joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005ef30
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea r14, [rsp + 0x78]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1401543c0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.1400956b0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x1401990c0]
movaps xmmword [rsp + 0x60], xmm0
lea rdi, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
call fcn.1400958e0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x14005efdf
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14005f114
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r14, [rsp + 0x78]
lea r15, [rsp + 0x48]
xor r12d, r12d
jmp 0x14005f00c
mov r12d, ebp
test rcx, rcx
je 0x14005f114
cmp byte [rsp + 0x78], 0
je 0x14005f090
mov esi, dword [rsp + 0x7c]
test sil, 1
je 0x14005f044
test sil, 0x10
je 0x14005f02d
xor ebp, ebp
test bl, bl
je 0x14005f0c3
mov rcx, rdi
test al, al
jns 0x14005f039
mov rcx, qword [rsp + 0x60]
mov edx, esi
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test sil, 0x10
je 0x14005f095
xor ebp, ebp
test bl, bl
je 0x14005f0c3
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
mov r8b, 1
call fcn.14005ef30
mov ebp, eax
test eax, eax
jne 0x14005f0c3
cmp byte [rsp + 0x77], 0
mov rcx, rdi
jns 0x14005f075
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14005f0c3
jmp 0x14005f0ad
call fcn.14007fd20
cmp byte [rsp + 0x77], 0
mov rcx, rdi
jns 0x14005f0a4
mov rcx, qword [rsp + 0x60]
call r13
xor ebp, ebp
test eax, eax
jne 0x14005f0c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
mov rdx, r15
call fcn.1400958e0
cmp byte [rsp + 0x77], 0
jns 0x14005f0e6
mov rcx, qword [rsp + 0x60]
call fcn.140150da4
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x14005f000
mov rcx, qword [rsp + 0x68]
jmp 0x14005f000
test al, al
jns 0x14005f122
mov rcx, qword [rsp + 0x60]
call fcn.140150da4
lea rcx, [rsp + 0x78]
call fcn.140095850
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140152280
mov eax, ebp
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140072370
Capabilities:
Delete file
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [0x1401d80f0]
test rdi, rdi
je 0x1400724c1
lea r14, [0x1401a99d3]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 1
lea rbx, [rdi + 0x30]
lea r15, [rdi + 0x38]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.14007fab0
lea r12, str.vmodule
cmp qword [rsp + 0x30], r15
jne 0x140072407
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.14007fab0
cmp qword [rsp + 0x30], r15
je 0x1400724c1
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 7
lea rbx, [rsp + 0x58]
lea r8, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
call fcn.14007d0d0
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 1
lea r14, [rsp + 0x30]
lea r8, [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
call fcn.14007d0d0
mov ecx, 0x20
call fcn.140150d68
mov rdi, rax
lea r9, [0x1401d8070]
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.1400aca80
cmp byte [rsp + 0x47], 0
js 0x140072484
cmp byte [rsp + 0x6f], 0
js 0x140072495
test rdi, rdi
jne 0x1400724a4
jmp 0x1400724c1
mov rcx, qword [rsp + 0x30]
call fcn.140150da4
cmp byte [rsp + 0x6f], 0
jns 0x14007247d
mov rcx, qword [rsp + 0x58]
call fcn.140150da4
test rdi, rdi
je 0x1400724c1
xor eax, eax
lock cmpxchg qword [0x1401d8080], rdi
je 0x1400724c1
mov rcx, rdi
call fcn.1400ad000
mov rcx, rdi
call fcn.140150da4
mov eax, dword [rsi]
mov dword [0x1401c8550], eax
test al, 1
jne 0x1400724ea
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140152280
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [0x1401d8078]
test rcx, rcx
je 0x14007251c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401d8078], 0
