joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011b9b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x194f239f
add rsp, 0x194f216f
mov r8, qword [0x1401403e0]
mov r15, r15
xchg rbx, r9
mov r9, rcx
xchg rbx, r9
movabs rcx, 0x72485a7f75fd6b30
sub rcx, 0x270277d5
xor rcx, 0x53cbd52
add rcx, 0x7fffffff
sub rcx, 0x20ea44a7
movabs rax, 0x2ea929bd193ec8b3
add rax, 0x4e8c945c
xor rax, 0x65133c2d
add rax, 0x25b0c345
add r8, rcx
xchg rdi, rdi
mov edx, 0x7797499e
xor edx, 0x355558c2
xor edx, 0x13bbc221
sub edx, 0x4a71edfc
sub edx, 0x707e47d
ror r8, 1
mov dword [rsp - 0x14], 0x3de54494
lea rcx, [rsp + 0x20]
xor r8, rax
movabs rax, 0x65f425507be27f6c
sub rax, 0x24441f86
xor rax, 0x32603799
add rax, 0x1dc7320b
rol r8, 3
rol r8, 0xc
rol r8, 2
rol r8, 2
xor r8, rax
call r8
mov dword [rsp - 0x20], esi
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
xchg r8, r8
nop
movabs rdx, 0xffffffff4c1becc8
xor rdx, 0x5ae75959
xor rdx, 0x129ace53
add rdx, 0x7fffffff
add rdx, 0x7b99843e
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg r14, rax
movups xmmword [r14 + 0x10], xmm0
xchg r14, rax
xchg r11, rax
movups xmmword [r11 + 0x20], xmm0
xchg r11, rax
lea rax, [rsp + 0x20]
mov r8, r8
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011bad8
mov dword [rsp - 0x38], ebx
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
xchg rsp, rdx
mov qword [rbx + 0x38], rsp
xchg rsp, rdx
call fcn.140017b44
xchg r10, r10
xor r8d, r8d
mov edx, 0x69db213c
sub edx, 0x30b007b4
add edx, 0x36e01667
xor edx, 0x393779db
sub edx, 0x1f24fcb9
cmp qword [rbx + 0x38], r8
mov dword [rsp - 0x18], 0x23eedab0
jbe 0x14011bb93
lea r9, [rsp + 0x20]
mov r10d, 0x21ae9fdb
xor r10d, 0x4d932393
xor r10d, 0xb4faee7
sub r10d, 0x677211b0
sub r9, rax
movzx ecx, dx
lea rax, [rax + 2]
mov rcx, rcx
and cx, r10w
ror edx, 3
ror edx, 2
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [r9 + rax - 2]
inc r8
mov dword [rsp - 0x40], ebp
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x14011bb5a
mov dword [rsp - 0x30], ebp
xchg rbx, r11
mov rax, r11
xchg rbx, r11
sub rsp, 0x2bf31ed4
add rsp, 0x2bf32104
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x140131cf0
Capabilities:
Execute syscall

Disassembly:
xchg rcx, r14
mov r10, r14
xchg rcx, r14
mov eax, dword [0x140140ba4]
mov dword [rsp - 0x1c], esp
cmp qword [0x140140bb8], 0
jne 0x14008c4e0
syscall
ret
jmp 0x14008d016
Function at 0x1401343d8
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rsi, rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp - 0x18], edi
mov qword [rsp + 0x18], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
mov qword [rsp], r12
push r14
xchg rbp, r9
mov r9, rsp
xchg rbp, r9
add rsp, 0xffffffffffffff90
mov dword [rsp - 0x10], esp
mov rdi, r8
xchg r13, rdx
mov r14, r13
xchg rdx, r13
xchg rdx, rsi
mov rdx, rcx
xchg rdx, rsi
movabs r12, 0x6eb140cb221a96d4
add r12, 0x28f44343
add r12, 0x331cf919
sub r12, 0x61104401
xor r12, 0x7ffee290
cmp r9d, 0x60001
jne 0x140134601
mov rsi, rsi
mov dword [rbp - 0x40], 0x34e755df
xor dword [rbp - 0x40], 0x7abf89a3
xor dword [rbp - 0x40], 0x623f781d
sub dword [rbp - 0x40], 0x131ae61f
xor edx, edx
mov dword [rsp - 0x34], 0x7889589
mov dword [rbp - 0x3c], 0x4d2ca73a
sub dword [rbp - 0x3c], 0x324e1ebd
add dword [rbp - 0x3c], 0x4c03c1a6
sub dword [rbp - 0x3c], 0x4e60e5f1
mov dword [rbp - 0x38], 0x58bf9b5a
xor dword [rbp - 0x38], 0x63c9de26
add dword [rbp - 0x38], 0xbd38d9e
xor dword [rbp - 0x38], 0x39644336
add dword [rbp - 0x38], 0x76e777c6
mov ecx, edx
xchg r9, r9
mov eax, 0x56294649
xor eax, 0x6b7bfb85
sub eax, 0x2c317700
xor eax, 0x25a6a3ad
