joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021940
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401de6c8]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x140021aaf
jp 0x140021aaf
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401de6d8]
mov ecx, dword [0x14022e720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140021ace
mov eax, dword [0x1401de6e8]
mov ecx, dword [0x14022e720]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140021b08
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x1401de6e0]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x1401664c0]
subpd xmm1, xmmword [0x1401664d0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x1401664e8]
ucomisd xmm1, xmm0
ja 0x140021aaf
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401de6d0]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x1401664c0]
subpd xmm1, xmmword [0x1401664d0]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401de6c8], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140128f20
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1401de6d8]
call fcn.1401295b8
cmp dword [0x1401de6d8], 0xffffffff
jne 0x1400219c1
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401de6d0], rdx
lea rcx, [0x1401de6d8]
call fcn.140129558
jmp 0x1400219c1
lea rcx, [0x1401de6e8]
call fcn.1401295b8
cmp dword [0x1401de6e8], 0xffffffff
jne 0x1400219e6
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1401de6e0], rax
lea rcx, [0x1401de6e8]
call fcn.140129558
jmp 0x1400219e6
Function at 0x140025660
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movzx eax, byte [rdx]
movabs rdi, 0xcbf29ce484222325
xor rdi, rax
movabs rsi, 0x100000001b3
imul rdi, rsi
movzx eax, byte [rdx + 1]
xor rax, rdi
imul rax, rsi
movzx edi, byte [rdx + 2]
xor rdi, rax
imul rdi, rsi
movzx eax, byte [rdx + 3]
xor rax, rdi
imul rax, rsi
and rax, qword [rcx + 0x30]
mov r8, qword [rcx + 8]
mov rsi, qword [rcx + 0x18]
mov rdi, rax
shl rdi, 4
mov r9, qword [rsi + rdi + 8]
cmp r9, r8
je 0x140025718
add rax, rax
lea r10, [rsi + rdi]
add r10, 8
lea r11, [rsi + rax*8]
mov rdi, qword [rsi + rax*8]
mov edx, dword [rdx]
cmp edx, dword [r9 + 0x10]
jne 0x1400256e8
cmp rdi, r9
je 0x140025721
mov r8, qword [r9 + 8]
jmp 0x140025724
xor eax, eax
mov rsi, r9
nop dword [rax]
cmp rsi, rdi
je 0x140025770
mov rsi, qword [rsi + 8]
cmp edx, dword [rsi + 0x10]
jne 0x1400256f0
test rsi, rsi
je 0x140025718
cmp r9, rsi
je 0x14002571c
cmp rdi, rsi
jne 0x14002572a
mov r8, qword [rdi]
mov r10, r11
mov r9, rdi
jmp 0x140025724
xor eax, eax
jmp 0x140025770
cmp rdi, rsi
jne 0x1400256e2
mov qword [r11], r8
mov qword [r10], r8
mov rsi, r9
mov rax, qword [rsi]
add qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, qword [rsi + 8]
mov qword [rcx], rax
mov rcx, qword [rsi + 8]
mov qword [rax + 8], rcx
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14002575e
lock sub dword [rcx + 8], 1
jne 0x14002575e
add rcx, 8
add rcx, 0xfffffffffffffff8
call fcn.14003db30
mov edx, 0x20
mov rcx, rsi
call fcn.140128e80
mov eax, 1
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140029b80
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov r15, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx r12d, byte [r8 + 3]
xor r12, rcx
imul r12, rax
mov rcx, qword [r15 + 0x30]
and rcx, r12
mov rdx, qword [r15 + 0x18]
mov rax, rcx
shl rax, 4
mov rbx, qword [rdx + rax + 8]
cmp rbx, qword [r15 + 8]
je 0x140029c2e
mov eax, dword [rsi]
cmp eax, dword [rbx + 0x10]
je 0x140029c27
add rcx, rcx
mov rdi, qword [rdx + rcx*8]
nop word cs:[rax + rax]
nop
cmp rbx, rdi
je 0x140029c31
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140029c10
test rbx, rbx
je 0x140029d73
xor eax, eax
jmp 0x140029dd0
mov rdi, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [r15 + 0x10], rax
je 0x140029de8
mov ecx, 0x20
call fcn.140128e44
mov rbx, rax
mov eax, dword [rsi]
mov dword [rbx + 0x10], eax
mov qword [rbx + 0x18], 0
mov rax, qword [r15 + 0x10]
add rax, 1
movss xmm1, dword [r15]
js 0x140029c75
cvtsi2ss xmm0, rax
jmp 0x140029c8a
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rsi, qword [r15 + 0x38]
test rsi, rsi
js 0x140029c9a
cvtsi2ss xmm2, rsi
jmp 0x140029cb1
mov rax, rsi
