joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140186410
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 5]
mov ebp, 5
cmp eax, 1
jbe 0x14018646a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, r8
mov r15, rdx
mov rbp, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r12d, r12d
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0x50], 0x68
cmp byte [r9 + 0x17], 0
jns 0x1401864bf
mov r9, qword [r9]
mov rcx, r9
call fcn.1400f1508
mov r14, rax
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x1401864da
mov rax, qword [rbp + 8]
mov rbp, qword [rbp]
mov rsi, qword [rsp + 0x138]
test rax, rax
cmove rbp, rax
cmp byte [rbx + 0x17], 0
jns 0x1401864f2
mov rbx, qword [rbx]
mov r15, qword [r15]
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x1401865c6
cmp edi, 6
mov r12d, 0x1fffff
mov ebx, 0x101c01
cmove ebx, r12d
mov r13, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r13
mov r8, r15
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401865dc
cmp edi, 6
mov ebx, 0x100c43
cmove ebx, r12d
mov rdi, qword [rsi + 8]
add rsi, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rdi
mov r8, r15
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test r14, r14
je 0x140186444
mov rcx, r14
call fcn.1400dec10
jmp 0x140186444
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401865c6
Function at 0x1401896c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1401c8a80]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x140189753
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x140189753
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xb3
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.1400d6670
mov rcx, rsi
call fcn.14002ed20
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
Function at 0x140194250
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
mov r15, r9
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
mov r14, qword [rsp + 0x380]
mov rsi, qword [rsp + 0x370]
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], rdx
call fcn.140126140
lea rcx, [rax + 8]
call fcn.14019bb60
test al, al
je 0x140194304
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x368]
mov edx, dword [rsp + 0x360]
mov r8d, dword [rsp + 0x358]
mov r9, qword [rsp + 0x350]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
mov rcx, rbx
mov rdx, rbp
mov r8, r15
call rdi
mov esi, 1
test eax, eax
jne 0x14019434b
call fcn.140126140
lea rcx, [rax + 8]
call fcn.14019a840
xor esi, esi
test al, al
je 0x14019434b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov edx, 0x18
mov rcx, r14
mov r8d, 1
call fcn.1401740d0
test al, al
je 0x140194341
call fcn.140173fd0
test rax, rax
jne 0x14019436d
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rsi, rax
mov qword [rsp + 0x70], 0
lea rdi, [rsp + 0xe0]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400f5b50
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1401943ad
mov qword [rsp + 0x70], rdi
movaps xmm0, xmmword [0x1401c8a80]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx], xmm0
mov rcx, rbx
mov rdx, rsi
call fcn.14019a850
lea rsi, [0x1401e3fa0]
lea rax, [rsp + 0x88]
mov ecx, 0xb
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
movabs rcx, 0xaaaaaaaa00000018
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x370]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0x80]
lea r9, [rsp + 0x70]
mov rcx, rbx
call fcn.14019bb70
mov edi, eax
test eax, eax
jne 0x140194449
mov ecx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp dword [rsp + 0x90], 0
sete sil
test edi, edi
jne 0x140194341
jmp 0x14019434b
Function at 0x140197380
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401c8a80]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.14018ac10
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.140197100
test al, al
je 0x140197447
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401974d3
mov rcx, rdi
call fcn.14018ac10
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.140197100
test al, al
je 0x140197518
cmp dword [r15], 0x4550
jne 0x140197557
mov sil, 1
test r14, r14
je 0x1401974b2
mov qword [r14], rdi
jmp 0x1401974b2
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x1401974b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1400d6670
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14019749d
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400d6670
mov rcx, rdi
call fcn.14002ed20
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x1401974b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140197487
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x1401974b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140197481
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x1401974b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140197487
Function at 0x140197bc0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401c8a80]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.14018ac10
