joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003cfb0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x14003cfec
mov rcx, qword [rcx + 0x10]
cmp rdx, rcx
je 0x14003cfec
test rcx, rcx
jle 0x14003cfe8
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rdi + 0x10], rbx
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x14003cfff
mov eax, 0xc0000141
jmp 0x14003d192
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003d18d
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
mov qword [rdi + 0x20], rdx
mov qword [rdi + 0x28], rdx
cmp dword [rdx], 0x4550
jne 0x14003d18d
mov eax, 0x20b
mov qword [rsp + 0x50], rsi
cmp word [rdx + 0x18], ax
jne 0x14003d04c
mov byte [rdi + 0x19], 1
lea rbx, [rdx + 0x108]
mov rax, qword [rdx + 0x30]
mov r8b, 1
jmp 0x14003d05d
mov byte [rdi + 0x19], 0
lea rbx, [rdx + 0xf8]
mov eax, dword [rdx + 0x34]
xor r8b, r8b
mov qword [rdi + 0x30], rax
lea rcx, [rdx + 0xf8]
mov eax, dword [rdx + 0x50]
mov dword [rdi + 0x38], eax
mov eax, dword [rdx + 0x54]
mov dword [rdi + 0x40], eax
mov eax, dword [rdx + 0x28]
mov dword [rdi + 0x3c], eax
movzx eax, word [rdx + 0x5c]
mov dword [rdi + 0x54], eax
movzx eax, word [rdx + 0x5e]
mov dword [rdi + 0x5c], eax
mov qword [rsp + 0x20], rbx
movzx eax, word [rdx + 0x16]
shr ax, 0xd
not al
and al, 1
mov byte [rdi + 0x1a], al
test r8b, r8b
lea rax, [rdx + 0xe8]
cmove rcx, rax
xor esi, esi
mov eax, dword [rcx]
test eax, eax
jne 0x14003d12c
mov eax, esi
xor ecx, ecx
mov byte [rdi + 0x1b], cl
test cl, cl
je 0x14003d0f0
sub eax, dword [rdi + 0x10]
lea rdx, [rdi + 0xf8]
add eax, 0x10
lea rcx, [rdi + 0x138]
mov dword [rdi + 0x58], eax
call fcn.140044ae0
test al, al
je 0x14003d0eb
xor edx, edx
lea rcx, [rdi + 0x138]
call fcn.140044c20
mov rbx, qword [rsp + 0x20]
mov rax, qword [rdi + 0x20]
cmp si, word [rax + 6]
jae 0x14003d184
mov qword [rsp + 0x48], rbp
mov rdx, qword [rdi + 0x68]
cmp rdx, qword [rdi + 0x70]
je 0x14003d157
movups xmm0, xmmword [rbx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movsd xmm0, qword [rbx + 0x20]
movsd qword [rdx + 0x20], xmm0
add qword [rdi + 0x68], 0x28
jmp 0x14003d163
mov rdx, rax
mov r8d, 1
mov rcx, rdi
call fcn.14003dd30
test rax, rax
je 0x14003d0b4
test byte [rax + 0x10], 1
je 0x14003d0b4
mov cl, 1
jmp 0x14003d0b6
mov r8, rbx
lea rcx, [rdi + 0x60]
call fcn.14003e430
mov rbx, qword [rsp + 0x20]
inc esi
mov rax, qword [rdi + 0x20]
add rbx, 0x28
mov qword [rsp + 0x20], rbx
movzx ecx, word [rax + 6]
cmp esi, ecx
jl 0x14003d103
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
jmp 0x14003d192
mov eax, 0xc000007b
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14006a770
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14003df50
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.140089760
xor ebx, ebx
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x40], 0x38
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
lea r8, [rsi + 0x50]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.14003e180
mov r12, rax
test rax, rax
je 0x14003e135
test rdi, rdi
jne 0x14003e0c6
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x190]
call fcn.140089760
lea rdx, [rbp + 0x190]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, str.ImageManifest
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x14003e034
mov eax, 0xc0150002
jmp 0x14003e137
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
setg r15b
test rax, rax
jle 0x14003e0b5
mov dword [rbp - 0x80], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x80]
mov r8d, dword [rsp + 0x78]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r15b, r15b
je 0x14003e094
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], rbx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rsi + 0x118]
lea rdx, [rbp - 0x70]
call fcn.1400068b8
nop
jmp 0x14003e0ef
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14003e137
mov dword [rsp + 0x44], 8
movzx eax, word [rsi + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rdi
lea rdx, [rsi + 0xf8]
lea rcx, [rsi + 0x118]
call fcn.140017420
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rdi, rax
mov rcx, qword [rsi + 0x48]
cmp rax, rcx
je 0x14003e118
test rcx, rcx
jle 0x14003e111
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rsi + 0x48], rdi
