joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015d10
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r15d, r8d
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov qword [rsp + 0x20], r14
xor ebp, ebp
lea rsi, [rsp + 0x2a0]
mov rcx, rsi
xor r8d, r8d
mov r9d, 3
call fcn.14001d5c0
lea rdi, [rsp + 0x280]
mov rcx, rsi
mov rdx, rdi
call fcn.14001d750
cmp qword [rsp + 0x290], 0
je 0x140015eb4
lea rsi, [rsp + 0x2a0]
lea rbx, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
nop word [rax + rax]
mov rcx, rsi
mov rdx, rbx
call fcn.14001d6c0
mov edx, dword [rsp + 0x30]
test dl, 1
je 0x140015de8
test r15b, r15b
jne 0x140015dc9
mov rcx, rbx
call fcn.14001d350
test al, al
jne 0x140015de8
mov edx, dword [rsp + 0x30]
and edx, 0xfffffffe
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140015de2
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.14001d350
test al, al
je 0x140015e40
xor ebp, ebp
test r15b, r15b
je 0x140015e75
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.140015d10
mov ebp, eax
test eax, eax
jne 0x140015e75
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140015e25
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x140015e75
jmp 0x140015e5f
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140015e56
mov rcx, qword [rsp + 0x280]
call r12
xor ebp, ebp
test eax, eax
jne 0x140015e75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
or eax, 1
cmp eax, 3
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, rbx
call fcn.140004c50
mov rcx, rsi
mov rdx, rbx
call fcn.14001d750
mov rcx, rdi
mov rdx, rbx
call fcn.140012240
mov rcx, rbx
call fcn.140012160
cmp qword [rsp + 0x290], 0
mov r13d, ebp
jne 0x140015da0
lea rcx, [rsp + 0x280]
call fcn.140012160
lea rcx, [rsp + 0x2a0]
call fcn.14001d5f0
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1400a6c00
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140016870
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov r14, rcx
mov rax, qword [0x140125058]
xor rax, rbp
mov qword [rbp], rax
call fcn.14000d5e0
mov rdi, rax
lea rbx, [0x1400f7171]
mov rcx, rax
mov rdx, rbx
call fcn.14000da00
test al, al
jne 0x1400168cd
lea rdx, str.vmodule
mov rcx, rdi
call fcn.14000da00
test al, al
je 0x1400169da
cmp qword [0x140128a48], 0
jne 0x140016add
mov rax, qword [0x140128a50]
mov qword [0x140128a48], rax
mov ecx, 0x20
call fcn.1400a6840
mov rsi, rax
lea rcx, str.vmodule
mov qword [rbp - 0x50], rcx
call fcn.1400dde20
mov qword [rbp - 0x48], rax
lea r15, [rbp - 0x20]
lea r8, [rbp - 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.14000da70
mov qword [rbp - 0x60], rbx
mov rcx, rbx
call fcn.1400dde20
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x40]
lea r8, [rbp - 0x60]
mov rcx, rdi
mov rdx, rbx
call fcn.14000da70
lea r9, [0x140128a58]
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.140028620
mov qword [0x140128a50], rsi
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x14001699b
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140016996
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016ae4
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400a68b0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x1400169da
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400169d5
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016ae4
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400a68b0
mov eax, dword [r14]
mov dword [section..data], eax
mov bl, 1
test al, 1
je 0x140016abf
mov rcx, qword [0x140128aa8]
test rcx, rcx
je 0x140016a0a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140128aa8], 0
mov rdi, qword [0x140128a60]
test rdi, rdi
jne 0x140016a43
mov ecx, 0x20
call fcn.1400a6840
mov rdi, rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
mov word [rdi], 0
mov qword [0x140128a60], rdi
mov rsi, qword [r14 + 8]
mov rcx, rsi
call fcn.1400de470
mov rbx, rax
mov rax, qword [rdi + 0x18]
cmp rax, rbx
jae 0x140016a72
mov rcx, rdi
mov rdx, rbx
mov r9, rsi
call fcn.140003250
cmp dword [r14 + 0x14], 0
jne 0x140016ab8
jmp 0x140016aa1
mov r15, rdi
cmp rax, 8
jb 0x140016a7e
mov r15, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r15
mov rdx, rsi
call fcn.1400ca590
mov word [r15 + rbx*2], 0
cmp dword [r14 + 0x14], 0
jne 0x140016ab8
mov rcx, qword [0x140128a60]
cmp qword [rcx + 0x18], 7
jbe 0x140016ab2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140016af0
mov ebx, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400a6c00
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
int3
call fcn.1400d7230
ud2
Function at 0x14001a090
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r15, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r15 + 0x30]
mov rax, qword [r15 + 8]
mov r8, qword [r15 + 0x18]
lea rdi, [rdx + rdx]
add rdi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x14001a113
mov rdx, qword [rdx]
mov rsi, rcx
cmp rcx, rax
je 0x14001a122
mov rsi, qword [r8 + rdi*8]
mov rsi, qword [rsi]
cmp rsi, rdx
je 0x14001a13b
cmp dword [rdx + 0x10], ebx
jne 0x14001a110
cmp rdx, rax
je 0x14001a13b
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x14001a1b0
mov rdi, qword [rax]
mov r12, qword [rdi + 8]
mov ecx, 0x38
call fcn.1400a6840
mov rsi, rax
test rdi, rdi
mov rax, r12
cmove rax, rsi
mov rcx, rdi
cmove rcx, rsi
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov eax, dword [r13]
mov dword [rsi + 0x10], eax