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.140197100
test al, al
je 0x140197c87
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140197d13
mov rcx, rdi
call fcn.14018ac10
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.140197100
test al, al
je 0x140197d58
cmp dword [r15], 0x4550
jne 0x140197d97
mov sil, 1
test r14, r14
je 0x140197cf2
mov qword [r14], rdi
jmp 0x140197cf2
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x140197cf0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1400d6670
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140197cdd
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400d6670
mov rcx, rdi
call fcn.14002ed20
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x140197cf0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140197cc7
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x140197cf0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140197cc1
mov ecx, 1
call fcn.1400e8860
test al, al
je 0x140197cf0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140197cc7
Function at 0x14019e6c0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.14019fb00
mov byte [rsp + 0x37], 0
cmp byte [0x1401f9fd2], 0
je 0x14019e786
mov edi, dword [0x1402003c0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14019e77c
cmp rdi, 1
jbe 0x14019e822
inc qword [rdi + 0x298]
mov rsi, qword [rdi + 0x140]
test rsi, rsi
je 0x14019e854
inc qword [rdi + 0x2a0]
mov rax, qword [rsi]
test rax, rax
je 0x14019e778
mov rcx, rax
not rcx
cmp qword [rsi + 8], rcx
jne 0x14019e8d1
bswap rax
dec byte [rdi + 0x148]
mov qword [rdi + 0x140], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x14019e74d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14019e70d
mov edi, 1
xor ebx, ebx
lea r14, [0x1401f9fd8]
mov rsi, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, r14
call rsi
test al, al
jne 0x14019e7d2
jmp 0x14019e8dd
pause
dec eax
jne 0x14019e7ae
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x14019e7a0
lea rcx, [0x1401f9fd8]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [0x1401fa300]
mov rsi, qword [rax]
test rsi, rsi
je 0x14019e8f4
mov byte [rsp + 0x37], 0
mov rcx, qword [rsi]
test rcx, rcx
je 0x14019e8d6
mov rdx, rcx
not rdx
cmp qword [rsi + 8], rdx
jne 0x14019e8d1
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
lea rcx, [0x1401f9fd8]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x14019e75d
je 0x14019e889
mov byte [0x1401f9fd2], 0
lea rcx, [0x1401f9fd0]
call fcn.1400e9130
mov rdi, rax
mov byte [0x1401f9fd2], 1
inc qword [rax + 0x298]
mov rsi, qword [rax + 0x140]
jmp 0x14019e725
movdqu xmm0, xmmword [rdi + 0x2a8]
pcmpeqd xmm1, xmm1
psubq xmm0, xmm1
movdqu xmmword [rdi + 0x2a8], xmm0
mov edx, 0x14
mov rcx, rdi
call fcn.1400c2020
mov rsi, qword [rdi + 0x140]
test rsi, rsi
jne 0x14019e735
mov edi, 1
xor ebx, ebx
lea rsi, [0x1401f9fd8]
mov rbp, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r14d, 0x40
mov rcx, rsi
call rbp
test al, al
jne 0x14019e7d2
jmp 0x14019e8ec
pause
dec eax
jne 0x14019e8b3
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r14d
cmp ebx, 0x3e8
jl 0x14019e8a4
jmp 0x14019e7c6
call 0x140152a70
xor ecx, ecx
jmp 0x14019e806
mov eax, edi
test edi, edi
jg 0x14019e7ae
jmp 0x14019e7b6
mov eax, edi
test edi, edi
jg 0x14019e8b3
jmp 0x14019e8bb
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401fa300]
lea rdx, [0x1401f9fd0]
mov r9d, 0x58
xor r8d, r8d
call fcn.1400c21b0
mov rsi, rax
jmp 0x14019e810
Function at 0x14019ed50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rcx, [0x1401fb4f0]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rsi]
mov qword [rsi], 0
mov rdi, qword [0x1401fb500]
mov qword [0x1401fb500], rax
test rdi, rdi
jne 0x14019edb0
lea rcx, [0x1401fb4f0]
call fcn.1400e28b0
lea rcx, [0x1401fb4f8]
call sub.KERNEL32.dll_WakeAllConditionVariable
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
jne 0x14019edde
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0x48]
call fcn.14019f140
lea rcx, [rdi + 0x28]
call fcn.14019f480
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14019edd4
mov qword [rdi + 0x18], rcx
call fcn.14019f7c0
mov rcx, rdi
call fcn.14019f7c0
jmp 0x14019ed82
mov rcx, qword [rdi + 0x48]
call fcn.14019f140
lea rcx, [rdi + 0x28]
call fcn.14019f480
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14019ee02
mov qword [rdi + 0x18], rcx
call fcn.14019f7c0
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14019f7c0
Function at 0x1401a1eb0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.14019fb00
mov byte [rsp + 0x37], 0
cmp byte [0x1401f9fd2], 0
je 0x1401a1f76
mov edi, dword [0x1402003c0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x1401a1f6c
cmp rdi, 1
jbe 0x1401a2012
inc qword [rdi + 0x298]
mov rsi, qword [rdi + 0xc0]
test rsi, rsi
je 0x1401a2044
inc qword [rdi + 0x2a0]
mov rax, qword [rsi]
test rax, rax
je 0x1401a1f68
mov rcx, rax
not rcx
cmp qword [rsi + 8], rcx
jne 0x1401a20c1
bswap rax
dec byte [rdi + 0xc8]