mov rcx, qword [0x1401d8068]
test rcx, rcx
jne 0x14007254a
and byte [0x1401c8550], 0xfe
jmp 0x140072528
mov rcx, qword [0x1401d8068]
test rcx, rcx
jne 0x14007254a
mov ecx, 0x18
call fcn.140150d68
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1401d8068], rax
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140072594
call fcn.14005104a
cmp dword [rsi + 0x14], 0
jne 0x140072574
mov rcx, qword [0x1401d8068]
cmp byte [rcx + 0x17], 0
jns 0x14007256e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140152280
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400725a0
int3
Function at 0x140072e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rax, [0x14019bea8]
mov qword [rcx], rax
call fcn.140072ee0
mov ecx, dword [rsi + 0x130]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [rsi + 0x12c]
call fcn.140167894
mov dword [rax], edi
mov rax, qword [rsi + 0x10]
movsxd rax, dword [rax + 4]
lea rcx, [0x14019b900]
mov qword [rsi + rax + 0x10], rcx
lea rdi, [rsi + 0x18]
lea rax, [0x14019b910]
mov qword [rsi + 0x18], rax
cmp byte [rsi + 0x6f], 0
jns 0x140072eb3
mov rcx, qword [rsi + 0x58]
call fcn.140150da4
sub rsi, 0xffffffffffffff80
mov rcx, rdi
call fcn.140024b6e
mov rcx, rdi
call fcn.140024bd0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140024b68
Function at 0x140073c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rax, str.p__a_
mov qword [rcx], rax
call fcn.140073d10
lea rax, [0x14019bea8]
mov qword [rsi], rax
mov rcx, rsi
call fcn.140072ee0
mov ecx, dword [rsi + 0x130]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [rsi + 0x12c]
call fcn.140167894
mov dword [rax], edi
mov rax, qword [rsi + 0x10]
movsxd rax, dword [rax + 4]
lea rcx, [0x14019b900]
mov qword [rsi + rax + 0x10], rcx
lea rdi, [rsi + 0x18]
lea rax, [0x14019b910]
mov qword [rsi + 0x18], rax
cmp byte [rsi + 0x6f], 0
jns 0x140073ce5
mov rcx, qword [rsi + 0x58]
call fcn.140150da4
sub rsi, 0xffffffffffffff80
mov rcx, rdi
call fcn.140024b6e
mov rcx, rdi
call fcn.140024bd0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140024b68

Function at 0x14007b340
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14007b36a
call fcn.140075ef0
mov qword [rsi], 0
test r14, r14
je 0x14007b398
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14007b3e6
cmp r15, 2
jae 0x14007b400
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
cmp byte [rdi + 0x1f], 0
js 0x14007b3b6
lea rax, [rdi + 8]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
jmp 0x14007b3c3
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
call fcn.140050dce
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
movzx eax, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
movzx eax, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140075ef0
mov rcx, qword [rsi]
call fcn.140053e50
mov qword [rsi], 0
cmp r15, 2
jb 0x14007b390
mov qword [rsi], r14
call fcn.140075ef0
jmp 0x14007b390
Function at 0x14007b470
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
call fcn.14005b970
mov r14, qword [rdi]
mov qword [rdi], 0
lea r15, [r14 + 1]
cmp r15, 2
jae 0x14007b4a9
cmp qword [rsi], r14
jne 0x14007b4b3
cmp rsi, rdi
jne 0x14007b4da
jmp 0x14007b547
call fcn.140075ef0
cmp qword [rsi], r14
je 0x14007b49f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14007b516
cmp r15, 2
jae 0x14007b530
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rsi, rdi
je 0x14007b547
lea rdx, [rdi + 8]
lea rcx, [rsi + 8]
cmp byte [rsi + 0x1f], 0
movzx r8d, byte [rdi + 0x1f]
js 0x14007b502
test r8b, r8b
js 0x14007b53a
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
jmp 0x14007b547
test r8b, r8b
jns 0x14007b50f
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