xor eax, 0x132f8462
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov dword [rsp - 0xc], 0x7359017b
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
xchg r13, r13
jb 0x1401344c2
mov r9d, 0x4ebd5a25
sub r9d, 0x21136f7c
sub r9d, 0x2d8ac46b
xor r9d, 0x6a714f53
xor r9d, 0x6a6e6692
mov qword [rsp + 0x20], 0x761ca4a9
xor qword [rsp + 0x20], 0x35d07e0a
xor qword [rsp + 0x20], 0x2d2231d5
sub qword [rsp + 0x20], 0x6eeeeb6a
lea r8, [rbp - 0x34]
xchg r9, rdx
mov r9, rdi
xchg rdx, r9
xchg rbp, r14
mov rcx, rbp
xchg r14, rbp
call fcn.140131908
mov dword [rsp - 0x44], esi
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rdi, [rbp - 0x34]
xor eax, eax
mov r12, r12
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
je 0x140134656
xchg r8, r8
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.14008e7f0
mov dword [rsp - 0x24], 0x3b9274db
test dword [rbp - 7], 0x1000
jne 0x140134656
cmp byte [rbp - 0x1d], 0xe8
jne 0x140134656
mov dword [rsp - 0x2c], edi
lea rdx, [rbx + 0xc]
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
call fcn.140084180
mov dword [rsp - 0x44], 0x5c9f7ca4
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
add edx, eax
mov r11, r11
xchg r9, rax
mov r9, qword [rsi + 8]
xchg r9, rax
xor rax, r12
add rdx, rax
xor rdx, r12
mov dword [rsp - 0xc], 0x58bd50ff
xchg rdx, r11
mov qword [rsi + 0x20], r11
xchg r11, rdx
cmp qword [rsi + 0x20], r12
mov rdi, rdi
setne al
lea r11, [rsp + 0x70]
xchg rbx, r15
mov r15, qword [r11 + 0x20]
xchg rbx, r15
mov rsi, qword [r11 + 0x28]
mov dword [rsp - 0x34], 0x3023d88e
xchg rdi, rsi
mov rsi, qword [r11 + 0x30]
xchg rsi, rdi
xchg r10, r11
mov rsp, r10
xchg r11, r10
pop r14
mov dword [rsp - 0x20], 0x29f59a30
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
xor al, al
jmp 0x14013460b
Function at 0x1400043e0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14000bf40
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14000bf7d
test rdx, rdx
je 0x14000bf7d
mov rax, qword [rax]
cmp rax, r9
jne 0x14000bf60
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret
Function at 0x140004bd0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14030ff08]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + pe_nt_image_headers64]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140005430
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov esi, ecx
movsxd rbx, edx
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rdi, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_QueryPerformanceFrequency
mov r14d, 0x1e
mov rdx, rbx
imul rdx, qword [rsp + 0x50]
movabs rax, 0x431bde82d7b634db
imul rdx
mov rbp, rdx
sar rbp, 0x12
mov rax, rbp
shr rax, 0x3f
add rbp, rax
add rbp, rdi
cmp esi, r14d
cmovb r14d, esi
xor edi, edi
test r14d, r14d
jle 0x1400054d2
mov ebx, 1
test ebx, ebx
jle 0x1400054b8
mov eax, ebx
nop dword [rax]
pause
sub rax, 1
jne 0x1400054b0
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_QueryPerformanceCounter
cmp qword [rsp + 0x50], rbp
jg 0x1400054d2
inc edi
rol ebx, 1
cmp edi, r14d
jl 0x1400054a3
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400054f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x58]
movzx esi, dl
mov r8d, dword [0x14030ff08]
mov rbp, rcx
mov rdi, qword [rax + r8*8]
mov eax, 0x100
cmp byte [rax + rdi], 0
jne 0x140005530
call fcn.140069b9c
mov ebx, 0x10
add rbx, rdi
mov rcx, rbx
call fcn.140007c20
xor r14d, r14d
lea rcx, [rbp + 0x10]
test al, al
cmovne r14, rbx
call fcn.14000ca40
mov qword [0x1403090c8], r14
test sil, sil
je 0x14000556e
mov rcx, qword [0x140309370]
mov rax, qword [rcx]
call qword [rax + 0x1c0]
mov eax, dword [0x1403090c0]