mov qword [rdi + 0xc0], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x1401a1f3d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1401a1efd
mov edi, 1
xor ebx, ebx
lea r14, [0x1401f9fd8]
mov rsi, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, r14
call rsi
test al, al
jne 0x1401a1fc2
jmp 0x1401a20cd
pause
dec eax
jne 0x1401a1f9e
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x1401a1f90
lea rcx, [0x1401f9fd8]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [0x1401fa1c0]
mov rsi, qword [rax]
test rsi, rsi
je 0x1401a20e4
mov byte [rsp + 0x37], 0
mov rcx, qword [rsi]
test rcx, rcx
je 0x1401a20c6
mov rdx, rcx
not rdx
cmp qword [rsi + 8], rdx
jne 0x1401a20c1
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
lea rcx, [0x1401f9fd8]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x1401a1f4d
je 0x1401a2079
mov byte [0x1401f9fd2], 0
lea rcx, [0x1401f9fd0]
call fcn.1400e9130
mov rdi, rax
mov byte [0x1401f9fd2], 1
inc qword [rax + 0x298]
mov rsi, qword [rax + 0xc0]
jmp 0x1401a1f15
movdqu xmm0, xmmword [rdi + 0x2a8]
pcmpeqd xmm1, xmm1
psubq xmm0, xmm1
movdqu xmmword [rdi + 0x2a8], xmm0
mov edx, 0xc
mov rcx, rdi
call fcn.1400c2020
mov rsi, qword [rdi + 0xc0]
test rsi, rsi
jne 0x1401a1f25
mov edi, 1
xor ebx, ebx
lea rsi, [0x1401f9fd8]
mov rbp, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r14d, 0x40
mov rcx, rsi
call rbp
test al, al
jne 0x1401a1fc2
jmp 0x1401a20dc
pause
dec eax
jne 0x1401a20a3
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r14d
cmp ebx, 0x3e8
jl 0x1401a2094
jmp 0x1401a1fb6
call 0x140152a70
xor ecx, ecx
jmp 0x1401a1ff6
mov eax, edi
test edi, edi
jg 0x1401a1f9e
jmp 0x1401a1fa6
mov eax, edi
test edi, edi
jg 0x1401a20a3
jmp 0x1401a20ab
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401fa1c0]
lea rdx, [0x1401f9fd0]
mov r9d, 0x28
xor r8d, r8d
call fcn.1400c21b0
mov rsi, rax
jmp 0x1401a2000
Function at 0x1401a31f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1401a3227
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x1401a3201
ret

Function at 0x1401a3280
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1401a32b8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x1401a3291
ret
Function at 0x140005790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x41], rax
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
lea r13, vtable.CVolMem.0
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], 0x40
mov qword [rbp - 0x19], r12
mov rbx, qword [0x14006e050]
test rbx, rbx
jne 0x140005837
lea r8d, [r12 + 0x30]
lea rdx, [rbp - 1]
lea rcx, [0x140012bd0]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebx, r12d
test rax, rax
cmovne rbx, qword [rbp + 7]
mov edx, 0x1f4
mov r8d, 0xa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x1400058a7
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400058a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x140005897
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov qword [rbp - 0x19], r12
mov rdx, r15
lea rcx, [rbp - 0x41]
call fcn.1400138d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rsi, vtable.CVolObject.0
mov r8d, 0xcc
lea rdx, [rbp - 0x41]
mov rcx, rdi
call fcn.140005bd0
mov dword [rbp - 0x49], 1
mov qword [rbp - 0x41], r13
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x1400058e6
mov rax, qword [rbp - 0x41]
mov r8, qword [rax + 0x18]
cmp rax, r13
jne 0x14000591a
lea rcx, [0x14006de88]
call fcn.140013fe0
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x41], rsi
mov rax, rdi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp - 0x41]
call r8
jmp 0x1400058e6
Function at 0x140005930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x41], rax
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
lea r13, vtable.CVolMem.0
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], 0x40
mov qword [rbp - 0x19], r12
mov rbx, qword [0x14006e050]
test rbx, rbx
jne 0x1400059d7
lea r8d, [r12 + 0x30]
lea rdx, [rbp - 1]
lea rcx, [0x140012bd0]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebx, r12d
test rax, rax
cmovne rbx, qword [rbp + 7]
mov edx, 0x1f5
mov r8d, 0xa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x140005a47
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140005a40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x140005a37
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov qword [rbp - 0x19], r12
mov rdx, r15
lea rcx, [rbp - 0x41]
call fcn.1400138d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rsi, vtable.CVolObject.0
mov r8d, 0x68
lea rdx, [rbp - 0x41]
mov rcx, rdi
call fcn.140005bd0
mov dword [rbp - 0x49], 1
mov qword [rbp - 0x41], r13
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x140005a86
mov rax, qword [rbp - 0x41]
mov r8, qword [rax + 0x18]
cmp rax, r13
jne 0x140005aba
lea rcx, [0x14006de88]
call fcn.140013fe0
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x41], rsi
mov rax, rdi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp - 0x41]
call r8
jmp 0x140005a86