lea rcx, [rsi + 0x18]
call fcn.140011f80
mov rax, qword [r15 + 0x10]
movabs rcx, 0x492492492492491
cmp rax, rcx
je 0x14001a1c3
add rax, 1
mov qword [r15 + 0x10], rax
mov qword [rdi + 8], rsi
mov qword [r12], rsi
mov rax, qword [r15 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r15
mov rdx, r14
call fcn.14001a1e0
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400a80d0
ud2
Function at 0x14001aed0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14001aeff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001af02
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14001af23
test bl, bl
je 0x14001af6c
cmp byte [rdi + 8], 0
je 0x14001af5e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001af61
cmp byte [rdi + 8], 0
je 0x14001af34
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001af37
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001af4d
xor edi, edi
jmp 0x14001afe8
cmp byte [rdi + 8], 0
je 0x14001afa0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001afa3
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x14001af7d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001af80
mov rcx, qword [rdi]
call sub.KERNEL32.dll_GetProcessId
mov rcx, qword [0x140128e48]
mov dil, 1
test rcx, rcx
je 0x14001afe8
mov edx, eax
mov r8d, esi
call fcn.14002a950
jmp 0x14001afe8
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14001afb6
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x14001afc7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001afca
mov rcx, qword [rdi]
call sub.KERNEL32.dll_GetProcessId
mov rcx, qword [0x140128e48]
test rcx, rcx
je 0x14001afe5
mov edx, eax
mov r8d, esi
call fcn.14002a950
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400202a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], rdx
mov r12, qword [rcx]
lea rax, [r12 + 8]
mov qword [rsp + 0x38], rax
mov r13, qword [r12 + 8]
cmp byte [r13 + 0x19], 0
mov qword [rsp + 0x30], r8
je 0x1400202dd
mov qword [rsp + 0x28], r12
jmp 0x140020366
mov rbx, qword [r8]
mov r15, qword [r8 + 8]
sub r15, rbx
mov qword [rsp + 0x28], r12
mov rdi, qword [r13 + 0x20]
mov rbp, qword [r13 + 0x28]
sub rbp, rdi
cmp rbp, r15
setb r14b
mov rsi, r15
cmovb rsi, rbp
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.1400ca490
test eax, eax
sete cl
test eax, eax
js 0x140020357
and r14b, cl
jne 0x140020357
cmp byte [r12 + 0x19], 0
je 0x140020350
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400ca490
test eax, eax
mov rcx, r12
cmove rcx, r13
cmp r15, rbp
cmovae rcx, r12
test eax, eax
cmovs rcx, r13
mov r12, rcx
mov qword [rsp + 0x28], r13
jmp 0x14002035b
add r13, 0x10
mov r13, qword [r13]
cmp byte [r13 + 0x19], 0
je 0x1400202ec
xor eax, eax
cmp byte [r12 + 0x19], al
mov rcx, qword [rsp + 0x38]
cmove rcx, r12
mov rdi, qword [rcx]
cmp byte [rdi + 0x19], al
jne 0x1400203d4
mov rax, qword [rsp + 0x30]
mov rsi, qword [rax]
mov rbp, qword [rax + 8]
sub rbp, rsi
xor r15d, r15d
mov rdx, qword [rdi + 0x20]
mov r8, qword [rdi + 0x28]
sub r8, rdx
cmp rbp, r8
setb bl
cmovb r8, rbp
mov rcx, rsi
call fcn.1400ca490
test eax, eax
sets al
sete cl
and cl, bl
or cl, al
mov eax, ecx
xor al, 1
movzx eax, al
shl rax, 4
test cl, cl
cmovne r12, rdi
mov rdi, qword [rdi + rax]
cmp byte [rdi + 0x19], r15b
je 0x140020390
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rax + 8], r12
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140021b10
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140021b7f
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140021aa0
test al, al
jne 0x140021b8d
add rbx, 8
cmp rbx, 0x18
jne 0x140021b4d
xor esi, esi
jmp 0x140021b90
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.1400a6c00
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140025020
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x80], 0
je 0x1400250a0
cmp qword [rsi + 0x68], 0
je 0x1400250da
cmp byte [rsi + 0x71], 0
je 0x1400250da
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400250d6
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
test eax, eax
je 0x1400250a4
cmp eax, 1
je 0x1400250a8
cmp eax, 3
jne 0x1400250d6
jmp 0x1400250da
xor edi, edi
jmp 0x1400250f1
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1400250d0
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call fcn.1400d9d30
cmp rbx, rax
jne 0x1400250d6
cmp byte [rsi + 0x71], 0
je 0x1400250da
xor ebx, ebx
jmp 0x1400250dd
mov rbx, rsi
mov rcx, qword [rsi + 0x80]
call fcn.1400d9130
xor edi, edi
test eax, eax
cmove rdi, rbx
mov byte [rsi + 0x7c], 0
mov byte [rsi + 0x71], 0
lea rax, [rsi + 8]
mov qword [rsi + 0x18], rax
lea rax, [rsi + 0x10]
mov qword [rsi + 0x20], rax
lea rax, [rsi + 0x28]
mov qword [rsi + 0x38], rax
lea rax, [rsi + 0x30]
mov qword [rsi + 0x40], rax
lea rax, [rsi + 0x48]
mov qword [rsi + 0x50], rax
lea rax, [rsi + 0x4c]
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x80], 0
mov rax, qword [0x140128de8]
mov qword [rsi + 0x74], rax
mov qword [rsi + 0x68], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a6c00
mov rax, rdi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400262f0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140024bd0
test esi, esi
js 0x140026370
lea rcx, [rsp + 0x30]
call fcn.140022850
call fcn.14003fd90
test al, al
je 0x140026349
movsxd r9, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.14003fe30
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140026377