or eax, 2
mov dword [0x1403090c0], eax
call sub.KERNEL32.dll_FlushProcessWriteBuffers
xor r15d, r15d
xor esi, esi
xor dil, dil
movabs r12, 0x431bde82d7b634db
mov ebp, esi
xor esi, esi
call fcn.140008570
mov rcx, rax
call fcn.1400085d0
mov r8b, 1
lea rcx, [rsp + 0x20]
lea rdx, [rax + 0x10]
call fcn.14000c800
call fcn.140008570
mov rcx, rax
call fcn.1400085d0
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140005605
mov rax, qword [rbx + 0x58]
mov qword [rsp + 0x30], rax
cmp rbx, r14
je 0x1400055d0
mov rcx, rbx
call fcn.140007320
test al, al
jne 0x1400055d0
inc esi
test dil, dil
jne 0x1400055d0
mov rcx, rbx
call fcn.1400078c0
jmp 0x1400055d0
lea rcx, [rsp + 0x20]
call fcn.14000ca20
test esi, esi
je 0x1400056c0
cmp esi, ebp
jl 0x140005647
test dil, dil
je 0x140005647
mov edx, 0x64
mov ecx, r15d
call fcn.140005430
inc r15d
xor dil, dil
test r15b, 0x7f
jne 0x140005594
call sub.KERNEL32.dll_SwitchToThread
jmp 0x140005594
lea rcx, [rsp + 0x70]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call sub.KERNEL32.dll_QueryPerformanceFrequency
mov rax, qword [rsp + 0x70]
lea rcx, [rax + rax*4]
mov rax, r12
imul rcx
mov rbp, rdx
sar rbp, 0x12
mov rax, rbp
shr rax, 0x3f
add rbp, rax
add rbp, rbx
mov ebx, 1
xor edi, edi
nop word [rax + rax]
test ebx, ebx
jle 0x14000569e
mov eax, ebx
pause
sub rax, 1
jne 0x140005696
lea rcx, [rsp + 0x70]
call sub.KERNEL32.dll_QueryPerformanceCounter
cmp qword [rsp + 0x70], rbp
jg 0x1400056b8
inc edi
rol ebx, 1
cmp edi, 0x1e
jl 0x140005690
mov dil, 1
jmp 0x140005594
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000c350
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x1400078dd
mov eax, dword [rcx + 0x38]
shr eax, 7
test al, 1
jne 0x1400078dd
mov rdx, rcx
mov rcx, qword [rcx + 0x60]
jmp 0x14000c350
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x140302178]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14000c3c0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x40100003
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000c3b7
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x14000c3b7
test eax, 0x18000000
jne 0x14000c3b7
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [0x1403094b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140069ca0
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret

Function at 0x14000c5a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14000c5b4
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000c640
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000c669
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x14000c680
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov qword [rsp + 0x28], 0
mov r8, rcx
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x14000c6b5
add rsp, 0x30
pop rbx
ret
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14000cb70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x1403094b8]
test al, al
jne 0x14000cd21
lea rcx, [0x1403094c0]
call fcn.14000cb40
movzx eax, byte [0x1403094b8]
test al, al
je 0x14000cbab
lea rcx, [0x1403094c0]
call fcn.14000cb60
add rsp, 0x28
ret
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rbp
call sub.KERNEL32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14000cd09
mov rbp, qword [rsp + 0x30]
cmp rbp, 0x64
jl 0x14000cd09
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
mov qword [rsp + 0x48], rsi
imul rbp
mov qword [rsp + 0x20], rdi
xor edi, edi
lea rbx, [rdx + rbp]
sar rbx, 6
mov rax, rbx
shr rax, 0x3f
add rbx, rax
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rsi, qword [rsp + 0x30]
mov eax, 0x3e8
pause
sub rax, 1
jne 0x14000cc15