call fcn.1400512fe
jmp 0x14007b547
call fcn.140075ef0
mov rcx, qword [rsi]
call fcn.140053e50
mov qword [rsi], 0
cmp r15, 2
jb 0x14007b4cd
mov qword [rsi], r14
call fcn.140075ef0
jmp 0x14007b4cd
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
call fcn.140051388
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
movzx eax, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
movzx eax, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400821f3
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x140082233
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x140082243
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
test rbx, rbx
je 0x140082390
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140082390
lea r14, [rsp + 0x50]
mov rax, qword [r14]
movzx ebp, word [rax]
movzx r15d, word [rax + 2]
mov word [rsp + 0x260], bp
mov word [rsp + 0x262], r15w
mov r12, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r12
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], r15w
mov word [rsp + 0x268], bp
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call r12
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
mov rbp, 0xfffffffffffffffe
lea r15, str.StringFileInfo_04hx_04hx_ls
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401543c0
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x140082315
mov rax, qword [rdi]
movzx ecx, word [rsp + rbp*2 + 0x264]
movzx edx, word [rsp + rbp*2 + 0x266]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
mov r9, r15
call fcn.14005f320
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, rbx
mov rdx, r14
mov r8, r12
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140082378
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jne 0x140082388
add rbp, 2
cmp rbp, 5
jbe 0x1400822f9
jmp 0x140082390
mov rcx, rsi
call fcn.14005104a
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140152280
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140084296
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov rcx, qword [rcx + 8]
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x84], 0
je 0x1400842df
add rax, rcx
cmp word [rax + 0x14], 0x78
jb 0x1400842df
add rax, 0x88
je 0x1400842df
mov r8d, dword [rax]
test r8, r8
je 0x1400842df
add r8, rcx
je 0x1400842df
cmp rdx, 0xffff
ja 0x1400842e8
mov r10d, dword [r8 + 0x10]
jmp 0x140084394
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [r8 + 0x18]
mov r10d, dword [r8 + 0x20]
lea r9, [rcx + r10]
test r10, r10
cmove r9, r10
lea r10, [r9 + rax*4]
lea r11, [rdx + 1]
xor eax, eax
mov rsi, r9
cmp rsi, r10
je 0x1400842e1
mov rdi, r10
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
shr rdi, 0x3f
add rdi, rbx
and rdi, 0xfffffffffffffffe
mov r14d, dword [rsi + rdi*2]
lea rbx, [rcx + r14]
test r14, r14
cmove rbx, r14
mov bpl, byte [rdx]
test bpl, bpl
je 0x14008435a
mov r14, r11
cmp bpl, byte [rbx]
jne 0x140084354
inc rbx
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x14008433f
xor ebp, ebp
movzx ebp, bpl
jmp 0x14008435c
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ebx, byte [rbx]
lea r14, [rdi + 4]
cmp ebp, ebx
cmovg rsi, r14
cmovs r10, rdi
jne 0x140084308
mov r10d, dword [r8 + 0x10]
mov eax, dword [r8 + 0x24]
lea rdx, [rcx + rax]
test rax, rax
cmove rdx, rax
sub rdi, r9
sar rdi, 1
movzx edx, word [rdx + rdi]
add dx, r10w
mov eax, dword [r8 + 0x1c]
add rcx, rax
test rax, rax
cmove rcx, rax
movzx eax, dx
lea rax, [rcx + rax*4]
mov ecx, r10d
shl rcx, 2
sub rax, rcx
jmp 0x1400842e1

Function at 0x140084458
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14008448f
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14008448f
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x14008448f