mov esi, dword [rsp + 0x2c]
jmp 0x140026388
mov esi, 0xffffffff
jmp 0x140026392
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x30]
call fcn.14003fe00
lea rcx, [rsp + 0x40]
call fcn.140024cd0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a6c00
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400263c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140024bd0
test esi, esi
js 0x14002644d
lea rcx, [rsp + 0x30]
call fcn.140022850
call fcn.14003fd90
test al, al
je 0x140026419
movsxd r9, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.14003fe30
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.14003fe00
jmp 0x140026452
mov esi, 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.140024cd0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a6c00
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140027ca0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x140128e10]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x140027e0f
jp 0x140027e0f
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140128e20]
mov ecx, dword [0x140128b20]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140027e2e
mov eax, dword [0x140128e30]
mov ecx, dword [0x140128b20]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140027e6a
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x140128e28]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x1400f7130]
subpd xmm1, xmmword [0x1400f7140]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addpd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x1400f7158]
ucomisd xmm1, xmm0
ja 0x140027e0f
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x140128e18]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x1400f7130]
subpd xmm1, xmmword [0x1400f7140]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addpd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x140128e10], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a6c00
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x140128e20]
call fcn.1400a6a20
mov eax, dword [0x140128e20]
cmp eax, 0xffffffff
jne 0x140027d21
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140128e18], rdx
lea rcx, [0x140128e20]
call fcn.1400a6a90
jmp 0x140027d21
lea rcx, [0x140128e30]
call fcn.1400a6a20
mov eax, dword [0x140128e30]
cmp eax, 0xffffffff
jne 0x140027d46
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x140128e28], rax
lea rcx, [0x140128e30]
call fcn.1400a6a90
jmp 0x140027d46
Function at 0x14002db40
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, dword [0x140128f00]
mov ecx, dword [0x140128b20]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002dba0
lea rsi, [0x140128ef8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400a6c00
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x140128f00]
call fcn.1400a6a20
mov eax, dword [0x140128f00]
cmp eax, 0xffffffff
jne 0x14002db7c
lea rcx, [rsp + 0x64]
xor esi, esi
mov r8d, 0x118
xor edx, edx
call fcn.1400caa00
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x64]
cmp eax, 0xa
je 0x14002dc11
cmp eax, 6
jne 0x14002dc4c
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rdi, [rsp + 0x2c]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call rax
mov esi, dword [rsp + 0x2c]
mov ecx, pe_nt_image_headers64
call fcn.1400a6840
mov rdi, rax
lea rdx, [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rcx, rax
mov r9d, esi
call fcn.14002dcb0
mov qword [0x140128ef8], rdi
lea rcx, [0x140128f00]
call fcn.1400a6a90
jmp 0x14002db7c
Function at 0x1400340b0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x140034107
mov r12, r8
mov ebx, edx
mov edi, ecx
bt edx, 8
jae 0x1400340ec
mov eax, ebx
and eax, 0x200
jne 0x140034107
cmp edi, 2
lea rax, [0x140129210]
lea rcx, [0x140129410]
cmove rcx, rax
cmp word [rcx], 0
je 0x140034126
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a6c00
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x140034107
cmp byte [0x140129200], 0
setne al
bt ebx, 8
jb 0x140034107
shr ebx, 9
and ebx, 1
or bl, al
je 0x140034107
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x140034186
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
mov r13d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x140034222
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x1400341bf
test dx, dx
jne 0x140034244
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x1400341ed
cmp ebp, 2
jne 0x1400341e3
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x1400341ed
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x140034205
dec r14
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x1400341f7
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x14003424b
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x140034244
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.1400d7b00
test eax, eax
je 0x1400341ac
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x140034222
cmp dword [rsp + 0x2c], 0
je 0x140034107
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x14003426a
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.1400de470
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.140034b30
jmp 0x140034107

Function at 0x1400351f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140125180]
cmp ecx, 0xffffffff
je 0x14003520e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 1
sete al
jmp 0x140035210
xor eax, eax
add rsp, 0x28
ret