]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r11, rcx
mov r9d, edx
test edx, edx
jne 0x1800095cd
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1800431b0
add rsp, 0x18
ret
mov rcx, qword [r8]
xor edx, edx
mov qword [rsp], rcx
movzx eax, byte [rsp + 1]
movzx r8d, cl
xor r8d, 0x811c9dc5
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 2]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 4]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 6]
imul r8d, r8d, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul r8d, r8d, 0x1000193
xor r8d, eax
imul r8d, r8d, 0x1000193
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x180009675
cmp qword [rax + 8], rcx
je 0x180009675
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x180009664
test r10, r10
je 0x18000967d
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1800431b0
add rsp, 0x18
ret

Function at 0x18000cda0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x28
call fcn.180043d80
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x18000cde0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180043d80
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x18000ce00
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180043d80
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret
Function at 0x18000d310
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.180043d80
sub rsp, rax
xor ebx, ebx
mov rsi, rcx
mov ebp, ebx
test rcx, rcx
je 0x18000d3f7
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov r12d, eax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
lea ecx, [r12 + 1]
add rdx, rcx
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x18000d3fa
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp word [rbp + rcx*2], 0x5c
je 0x18000d3a4
mov ecx, eax
mov edx, 0x5c
inc eax
mov word [rbp + rcx*2], dx
or rcx, 0xffffffffffffffff
movsxd r8, eax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x18000d3f7
add r8, r8
mov rdx, rsi
sub r8, rsi
add r8, rbp
nop word [rax + rax]
movzx eax, word [rdx]
or rcx, 0xffffffffffffffff
inc ebx
mov word [r8 + rdx], ax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, ebx
add rdx, 2
not rcx
dec rcx
cmp rax, rcx
jb 0x18000d3d0
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x18000d5a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.180043d80
sub rsp, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x40
mov edx, eax
mov edi, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18000d60b
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18000d600
cmp edi, eax
jb 0x18000d600
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000faa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x30
call fcn.180043d80
sub rsp, rax
mov rdi, rcx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x18000fca2
mov rcx, rdi
call fcn.18000d4d0
test eax, eax
jne 0x18000fca2
mov rcx, rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
call fcn.18000f820
mov rbp, rax
test rax, rax
je 0x18000fbcd
mov qword [rsp + 0x50], r12
call fcn.18000d5a0
mov r12, rax
test rax, rax
je 0x18000fbba
mov rcx, rbp
call fcn.18000d4d0
test eax, eax
je 0x18000fba3
lea rax, str.system32_
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbp
call fcn.180055fd0
test eax, eax
je 0x18000fb76
lea rax, [rsp + 0x30]
add rbx, 8
cmp rbx, rax
jb 0x18000fb40
jmp 0x18000fb86
lea rdx, [rbp + rdi*2]
mov rcx, r12
call fcn.18000f4d0
mov rsi, rax
lea rax, [rsp + 0x30]
cmp rbx, rax
jne 0x18000fbb1
mov rcx, rbp
call fcn.18000d540
test eax, eax
je 0x18000fbb1
mov rsi, rbp
xor ebp, ebp
jmp 0x18000fbb1
mov rdx, rbp
mov rcx, r12
call fcn.18000f4d0
mov rsi, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x50]
jmp 0x18000fc6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18000fc77
mov rcx, rdi
call fcn.18000e720
mov rbx, rax
test rax, rax
je 0x18000fc77
mov ecx, 0x37e4
call fcn.18000e310
test eax, eax
je 0x18000fc0c
lea rcx, [0x1800a3af0]
call fcn.18000f200
jmp 0x18000fc11
call fcn.18000d5a0
mov rdi, rax
test rax, rax
je 0x18000fc65
mov rdx, rbx
mov rcx, rax
call fcn.18000f4d0
mov rsi, rax
test rax, rax
je 0x18000fc5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000fc3e
test al, 0x50
je 0x18000fc5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18000fc51
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x18000fc77
xor ecx, ecx
jmp 0x18000fc84
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18000fc8a
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x180010a00
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1800d0050]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.180010ac0
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.1800107b0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800431b0
add rsp, 0xb0
pop rbx
ret

Function at 0x18002ef80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test ecx, ecx
jle 0x18002f05d
push rbx
sub rsp, 0x40
movsxd rbx, ecx
cmp ebx, 0x64
jle 0x18002efea
imul rcx, rbx, 0xfffffffffffffff6
xor r8d, r8d
mov qword [rsp + 0x58], rcx
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x68]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movss xmm6, dword [0x1800998cc]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x58]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jl 0x18002f010
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
Function at 0x1800508b0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18005091f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18005091f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18005091f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18005091f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18005091f
cmp dword [rcx + 0x84], 0xe
jbe 0x18005091f
cmp dword [rcx + 0xf8], 0
je 0x18005091f
mov ecx, ebx
call fcn.1800509d0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800507ac
nop
cmp dword [rbp + 0x20], 0
je 0x18005096d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180050978
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800508b0

Function at 0x180050a6c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18005091f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18005091f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18005091f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18005091f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18005091f
cmp dword [rcx + 0x84], 0xe
jbe 0x18005091f
cmp dword [rcx + 0xf8], 0
je 0x18005091f
mov ecx, ebx
call fcn.1800509d0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800507ac
nop
cmp dword [rbp + 0x20], 0
je 0x18005096d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180050978
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800508b0
Function at 0x180055b44
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x180055b7b
call fcn.180057f40
mov dword [rax], 0x16
call fcn.18004a9b4
xor eax, eax
jmp 0x180055c09
mov rdx, r9
mov rcx, r8
call fcn.180055ae0
mov rbx, rax
test rax, rax
je 0x180055c06
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x180055a0c]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x180055bf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180057eb4
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180055bda
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180055be9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1800575a0
jmp 0x180055c06
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180055c03
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180060404
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18006041a
mov al, 1
jmp 0x18006047a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18006042b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180060478
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800552b8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180060478
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180060478
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180060478
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18006047a
xor al, al
add rsp, 0x20
pop rbx
ret