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x1400893d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x1400893e5
mov r8d, r8d
add rsp, 0x28
jmp fcn.140088b30
test r8d, r8d
jne 0x140089404
lea rcx, [0x1401dac48]
lea rdx, [0x1400bb000]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret

Function at 0x14008bb90
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401d8168]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14008bce4
jp 0x14008bce4
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401d8178]
mov ecx, dword [0x1401d52c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008bd04
mov eax, dword [0x1401d8188]
mov ecx, dword [0x1401d52c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008bd3e
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r14, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r14, qword [0x1401d8180]
xorps xmm0, xmm0
cvtsi2sd xmm0, r14
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x14019ea60]
ucomisd xmm1, xmm0
ja 0x14008bce4
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401d8170]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x14019ea40]
subpd xmm1, xmmword [0x14019ea50]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401d8168], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140152280
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401d8178]
call fcn.140150ec0
cmp dword [0x1401d8178], 0xffffffff
jne 0x14008bc12
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401d8170], rdx
lea rcx, [0x1401d8178]
call fcn.140150f58
jmp 0x14008bc12
lea rcx, [0x1401d8188]
call fcn.140150ec0
cmp dword [0x1401d8188], 0xffffffff
jne 0x14008bc37
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1401d8180], rax
lea rcx, [0x1401d8188]
call fcn.140150f58
jmp 0x14008bc37
Function at 0x14008cc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
mov eax, dword [0x1401d8298]
mov ecx, dword [0x1401d52c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008ccbb
lea rcx, [0x1401d81c8]
mov edx, esi
add rsp, 0x20
pop rsi
jmp fcn.1400c2e50
lea rcx, [0x1401d8298]
call fcn.140150ec0
cmp dword [0x1401d8298], 0xffffffff
jne 0x14008cca8
lea rcx, [0x1401d81c8]
call fcn.1400c2d40
lea rcx, [0x1401d8298]
call fcn.140150f58
jmp 0x14008cca8

Function at 0x14008cee0
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x7c], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x1401ac200]
movups xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x1401ac210]
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x8c], 0x20
lea rcx, [rsp + 0x20]
call fcn.14008d300
mov ebx, dword [rsp + 0x8c]
mov ebp, dword [rsp + 0x40]
mov r14d, dword [rsp + 0x44]
lea rdi, [rsp + 0x48]
mov eax, dword [rsp + 0x88]
lea rcx, [rax + 1]
mov byte [rsp + rax + 0x48], 0x80
cmp rax, 0x38
jb 0x14008cfab
cmp eax, 0x3f
je 0x14008cf94
mov r8d, 0x3f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.1401543c0
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.14008d410
xor ecx, ecx
jmp 0x14008cfb1
cmp rcx, 0x38
je 0x14008cfc4
mov r8d, 0x38
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.1401543c0
bswap r14d
bswap ebp
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0x84], ebp
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.14008d410
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
cmp ebx, 0x20
ja 0x14008d07b
cmp ebx, 4
jb 0x14008d07b
shr ebx, 2
mov eax, dword [rsp + 0x20]
bswap eax
mov dword [rsi], eax
cmp ebx, 1
je 0x14008d07b
mov eax, dword [rsp + 0x24]
bswap eax
mov dword [rsi + 4], eax
cmp ebx, 2
je 0x14008d07b
mov eax, dword [rsp + 0x28]
bswap eax
mov dword [rsi + 8], eax
cmp ebx, 3
je 0x14008d07b
mov eax, dword [rsp + 0x2c]
bswap eax
