joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d5a0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14014ead0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14005d618
cmp word [rsp + 0x70], 0
je 0x14005d618
mov qword [rsp + 0x60], rdi
mov rcx, rdi
call fcn.14016c344
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400784a0
jmp 0x14005d67d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.14005d4b0
test al, al
je 0x14005d64a
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x14005d67d
lea rax, [0x1401a3c84]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 3
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400784a0
cmp byte [rsp + 0x57], 0
jns 0x14005d67d
mov rcx, qword [rsp + 0x40]
call fcn.14014b4e4
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret
Function at 0x14005df30
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x2c0
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, [0x1401a3ce6]
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov r9d, 0x432
call fcn.1400763c0
lea rcx, [rsp + 0x60]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0xa8], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005e0ab
lea rbx, [rsp + 0xb0]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.14014ead0
mov word [rsp + 0xb0], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x14005e067
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call fcn.14016c344
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400784a0
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14007b1e0
cmp byte [rsi + 0x17], 0
jns 0x14005e039
mov rcx, qword [rsi]
call fcn.14014b4e4
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x14005e067
mov rcx, qword [rsp + 0x30]
call fcn.14014b4e4
mov qword [rsp + 0x48], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005e0db
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x60]
call fcn.1400a3590
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0x2c0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
mov qword [rsp + 0x48], rdi
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0xa8]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x48]
call fcn.140062630
jmp 0x14005dfbe
movzx ecx, al
mov qword [rsp + 0xb0], 0
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0xb0]
mov r9d, 2
call fcn.140032900
jmp 0x14005e07b
Function at 0x14005e110
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [0x1401a3cfb]
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x442
call fcn.1400763c0
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0x80], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005e1e8
cmp byte [rsi + 0x17], 0
jns 0x14005e19a
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
mov qword [rsp + 0x90], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005e22e
test esi, esi
setne bl
lea rcx, [rsp + 0x40]
call fcn.1400a3590
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
mov qword [rsp + 0x90], rdi
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x88]
lea r9, [rsp + 0x90]
call fcn.140062630
cmp byte [rsi + 0x17], 0
js 0x14005e197
jmp 0x14005e19a
movzx ecx, al
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0x20]
mov r9d, 2
call fcn.140032900
jmp 0x14005e1bc
Function at 0x14005ee60
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea r14, [rsp + 0x78]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.14014ead0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.140097270
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x60], xmm0
lea rdi, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
call fcn.1400974a0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x14005ef0f
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14005f044
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r14, [rsp + 0x78]
lea r15, [rsp + 0x48]
xor r12d, r12d
jmp 0x14005ef3c
mov r12d, ebp
test rcx, rcx
je 0x14005f044
cmp byte [rsp + 0x78], 0
je 0x14005efc0
mov esi, dword [rsp + 0x7c]
test sil, 1
je 0x14005ef74
test sil, 0x10
je 0x14005ef5d
xor ebp, ebp
test bl, bl
je 0x14005eff3
mov rcx, rdi
test al, al
jns 0x14005ef69
mov rcx, qword [rsp + 0x60]
mov edx, esi
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test sil, 0x10
je 0x14005efc5
xor ebp, ebp
test bl, bl
je 0x14005eff3
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
mov r8b, 1
call fcn.14005ee60
mov ebp, eax
test eax, eax
jne 0x14005eff3
cmp byte [rsp + 0x77], 0
mov rcx, rdi
jns 0x14005efa5
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14005eff3
jmp 0x14005efdd
call fcn.1400814b0
cmp byte [rsp + 0x77], 0
mov rcx, rdi
jns 0x14005efd4
mov rcx, qword [rsp + 0x60]
call r13
xor ebp, ebp
test eax, eax
jne 0x14005eff3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
mov rdx, r15
call fcn.1400974a0
cmp byte [rsp + 0x77], 0
jns 0x14005f016
mov rcx, qword [rsp + 0x60]
call fcn.14014b4e4
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x14005ef30
mov rcx, qword [rsp + 0x68]
jmp 0x14005ef30
test al, al
jns 0x14005f052
mov rcx, qword [rsp + 0x60]
call fcn.14014b4e4
lea rcx, [rsp + 0x78]
call fcn.140097410
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebp
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14006c6e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov r14, 0xfffffffffffffffe
sub r14, rdx
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
nop dword [rax]
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14006c789