shr rax, 1
mov ecx, esi
and ecx, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm3, xmm0
divss xmm3, xmm2
ucomiss xmm3, xmm1
jbe 0x140029d7e
divss xmm0, xmm1
call fcn.14014078c
movss xmm1, dword [0x140166410]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
movabs rcx, 0x8000000000000000
xor rcx, rax
cvttss2si rdx, xmm0
ucomiss xmm0, xmm1
cmovae rdx, rcx
cmp rdx, 8
mov eax, 8
cmova rax, rdx
cmp rsi, rax
jae 0x140029d1e
cmp rsi, 0x1ff
ja 0x140029d1b
shl rsi, 3
cmp rsi, rax
jae 0x140029d1e
mov rsi, rax
mov rcx, r15
mov rdx, rsi
call fcn.140029e00
mov rcx, qword [r15 + 0x30]
and rcx, r12
mov rdx, qword [r15 + 0x18]
mov rax, rcx
shl rax, 4
mov rdi, qword [rdx + rax + 8]
cmp rdi, qword [r15 + 8]
je 0x140029d7e
mov eax, dword [rbx + 0x10]
cmp eax, dword [rdi + 0x10]
je 0x140029d6e
add rcx, rcx
mov rcx, qword [rdx + rcx*8]
nop word cs:[rax + rax]
nop
cmp rdi, rcx
je 0x140029d7b
mov rdi, qword [rdi + 8]
cmp eax, dword [rdi + 0x10]
jne 0x140029d60
mov rdi, qword [rdi]
jmp 0x140029d7e
mov rdi, qword [rbx]
jmp 0x140029c31
mov rdi, rcx
mov rcx, qword [rdi + 8]
add qword [r15 + 0x10], 1
mov qword [rbx], rdi
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rdi + 8], rbx
mov rsi, qword [r15 + 0x18]
and r12, qword [r15 + 0x30]
shl r12, 4
lea rax, [rsi + r12]
add rax, 8
lea rdx, [rsi + r12]
mov rsi, qword [rsi + r12]
cmp rsi, qword [r15 + 8]
je 0x140029dc3
cmp rsi, rdi
je 0x140029dc8
cmp qword [rax], rcx
jne 0x140029dce
jmp 0x140029dcb
mov qword [rdx], rbx
jmp 0x140029dcb
mov rax, rdx
mov qword [rax], rbx
mov al, 1
mov qword [r14], rbx
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.unordered_map_set_too_long
call fcn.140126de0
int3
Function at 0x140029e00
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x140029fa9
mov r15, rcx
add rdx, 0xffffffffffffffff
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov esi, 1
shl rsi, cl
lea r14, [r15 + 0x18]
mov r12, qword [r15 + 8]
lea rdx, [rsi + rsi]
mov rcx, r14
mov r8, r12
call fcn.140020ce0
lea rdi, [rsi - 1]
mov qword [r15 + 0x30], rdi
mov qword [r15 + 0x38], rsi
mov rax, qword [r15 + 8]
mov rdx, qword [rax]
cmp rdx, r12
je 0x140029f9b
movabs r9, 0x100000001b3
movabs r8, 0xcbf29ce484222325
jmp 0x140029ea8
mov qword [rdi + r10*8], rdx
mov qword [rdi + rax*8], rdx
cmp r11, r12
je 0x140029f9b
mov rdi, qword [r15 + 0x30]
mov rdx, r11
mov r11, qword [rdx]
movzx eax, byte [rdx + 0x10]
xor rax, r8
imul rax, r9
movzx ecx, byte [rdx + 0x11]
xor rcx, rax
imul rcx, r9
movzx eax, byte [rdx + 0x12]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + 0x13]
xor rcx, rax
imul rcx, r9
and rcx, rdi
mov rdi, qword [r14]
lea rax, [rcx + rcx]
add rax, 1
lea r10, [rcx + rcx]
shl rcx, 4
mov rbx, qword [rdi + rcx]
cmp rbx, r12
je 0x140029e90
mov rsi, qword [rdi + rax*8]
mov ecx, dword [rdx + 0x10]
cmp ecx, dword [rsi + 0x10]
jne 0x140029f30
mov rcx, qword [rsi]
cmp rcx, rdx
je 0x140029e94
mov r10, qword [rdx + 8]
mov qword [r10], r11
mov rsi, qword [r11 + 8]
mov qword [rsi], rcx
mov rbx, qword [rcx + 8]
mov qword [rbx], rdx
mov qword [rcx + 8], rsi
mov qword [r11 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x140029e94
cmp rbx, rsi
je 0x140029f6d
mov rsi, qword [rsi + 8]
cmp ecx, dword [rsi + 0x10]
jne 0x140029f30
mov rax, qword [rsi]
mov rcx, qword [rdx + 8]
mov qword [rcx], r11
mov rbx, qword [r11 + 8]
mov qword [rbx], rax
mov rdi, qword [rax + 8]
mov qword [rdi], rdx
mov qword [rax + 8], rbx
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rdi
cmp r11, r12
jne 0x140029ea1
jmp 0x140029f9b
mov rax, qword [rdx + 8]
mov qword [rax], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rbx
mov rsi, qword [rbx + 8]
mov qword [rsi], rdx
mov qword [rbx + 8], rcx
mov qword [r11 + 8], rax
mov qword [rdx + 8], rsi
mov qword [rdi + r10*8], rdx
cmp r11, r12
jne 0x140029ea1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140126de0
int3
Function at 0x1400322c2
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x1400323b7
mov edi, dword [rsp + 0xc0]
mov ebx, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov r10d, dword [rsp + 0xa8]
mov eax, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 7
jbe 0x140032327
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, eax