lea rcx, [rsp + 0x30]
add edi, 0x3e8
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x30]
sub rax, rsi
cmp rax, rbx
jl 0x14000cc10
movsd xmm3, qword [0x14029a948]
xorps xmm1, xmm1
mov rsi, qword [rsp + 0x48]
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x38]
xorps xmm2, xmm2
cvtsi2sd xmm0, rbp
mov ecx, 1
cvtsi2sd xmm2, rax
mov eax, edi
cvtsi2sd xmm1, rax
mulsd xmm2, qword [0x14029a960]
mulsd xmm1, xmm0
movsd xmm0, qword [0x14029a950]
divsd xmm2, xmm1
movsd xmm1, qword [0x14029a958]
maxsd xmm3, xmm2
divsd xmm0, xmm3
addsd xmm0, qword [0x14029a940]
cvttsd2si edx, xmm0
cmp edx, ecx
cmovl edx, ecx
mov dword [0x1403016a0], edx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
divsd xmm1, xmm0
addsd xmm1, qword [0x14029a940]
cvttsd2si eax, xmm1
movd xmm1, edx
cmp eax, ecx
cvtdq2ps xmm1, xmm1
cmovl eax, ecx
mov dword [0x1403016a4], eax
mov byte [0x1403094b8], cl
mov rcx, qword [0x140309370]
mov rax, qword [rcx]
call qword [rax + 0x180]
lea rcx, [0x1403094c0]
call fcn.14000cb60
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
ret
lea rcx, [0x1403094c0]
mov byte [0x1403094b8], 1
call fcn.14000cb60
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x14000ee40
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x140302178]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [str.DOTNET_]
mov rbp, rcx
lea rcx, [rsp + 0x40]
xorps xmm1, xmm1
movzx r15d, r9b
movaps xmmword [rsp + 0x40], xmm0
mov r12, r8
movups xmmword [rsp + 0x50], xmm1
mov r14, rdx
sub rcx, 2
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rsp + 0x80], xmm1
movups xmmword [r11 - 0x78], xmm1
movups xmmword [r11 - 0x68], xmm1
movups xmmword [r11 - 0x58], xmm1
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14000eeb0
xor edx, edx
nop dword [rax]
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14000eec0
mov r8d, 9
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call sub.KERNEL32.dll_GetEnvironmentVariableW
xor ebx, ebx
mov r10d, eax
lea ecx, [rax - 1]
cmp ecx, 7
jbe 0x14000efa6
mov rax, qword [rbp]
test rax, rax
jne 0x14000ef09
mov rcx, rbp
call fcn.14000f040
mov rax, qword [rbp]
cmp rax, 1
je 0x14000f01b
mov rbp, qword [rbp]
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov edi, ebx
nop dword [rax]
movsxd rsi, edi
mov rcx, r14
imul rdx, rsi, 0x78
add rdx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsicmp
test eax, eax
je 0x14000ef52
inc edi
cmp edi, 9
jl 0x14000ef30
mov r10d, ebx
jmp 0x14000ef91
xor r9b, r9b
mov r8d, ebx
mov rdx, rbx
nop dword [rax + rax]
imul rax, rsi, 0x3c
add rax, rdx
movzx ecx, word [rbp + rax*2 + 0x66]
mov word [rsp + rdx*2 + 0x20], cx
test cx, cx
je 0x14000ef84
inc r8d
inc rdx
cmp r8d, 9
jb 0x14000ef60
jmp 0x14000ef87
mov r9b, 1
test r9b, r9b
mov r10d, ebx
cmovne r10d, r8d
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
test r10d, r10d
je 0x14000f01b
cmp r10d, 9
jae 0x14000f01b
mov r8d, ebx
test r10d, r10d
je 0x14000f013
lea r9, [rsp + 0x20]
nop dword [rax]
movzx edx, word [r9]
lea eax, [rdx - 0x30]
test r15b, r15b
je 0x14000efdd
cmp ax, 9
ja 0x14000f01b
lea ebx, [rbx + rbx*4]
lea ebx, [rbx - 0x18]
lea ebx, [rdx + rbx*2]
jmp 0x14000f007
shl ebx, 4
cmp ax, 9
ja 0x14000efeb
add ebx, 0xffffffd0
jmp 0x14000f005
lea eax, [rdx - 0x61]
cmp ax, 5
ja 0x14000eff9
add ebx, 0xffffffa9
jmp 0x14000f005
lea eax, [rdx - 0x41]
cmp ax, 5
ja 0x14000f01b
add ebx, 0xffffffc9
add ebx, edx
inc r8d
add r9, 2
cmp r8d, r10d
jb 0x14000efc0
mov dword [r12], ebx
mov al, 1
jmp 0x14000f01d
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140069ca0