mov rax, qword [rsp + 0x20]
cmp rax, r14
ja 0x14006c730
mov rcx, rax
or rcx, rbx
shr rcx, 0x20
je 0x14006c766
xor edx, edx
div rbx
mov rdi, rdx
jmp 0x14006c76c
xor edx, edx
div ebx
mov edi, edx
add edi, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014c9b0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
int3
Function at 0x140072860
Capabilities:
Delete file
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [0x1401d31f0]
test rdi, rdi
je 0x1400729b1
lea r14, [0x1401a4b33]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 1
lea rbx, [rdi + 0x30]
lea r15, [rdi + 0x38]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.140081170
lea r12, str.vmodule
cmp qword [rsp + 0x30], r15
jne 0x1400728f7
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.140081170
cmp qword [rsp + 0x30], r15
je 0x1400729b1
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 7
lea rbx, [rsp + 0x58]
lea r8, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
call fcn.14007e930
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 1
lea r14, [rsp + 0x30]
lea r8, [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
call fcn.14007e930
mov ecx, 0x20
call fcn.14014b4a8
mov rdi, rax
lea r9, [0x1401d3120]
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.1400ae510
cmp byte [rsp + 0x47], 0
js 0x140072974
cmp byte [rsp + 0x6f], 0
js 0x140072985
test rdi, rdi
jne 0x140072994
jmp 0x1400729b1
mov rcx, qword [rsp + 0x30]
call fcn.14014b4e4
cmp byte [rsp + 0x6f], 0
jns 0x14007296d
mov rcx, qword [rsp + 0x58]
call fcn.14014b4e4
test rdi, rdi
je 0x1400729b1
xor eax, eax
lock cmpxchg qword [0x1401d3130], rdi
je 0x1400729b1
mov rcx, rdi
call fcn.1400aea60
mov rcx, rdi
call fcn.14014b4e4
mov eax, dword [rsi]
mov dword [0x1401c3550], eax
test al, 1
jne 0x1400729da
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014c9b0
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [0x1401d3128]
test rcx, rcx
je 0x140072a0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401d3128], 0
mov rcx, qword [0x1401d3118]
test rcx, rcx
jne 0x140072a3a
and byte [0x1401c3550], 0xfe
jmp 0x140072a18
mov rcx, qword [0x1401d3118]
test rcx, rcx
jne 0x140072a3a
mov ecx, 0x18
call fcn.14014b4a8
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1401d3118], rax
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140072a84
call fcn.140050e2a
cmp dword [rsi + 0x14], 0
jne 0x140072a64
mov rcx, qword [0x1401d3118]
cmp byte [rcx + 0x17], 0
jns 0x140072a5e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014c9b0
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140072a90
int3
Function at 0x140083bac
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x140083bec
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x140083bfc
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
test rbx, rbx
je 0x140083d49
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140083d49
lea r14, [rsp + 0x50]
mov rax, qword [r14]
movzx ebp, word [rax]
movzx r15d, word [rax + 2]
mov word [rsp + 0x260], bp
mov word [rsp + 0x262], r15w
mov r12, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r12
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], r15w
mov word [rsp + 0x268], bp
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call r12
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
mov rbp, 0xfffffffffffffffe
lea r15, str.StringFileInfo_04hx_04hx_ls
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14014ead0
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x140083cce
mov rax, qword [rdi]
movzx ecx, word [rsp + rbp*2 + 0x264]
movzx edx, word [rsp + rbp*2 + 0x266]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
mov r9, r15
call fcn.14005f3d0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, rbx
mov rdx, r14
mov r8, r12
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140083d31
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jne 0x140083d41
add rbp, 2
cmp rbp, 5
jbe 0x140083cb2
jmp 0x140083d49
mov rcx, rsi
call fcn.140050e2a
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14014c9b0
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140085a18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov rcx, qword [rcx + 8]
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x84], 0
je 0x140085a61
add rax, rcx
cmp word [rax + 0x14], 0x78
jb 0x140085a61
add rax, 0x88
je 0x140085a61
mov r8d, dword [rax]
test r8, r8
je 0x140085a61
add r8, rcx
je 0x140085a61
cmp rdx, 0xffff
ja 0x140085a6a
mov r10d, dword [r8 + 0x10]
jmp 0x140085b16
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [r8 + 0x18]
mov r10d, dword [r8 + 0x20]
lea r9, [rcx + r10]
test r10, r10
cmove r9, r10
lea r10, [r9 + rax*4]
lea r11, [rdx + 1]
xor eax, eax
mov rsi, r9
cmp rsi, r10
je 0x140085a63
mov rdi, r10
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
shr rdi, 0x3f
add rdi, rbx
and rdi, 0xfffffffffffffffe
mov r14d, dword [rsi + rdi*2]
lea rbx, [rcx + r14]
test r14, r14
cmove rbx, r14
mov bpl, byte [rdx]
test bpl, bpl
je 0x140085adc
mov r14, r11
cmp bpl, byte [rbx]
jne 0x140085ad6
inc rbx
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140085ac1
xor ebp, ebp
movzx ebp, bpl
jmp 0x140085ade
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ebx, byte [rbx]
lea r14, [rdi + 4]
cmp ebp, ebx
cmovg rsi, r14
cmovs r10, rdi
jne 0x140085a8a
mov r10d, dword [r8 + 0x10]
mov eax, dword [r8 + 0x24]
lea rdx, [rcx + rax]
test rax, rax
cmove rdx, rax