mov rcx, rdi
test rcx, rcx
jg 0x14003e135
mov rax, qword gs:[0x30]
cmp dword [rax + 0x1250], 0xc0000022
jne 0x14003e162
mov dword [rsi + 0x50], ebx
xor eax, eax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14006a770
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14003e137
Function at 0x140043280
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor esi, esi
lea r9, [rsp + 0x48]
mov rdi, rcx
mov qword [rsp + 0x48], rsi
add rcx, 0x68
lea edx, [rsi + 0x18]
lea r8d, [rsi + 8]
call fcn.140040400
cmp qword [rsp + 0x48], rsi
je 0x14004333f
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r8, rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov rcx, qword [rcx]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140043308
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x68]
mov qword [rsp + 0x40], rsi
test rdx, rdx
je 0x14004333f
mov rax, qword [rdx + 0x18]
lea r8, [rsp + 0x40]
mov rdx, qword [rdx]
mov r9d, 8
add rdx, 0x18
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x140043352
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x40], rsi
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140043405
call fcn.140040610
test al, al
je 0x140043405
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rdi + 0x20]
mov dword [rax + 0x1250], esi
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x20]
mov edx, 0xffffffff
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rdi + 0x20]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400433b7
jle 0x1400433b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov dword [rbx + 8], esi
mov rbx, qword [rdi + 0x28]
mov qword [rdi + 0x20], rsi
mov qword [rdi + 0x28], rsi
test rbx, rbx
je 0x1400433f7
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400433f7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400433f7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140043405
call fcn.1400402d0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a770
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140047ea0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [0x1400f3a18], 0
jne 0x140047f11
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x1400f3a08], rax
mov eax, dword [rsp + 0x48]
mov qword [0x1400f3a10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1400f3a18], rax
lea rax, [0x1400f3a08]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14006a770
add rsp, 0x68
ret
Function at 0x14004bcb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
call fcn.140046300
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
mov r8, qword [rdi + 0x10]
jb 0x14004bce2
mov rdx, qword [rdi]
xor ebx, ebx
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
test r8, r8
je 0x14004bd13
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x14004bd00
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140025670
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14004bd32
mov rax, qword [rsi + 8]
jmp 0x14004bd39
mov rcx, qword [rsi + 8]
mov rax, rcx
cmp rcx, rax
je 0x14004bd42
mov rbx, qword [rcx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140056370
Capabilities:
Terminate thread

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov byte [rcx + 0x60], 0
mov rcx, qword [rcx + 0x48]
xor ebp, ebp
test rcx, rcx
je 0x1400563a5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + 0x48], rbp
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400563ba
jle 0x1400563b6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rbp
mov edi, ebp
nop dword [rax]
mov edx, edi
mov rcx, rbx
call fcn.1400560c0
inc edi
cmp edi, 4
jl 0x1400563c0
cmp qword [rbx + 0x10], rbp
je 0x1400564af
call fcn.140013488
mov rcx, qword [rbx]
mov dword [rsp + 0x40], ebp
mov edx, dword [rcx + 8]
mov rcx, qword [rax]
mov dword [rsp + 0x44], edx
cmp rcx, 0xffffffffffffffff
je 0x140056445
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x44]
mov dword [rsp + 0x28], ebp
mov r9d, 4
mov edx, 0x8005e020
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14005643a
mov rax, qword gs:[0x30]
cmp dword [rax + 0x1250], ebp
jl 0x140056445
lea rcx, [rbx + 8]
call fcn.1400564d0
jmp 0x1400564a3
mov qword [rsp + 0x78], rsi
mov rsi, qword [rbx + 8]
mov qword [rsp + 0x80], r14