mov r9d, r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x1400323a1
mov rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x40]
mov qword [r15], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb rbx, rbx
or rbx, qword [r15]
jmp 0x1400323a8
mov rbx, 0xffffffffffffffff
mov qword [r14], rbx
xor eax, eax
cmp rbx, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140128f20
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400327d6
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 5]
mov ebp, 5
cmp eax, 1
ja 0x140032985
mov rsi, r8
mov r15, rdx
mov rbp, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r12d, r12d
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0x50], 0x68
mov r13d, 7
cmp qword [r9 + 0x18], r13
jbe 0x140032868
mov r9, qword [r9]
mov rcx, r9
call fcn.14013fb50
mov r14, rax
mov rax, qword [rbp + 0x10]
cmp qword [rbp + 0x18], r13
jbe 0x140032881
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove rbp, rax
cmp qword [rsi + 0x18], r13
jbe 0x140032899
mov rsi, qword [rsi]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x140032978
cmp edi, 6
mov r12d, 0x1fffff
mov esi, 0x101c01
cmove esi, r12d
mov r13, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r13
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rsi, qword [rbx + 8]
test eax, eax
je 0x14003296f
add rbx, 8
cmp edi, 6
mov edi, 0x100c43
cmove edi, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rsi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
jmp 0x140032978
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140032985
mov rcx, r14
call fcn.140138178
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140128f20
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400329ac
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor r14d, r14d
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140032a44
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140035a7e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x160
mov r12, rcx
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x158], rax
test dl, dl
je 0x140035b0a
lea rax, [0x14004ace8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x140167e60]
lea r8, str.NtMapViewOfSection
mov rcx, r12
mov rdx, rdi
mov r9d, 1
call fcn.14003548e
lea rax, [0x14004ad50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, r12
mov rdx, rdi
mov r9d, 1
call fcn.14003548e
jmp 0x140035b16
cmp qword [r12 + 0x10], 0
je 0x140035cad
mov rax, qword [r12]
mov r14, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, r14
xor edx, edx
mov r9d, 0x2000
call r13
mov rdi, rax
mov rsi, qword [r12 + 0x10]
shl rsi, 6
lea r15, [rsi + 0x60]
mov rcx, r15
call fcn.140035294
mov rbx, rax
mov rax, 0xfffffffffffff000
mov rcx, rbx
and rcx, rax
lea rdx, [rcx + rdi]
and ebx, 0xfff
add rsi, 0x105f
and rsi, rax
mov dword [rsp + 0x20], 0x40
mov rcx, r14
mov r8, rsi
mov r9d, 0x1000
call r13
mov rdi, rax
test rax, rax
jne 0x140035bc4
lea rdx, str..._.._sandbox_win_src_interception.cc
lea r9, str.thunk_base
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x188
call fcn.14000e0a0
mov rcx, rsi
call fcn.14000e210
add rdi, rbx
movaps xmm0, xmmword [0x140164c30]
lea rsi, [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi], r15
mov dword [rsi + 0x18], 0
mov qword [rsi + 8], 0x20
lea rcx, [0x1401dec60]
mov r8d, 0x150
xor edx, edx
call fcn.14012b560
mov rcx, r12
mov rdx, rdi
mov r8, r15
mov r9, rsi
call fcn.140035f40
mov ebx, eax
test eax, eax
jne 0x140035caf
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x38]
mov qword [rcx], rax
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x40]
mov r9d, 0x20
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 0x2a
test eax, eax
je 0x140035caf
cmp qword [rsp + 0x38], 0x20
jne 0x140035caf
lea rax, [rsp + 0x34]
mov dword [rax], 0xaaaaaaaa
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [r12]
lea rdx, str.g_originals
lea r8, [0x1401dec60]
mov r9d, 0x150
call fcn.140016100
mov ebx, eax
jmp 0x140035caf
xor ebx, ebx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140128f20
mov eax, ebx
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140037548
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test r8, r8