sub rdi, r9
sar rdi, 1
movzx edx, word [rdx + rdi]
add dx, r10w
mov eax, dword [r8 + 0x1c]
add rcx, rax
test rax, rax
cmove rcx, rax
movzx eax, dx
lea rax, [rcx + rax*4]
mov ecx, r10d
shl rcx, 2
sub rax, rcx
jmp 0x140085a63

Function at 0x140085bda
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140085c11
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140085c11
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140085c11
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x14008acb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x14008acc5
mov r8d, r8d
add rsp, 0x28
jmp fcn.14008a410
test r8d, r8d
jne 0x14008ace4
lea rcx, [0x1401d5d48]
lea rdx, [0x1400bc3b0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret

Function at 0x14008d4c0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401d3290]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14008d614
jp 0x14008d614
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401d32a0]
mov ecx, dword [0x1401d0348]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008d634
mov eax, dword [0x1401d32b0]
mov ecx, dword [0x1401d0348]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008d66e
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r14, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r14, qword [0x1401d32a8]
xorps xmm0, xmm0
cvtsi2sd xmm0, r14
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x140199ac0]
ucomisd xmm1, xmm0
ja 0x14008d614
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401d3298]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x140199aa0]
subpd xmm1, xmmword [0x140199ab0]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401d3290], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014c9b0
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401d32a0]
call fcn.14014b600
cmp dword [0x1401d32a0], 0xffffffff
jne 0x14008d542
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401d3298], rdx
lea rcx, [0x1401d32a0]
call fcn.14014b698
jmp 0x14008d542
lea rcx, [0x1401d32b0]
call fcn.14014b600
cmp dword [0x1401d32b0], 0xffffffff
jne 0x14008d567
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1401d32a8], rax
lea rcx, [0x1401d32b0]
call fcn.14014b698
jmp 0x14008d567
Function at 0x14008e7b0
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x7c], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x1401a7610]
movups xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x1401a7620]
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x8c], 0x20
lea rcx, [rsp + 0x20]
call fcn.14008ebd0
mov ebx, dword [rsp + 0x8c]
mov ebp, dword [rsp + 0x40]
mov r14d, dword [rsp + 0x44]
lea rdi, [rsp + 0x48]
mov eax, dword [rsp + 0x88]
lea rcx, [rax + 1]
mov byte [rsp + rax + 0x48], 0x80
cmp rax, 0x38
jb 0x14008e87b
cmp eax, 0x3f
je 0x14008e864
mov r8d, 0x3f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.14014ead0
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.14008ece0
xor ecx, ecx
jmp 0x14008e881
cmp rcx, 0x38
je 0x14008e894
mov r8d, 0x38
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.14014ead0
bswap r14d
bswap ebp
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0x84], ebp
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.14008ece0
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
cmp ebx, 0x20
ja 0x14008e94b
cmp ebx, 4
jb 0x14008e94b
shr ebx, 2
mov eax, dword [rsp + 0x20]
bswap eax
mov dword [rsi], eax
cmp ebx, 1
je 0x14008e94b
mov eax, dword [rsp + 0x24]
bswap eax
mov dword [rsi + 4], eax
cmp ebx, 2
je 0x14008e94b
mov eax, dword [rsp + 0x28]
bswap eax
mov dword [rsi + 8], eax
cmp ebx, 3
je 0x14008e94b
mov eax, dword [rsp + 0x2c]
bswap eax
mov dword [rsi + 0xc], eax
cmp ebx, 4
je 0x14008e94b
mov eax, dword [rsp + 0x30]
bswap eax
mov dword [rsi + 0x10], eax
cmp ebx, 5
je 0x14008e94b
mov eax, dword [rsp + 0x34]
bswap eax
mov dword [rsi + 0x14], eax
cmp ebx, 6
je 0x14008e94b
mov eax, dword [rsp + 0x38]
bswap eax
mov dword [rsi + 0x18], eax
cmp ebx, 7
je 0x14008e94b
mov eax, dword [rsp + 0x3c]
bswap eax
mov dword [rsi + 0x1c], eax
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140095fd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400960bf
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x70], 0xaaaaaaaa
mov word [rsp + 0x30], 0x401
mov dword [rsp + 0x32], 0
mov word [rsp + 0x36], 0
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x38], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400960c2
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
test eax, eax
je 0x14009608f
mov ebx, eax
mov rcx, rbx
call fcn.14014b4a8
mov rdi, rax
lea r14, [rax + rbx]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r8, rbx
call fcn.14014e420
jmp 0x140096094
xor r14d, r14d
xor edi, edi
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
int3
Function at 0x1400ae480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
mov rcx, qword [rdx]
mov r8, qword [rdx + 8]
lea rdx, [rcx + r8]
test r8, r8
js 0x1400ae4ff
je 0x1400ae4fe
test r8b, 1
je 0x1400ae4b6
movzx r9d, byte [rcx]
movzx r10d, al
xor r10d, r9d
lea r9, [0x1401a4d50]
shr eax, 8
xor eax, dword [r9 + r10*4]
inc rcx
cmp r8, 1
je 0x1400ae4fe
lea r8, [0x1401a4d50]
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
movzx r10d, al
xor r10d, r9d
shr eax, 8
xor eax, dword [r8 + r10*4]
movzx r9d, byte [rcx + 1]
movzx r10d, al
xor r10d, r9d
shr eax, 8
xor eax, dword [r8 + r10*4]
add rcx, 2
cmp rcx, rdx
jne 0x1400ae4d0
ret
int3