mov rdi, qword [rsi + 8]
cmp byte [rdi + 0x19], bpl
jne 0x140056487
mov r8, qword [rdi + 0x10]
lea rdx, [rbx + 8]
lea rcx, [rbx + 8]
call fcn.140056540
mov rcx, rdi
mov edx, 0x38
mov rdi, qword [rdi]
call fcn.14006a794
cmp byte [rdi + 0x19], bpl
je 0x140056460
mov r14, qword [rsp + 0x80]
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov qword [rsi + 0x10], rsi
mov rsi, qword [rsp + 0x78]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x58], rbp
mov qword [rbx + 0x50], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006a770
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400572d0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
jne 0x1400572f5
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rdi]
mov rcx, qword [rax + 0x10]
cmp dword [rcx + 0x10], 3
jne 0x14005739f
cmp byte [rcx + 0x16], 0
jne 0x14005739f
call fcn.140024040
mov rbx, rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rdx, str.Wow64SuspendThread
lea rcx, [rsp + 0x20]
call fcn.140006a18
nop
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400573c0
cmp eax, 0xffffffff
setne bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140057391
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005738c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400573ba
call fcn.14006a794
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.140095e24
int3

Function at 0x1400573c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140046300
lea rsi, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
mov r10, qword [rdi + 0x10]
jb 0x1400573f9
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x140057433
movabs r8, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r8
cmp rcx, r10
jb 0x140057420
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140025670
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140057452
mov rax, qword [rbx + 8]
jmp 0x140057459
mov rcx, qword [rbx + 8]
mov rax, rcx
cmp rcx, rax
je 0x140057486
mov rbx, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14005748f
mov rcx, qword [r14]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400574a0
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x970
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov edi, edx
mov rbx, rcx
cmp edx, 4
ja 0x14005767f
mov qword [r11 + 0x10], rbp
lea rcx, [r11 - 0x688]
xor edx, edx
mov qword [r11 + 0x18], rsi
mov r8d, 0x670
call fcn.140089760
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.140089760
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
movzx esi, byte [rax + 0x16]
test sil, sil
jne 0x140057530
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x14005755d
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.140089760
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rbp, qword [rsp + 0x988]
lea r8, [rsp + 0x360]
test sil, sil
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
js 0x140057656
mov edx, dword [r8]
test edi, edi
jne 0x140057590
and edx, 0xfff0fffe
jmp 0x1400575d3
cmp edi, 1
jne 0x14005759d
and edx, 0xff0ffffb
jmp 0x1400575d3
cmp edi, 2
mov ecx, 0xffffffbf
mov eax, 0xffffffef
cmovne eax, ecx
mov ecx, 0xf3ffffff
and eax, edx
mov edx, 0x3fffffff
cmp edi, 2
cmovne ecx, edx
mov edx, 0xfcffffff
and ecx, eax
mov eax, 0xcfffffff
cmp edi, 2
cmovne edx, eax
and edx, ecx
mov eax, edx
mov dword [r8], edx
shr eax, 2
mov ecx, eax
or ecx, edx
shr ecx, 4
or ecx, eax
or ecx, edx
test cl, 1
jne 0x1400575f2
btr edx, 8
mov dword [r8], edx
mov rcx, rbx
mov edi, 0xc000071c
call fcn.1400572d0
test sil, sil
jne 0x140057623
test al, al
je 0x140057654
mov rax, qword [rbx]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x14005763d
test al, al
je 0x140057654
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
je 0x140057654
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rsi, qword [rsp + 0x990]
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.14006a770
mov rbx, qword [rsp + 0x998]
add rsp, 0x970
pop rdi
ret
xor eax, eax
jmp 0x14005765e
Function at 0x140057690
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x970
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x670
call fcn.140089760
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.140089760
mov rsi, qword [rdi]
mov rax, qword [rsi + 0x10]