je 0x140037661
mov rdi, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x140037661
cmp word [rax + rcx + 0x14], 0x78
jb 0x140037661
mov r14, r8
mov r12, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test rax, rax
je 0x140037661
cmp r12, 0xffff
ja 0x1400375b7
mov word [r14], r12w
jmp 0x14003769a
mov rsi, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov edx, dword [rsi + 0x18]
lea rcx, [rdx*4]
test rcx, rcx
je 0x140037661
mov qword [rsp + 0x30], rsi
lea rbx, [rax + rdx*4]
lea r13, [r12 + 1]
mov qword [rsp + 0x28], rax
mov rbp, rax
mov rax, rbx
sub rax, rbp
mov rcx, rax
sar rcx, 2
shr rax, 0x3f
add rax, rcx
and rax, 0xfffffffffffffffe
lea r15, [rax*2]
add r15, rbp
mov edx, dword [r15]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov cl, byte [r12]
test cl, cl
je 0x14003763a
mov rdx, r13
cmp cl, byte [rax]
jne 0x14003763c
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14003762a
xor ecx, ecx
movzx ecx, cl
movzx eax, byte [rax]
mov edx, ecx
sub edx, eax
lea rsi, [r15 + 4]
test edx, edx
cmovg rbp, rsi
cmp ecx, eax
cmovs rbx, r15
je 0x140037674
xor eax, eax
cmp rbp, rbx
jne 0x1400375f0
jmp 0x140037663
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x30]
mov edx, dword [rsi + 0x24]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
sub r15, qword [rsp + 0x28]
sar r15, 1
movzx eax, word [rax + r15]
add ax, word [rsi + 0x10]
mov word [r14], ax
mov al, 1
jmp 0x140037663

Function at 0x140037740
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140037777
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140037777
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140037777
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret

Function at 0x140037d80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140037e10
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str..._.._base_rand_util_win.cc
lea r15, [0x140168178]
lea r12, [rsp + 0x20]
jmp 0x140037dd8
add rdi, rbx
sub rsi, rbx
je 0x140037e10
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140037dd0
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.14000e0a0
mov rcx, r12
call fcn.14000e210
jmp 0x140037dd0
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140128f20
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003ada0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x2c0
mov rsi, rcx
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [0x140164c30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [0x1401687ca]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov r9d, 0x382
call fcn.140008de0
lea rcx, [rsp + 0x30]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.140024150
lea rbx, [rsp + 0xb0]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.14012b560
mov word [rsp + 0xb0], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x14003aecb
mov qword [rsp + 0x20], rbx
cmp word [rsp + 0xb0], 0
je 0x14003ae81
xor eax, eax
nop word cs:[rax + rax]
cmp word [rsp + rax*2 + 0xb2], 0
lea rax, [rax + 1]
jne 0x14003ae70
jmp 0x14003ae83
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140006ab0
lea rbx, [rsp + 0x90]
mov rcx, rdi
mov rdx, rbx
call fcn.140007af0
mov rcx, rsi
mov rdx, rbx
call fcn.140006c00
mov rcx, rbx
call fcn.140006b90
mov rcx, rdi
call fcn.140006b90
mov dil, 1
lea rcx, [rsp + 0x30]
call fcn.140024290
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.140128f20
mov eax, edi
add rsp, 0x2c0
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003af00
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140164c30]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [0x1401687df]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x392
call fcn.140008de0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140024150
cmp qword [rsi + 0x18], 7
jbe 0x14003af7f
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rdi
call fcn.140024290
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140128f20
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003b9c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401cb2f8]
cmp ecx, 0xffffffff
je 0x14003b9e3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
jmp 0x14003b9e5
xor eax, eax
add rsp, 0x28
ret