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x140013ab0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x140302178]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x140013b9f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x140013b9f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x140013b7a
xorps xmm0, xmm0
test rdx, rdx
js 0x140013b21
cvtsi2ss xmm0, rdx
jmp 0x140013b39
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x14029b218]
test rdi, rdi
js 0x140013b53
cvtsi2ss xmm0, rdi
jmp 0x140013b6b
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x140013b91
cmp rdx, rdi
jbe 0x140013b8b
mov qword [rbx], rax
jmp 0x140013b91
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x140013c68
jmp 0x140013c65
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140013c42
test r14, r14
je 0x140013c31
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x140013bdb
cvtsi2ss xmm0, rcx
jmp 0x140013bf0
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x14029b218]
test rdx, rdx
js 0x140013c0a
cvtsi2ss xmm0, rdx
jmp 0x140013c22
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x140013c39
mov qword [rbx], rdx
test rsi, rsi
je 0x140013c68
xor eax, eax
jmp 0x140013c65
test r14, r14
je 0x140013c4e
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x140013c5b
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x140013c68
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140069ca0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret
Function at 0x140013c90
Capabilities:
Get memory capacity

Disassembly:
push rdi
sub rsp, 0x1b0
mov rax, qword [0x140302178]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rcx
test rcx, rcx
je 0x140013cb6
mov byte [rcx], 0
mov rax, qword [0x1403016d8]
cmp rax, 0xffffffffffffffff
jne 0x140013e40
mov qword [rsp + 0x1c8], rbx
xor ebx, ebx
mov qword [rsp + 0x1d0], rbp
mov rbp, rax
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1a8], r14
mov r14d, ebx
mov qword [rsp + 0x1a0], r15
mov r15d, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x140013dc3
cmp dword [rsp + 0x30], ebx
je 0x140013dc3
mov r9d, 0x90
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x100]
xor ecx, ecx
lea edx, [rbp + 0xa]
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x140013dc3
mov eax, dword [rsp + 0x110]
mov rdx, rbp
bt eax, 9
mov rcx, rbp
mov rsi, rbp
cmovb rdx, qword [rsp + 0x178]
bt eax, 8
cmovb rcx, qword [rsp + 0x170]
test al, 1
cmovne rsi, qword [rsp + 0x120]
cmp rdx, rbp
jne 0x140013d8c
cmp rcx, rbp
jne 0x140013d8c
cmp rsi, rbp
je 0x140013dc3
cmp rdx, rcx
mov dword [rsp + 0x40], 0x40
cmovb rcx, rdx
cmp rcx, rsi
cmovb rsi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x68]
cmp rsi, rbp
mov r14, qword [rsp + 0x50]
cmovb rbp, rsi
cmp rbp, 0xffffffffffffffff
mov rsi, rbx
cmovne rsi, rbp
mov rbp, qword [rsp + 0x1d0]
test r15, r15
jne 0x140013e04
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r15, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x88]
test rsi, rsi
cmovne r14, rsi
cmp r15, r14
mov r15, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x1a8]
cmovae rbx, rsi
mov rsi, qword [rsp + 0x1d8]
mov qword [0x1403016d8], rbx
mov rax, qword [0x1403016d8]
mov rbx, qword [rsp + 0x1c8]
mov rcx, rax
test rax, rax
je 0x140013e52
test rdi, rdi
je 0x140013e84
mov byte [rdi], 1
jmp 0x140013e84
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0xc8]
cmp qword [rsp + 0xe8], rax
cmovb rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140069ca0
add rsp, 0x1b0
pop rdi
ret

Function at 0x140013ec0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140302178]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069ca0
add rsp, 0x78
ret