movzx ebp, byte [rax + 0x16]
test bpl, bpl
jne 0x140057719
mov rdx, qword [rdi + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x140057746
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.140089760
mov rdx, qword [rdi + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
test bpl, bpl
lea r9, [rsp + 0x360]
lea rcx, [rsp + 0x38]
cmovne r9, rcx
test eax, eax
jns 0x140057765
xor eax, eax
jmp 0x1400578ae
xor edx, edx
mov ecx, edx
mov eax, edx
nop dword [rax + rax]
cmp qword [rsp + rax*8 + 0x338], rbx
je 0x140057795
cmp dword [rsp + rax*4 + 0x24], ebx
je 0x140057795
inc ecx
inc rax
cmp rax, 4
jl 0x140057770
mov eax, 0xc0000225
jmp 0x1400578ae
mov eax, ecx
test bpl, bpl
jne 0x1400577a6
mov qword [rsp + rax*8 + 0x338], rdx
jmp 0x1400577aa
mov dword [rsp + rax*4 + 0x24], edx
mov r8d, dword [r9]
test ecx, ecx
jne 0x1400577b8
mov eax, 0xfffffffe
jmp 0x1400577d4
cmp ecx, 1
jne 0x1400577c4
mov eax, 0xfffffffb
jmp 0x1400577d4
cmp ecx, 2
mov eax, 0xffffffbf
mov edx, 0xffffffef
cmove eax, edx
and r8d, eax
test ecx, ecx
jne 0x1400577e2
mov eax, 0xfff3ffff
jmp 0x1400577fe
cmp ecx, 1
jne 0x1400577ee
mov eax, 0xff3fffff
jmp 0x1400577fe
cmp ecx, 2
mov eax, 0x3fffffff
mov edx, 0xf3ffffff
cmove eax, edx
and r8d, eax
test ecx, ecx
jne 0x14005780c
mov edx, 0xfffcffff
jmp 0x140057828
cmp ecx, 1
jne 0x140057818
mov edx, 0xffcfffff
jmp 0x140057828
cmp ecx, 2
mov edx, 0xcfffffff
mov eax, 0xfcffffff
cmove edx, eax
and edx, r8d
mov eax, edx
mov dword [r9], edx
shr eax, 2
or eax, edx
shr eax, 2
or eax, edx
shr eax, 2
or eax, edx
test al, 1
jne 0x14005784a
btr edx, 8
mov dword [r9], edx
mov rcx, rdi
mov ebx, 0xc000071c
call fcn.1400572d0
test bpl, bpl
jne 0x14005787b
test al, al
je 0x1400578ac
mov rax, qword [rdi]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x140057895
test al, al
je 0x1400578ac
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
je 0x1400578ac
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, ebx
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.14006a770
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140057980
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov qword [rcx + 8], rdx
lea rax, vtable.blackbone::Native.0
mov rdi, rcx
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 0x10], rsi
movzx ebx, r8b
lea rcx, [rsp + 0x28]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [rsp + 0x2c]
mov dword [rdi + 0x18], ecx
test bl, bl
je 0x1400579ed
mov word [rdi + 0x14], 0x101
mov byte [rdi + 0x16], 1
jmp 0x140057a49
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x24], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov ecx, dword [rsp + 0x20]
cmp ecx, 1
mov edx, dword [rsp + 0x24]
sete al
cmp edx, 1
mov byte [rdi + 0x14], al
sete al
mov byte [rdi + 0x15], al
cmp ecx, 1
jne 0x140057a6f
cmp edx, ecx
je 0x140057a49
cmp ecx, 1
mov byte [rdi + 0x17], 1
setne sil
add esi, 2
mov dword [rdi + 0x10], esi
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a770
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
test ecx, ecx
jne 0x140057a3b
test edx, edx
jne 0x140057a3b
mov dword [rdi + 0x10], 1
jmp 0x140057a4c
Function at 0x140057e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rbp, rcx
call fcn.140024040
mov rdi, rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], bl
lea rdx, str.NtSetInformationProcess
lea rcx, [rsp + 0x20]
call fcn.140006a18
nop
call fcn.140046300
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140057ee3
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x140057ed0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025670
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140057f04
mov rax, qword [rdi + 8]
jmp 0x140057f0b
mov rcx, qword [rdi + 8]
mov rax, rcx
cmp rcx, rax
je 0x140057f36
mov rbx, qword [rcx + 0x30]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140057f40
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, qword [rbp + 8]
call rbx
mov ebx, eax
jmp 0x140057f45
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140057f7e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057f79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057f8f
call fcn.14006a794
mov eax, ebx
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140095e24
int3