mov dword [rsi + 0xc], eax
cmp ebx, 4
je 0x14008d07b
mov eax, dword [rsp + 0x30]
bswap eax
mov dword [rsi + 0x10], eax
cmp ebx, 5
je 0x14008d07b
mov eax, dword [rsp + 0x34]
bswap eax
mov dword [rsi + 0x14], eax
cmp ebx, 6
je 0x14008d07b
mov eax, dword [rsp + 0x38]
bswap eax
mov dword [rsi + 0x18], eax
cmp ebx, 7
je 0x14008d07b
mov eax, dword [rsp + 0x3c]
bswap eax
mov dword [rsi + 0x1c], eax
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140098320
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400983b8
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x140098383
call fcn.140075ef0
mov rcx, qword [rsi]
call fcn.140053e50
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140098395
mov qword [rsi], rdi
call fcn.140075ef0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 0
inc rax
cmp rax, 1
jbe 0x1400983bf
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 8], 0
int3
int3
Function at 0x1400ac9f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
mov rcx, qword [rdx]
mov r8, qword [rdx + 8]
lea rdx, [rcx + r8]
test r8, r8
js 0x1400aca6f
je 0x1400aca6e
test r8b, 1
je 0x1400aca26
movzx r9d, byte [rcx]
movzx r10d, al
xor r10d, r9d
lea r9, [0x1401a9bf0]
shr eax, 8
xor eax, dword [r9 + r10*4]
inc rcx
cmp r8, 1
je 0x1400aca6e
lea r8, [0x1401a9bf0]
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
movzx r10d, al
xor r10d, r9d
shr eax, 8
xor eax, dword [r8 + r10*4]
movzx r9d, byte [rcx + 1]
movzx r10d, al
xor r10d, r9d
shr eax, 8
xor eax, dword [r8 + r10*4]
add rcx, 2
cmp rcx, rdx
jne 0x1400aca40
ret
int3
Function at 0x1400b2c20
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1401d52c8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x120], 0
jne 0x1400b2c4b
call fcn.140151a78
mov eax, dword [0x1401d52c8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x188], 1
je 0x1400b2c72
mov ecx, dword [rsi + 0x1928]
test ecx, ecx
je 0x1400b2c76
xor edi, edi
jmp 0x1400b2cd3
mov ecx, 1
lock xadd dword [rsi + 0x1928], ecx
cmp ecx, 0x7fffffff
je 0x1400b2cde
test rsi, rsi
je 0x1400b2ce1
lea rbx, [rax + 0x188]
call fcn.1400e4b00
mov edx, 0x568
mov rcx, rax
xor r8d, r8d
call fcn.1400260d0
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.1400b3700
mov ecx, dword [0x1401d84b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rbx], rdi
lock dec dword [rsi + 0x1928]
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
int3
int3

Function at 0x1400b35b0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
cmp dword [rcx + 0xb78], 0x8000
jne 0x1400b36da
mov rsi, rcx
movzx eax, word [0x1401c8668]
lea rax, [rax + rax*4]
cmp dword [rcx + rax*8 + 0x60], 0x200
jne 0x1400b36dd
lea rcx, [0x1401c8620]
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400b35fd
cmp byte [0x1401d8508], 0
je 0x1400b3612
jmp 0x1400b3650
lea rcx, [0x1401c8620]
call fcn.1400b4580
cmp byte [0x1401d8508], 0
jne 0x1400b3650
cmp qword [0x1401de190], 0
jne 0x1400b36e3
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400b36e6
mov dword [0x1401d84b0], eax
mov dword [0x1401de198], eax
lea rax, [0x1400b3340]
mov qword [0x1401de190], rax
mov byte [0x1401d8508], 1
lea rcx, [0x1401c8620]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg qword [0x1401d8510], rsi
jne 0x1400b36e0
lea rax, [0x1400b36f0]
mov qword [0x1401de1a0], rax
add rsi, 0x48
xor eax, eax
lea rcx, [0x1401d84c0]
jmp 0x1400b36a2
xor edx, edx
mov byte [rax + rcx], dl
inc rax
add rsi, 0x28
cmp rax, 0x48
je 0x1400b36d4
cmp qword [rsi], 0
je 0x1400b3690
mov r8d, dword [rsi + 0x18]
mov dl, 0x80
cmp r8d, 0x81
jb 0x1400b3692
mov dl, 0x40
cmp r8d, 0x101
jb 0x1400b3692
cmp r8d, 0x201
setb dl
shl dl, 4
add dl, 0x10
jmp 0x1400b3692
add rsp, 0x20
pop rsi
ret
int3
int3
int3
int3
int3