joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046b20
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x140046d2c
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x18]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1401f2240]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x18]
test edx, edx
je 0x140046cf4
mov rcx, rbp
call fcn.140046210
mov edx, dword [rdi - 0x14]
mov rbx, rax
test edx, edx
je 0x140046b9e
lea rcx, [rbp + 0x6198]
call fcn.140025310
mov r11, rax
jmp 0x140046ba1
xor r11d, r11d
mov qword [rbx + 0x18], r11
movsx eax, word [rdi]
movd xmm1, eax
movsx eax, word [rdi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 4]
movd xmm1, eax
movsx eax, word [rdi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 8]
movd xmm1, eax
movsx eax, word [rdi + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xc8]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xc8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test r11, r11
je 0x140046c35
cmp qword [r11 + 0x20], 0
jne 0x140046c2a
mov qword [r11 + 0x20], rbx
jmp 0x140046c35
cmp qword [r11 + 0x28], 0
jne 0x140046c35
mov qword [r11 + 0x28], rbx
mov eax, dword [rdi - 0xc]
mov r9, rbx
mov dword [rbx + 0xbc], eax
movsx eax, byte [rdi - 8]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 4]
mov eax, dword [rbx + 0xc]
and ecx, 0x3fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140046c7c
nop dword [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140046c70
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.1400247a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov edx, r14d
test r9b, r9b
je 0x140046cd8
cmp r9b, 0x23
jne 0x140046cbb
cmp byte [r8], r9b
jne 0x140046cbb
cmp byte [r8 + 1], r9b
cmove edx, r14d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r15 + rcx*4]
test r9b, r9b
jne 0x140046ca8
mov rcx, qword [0x14022d050]
not edx
add rcx, 0x4160
call fcn.140025310
mov qword [rbx + 0x88], rax
add rdi, 0x24
sub rsi, 1
jne 0x140046b70
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f3120
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140050c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov word [rsp + 0x32], r14w
cmp edi, 0x100
jl 0x140050cb7
mov r8d, 0x4b89
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui.cpp
lea rcx, str.depth____1_____sizeof_node_settings.Depth_____3__
call fcn.1400f9f24
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140050cce
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x140050cd3
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x140050cfe
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x140050cfe
mov rax, qword [rax + 0x3b0]
test rax, rax
je 0x140050cfe
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x140050d03
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x140050d1d
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x140050d22
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0x3fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], dil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x140050da4
inc ecx
test r8d, r8d
je 0x140050d8f
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140050d94
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.140052ce0
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140050de3
lea r8d, [rdi + 1]
mov rcx, rbp
call fcn.140050c60
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x140050df3
inc edi
jmp 0x140050c90
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140067090
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14022d050]
mov edx, 0x210
call fcn.140036ab0
cmp byte [rax], 0
je 0x140067134
mov rcx, qword [0x14022d050]
mov edx, 0x210
call fcn.140023900
cmp byte [rax + 8], 0
jne 0x140067134
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140067134
cmp qword [0x14022d050], 0
jne 0x1400670fc
mov r8d, 0x1122
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1400f9f24
mov rbx, qword [0x14022d050]
cmp byte [rbx + 0x3909], 0
je 0x140067120
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140023f90
mov dword [rbx + 0x378], 0x210
mov dword [rbx + 0x938], 0xa0
mov rcx, qword [0x14022d050]
mov edx, 0x214
call fcn.140036ab0
cmp byte [rax], 0
je 0x1400671d2
mov rcx, qword [0x14022d050]
mov edx, 0x214
call fcn.140023900
cmp byte [rax + 8], 0
jne 0x1400671d2
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400671d2
cmp qword [0x14022d050], 0
jne 0x14006719a
mov r8d, 0x1122
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1400f9f24
mov rbx, qword [0x14022d050]
cmp byte [rbx + 0x3909], 0
je 0x1400671be
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140023f90
mov dword [rbx + 0x37c], 0x214
mov dword [rbx + 0x948], 0xa1
mov rcx, qword [0x14022d050]
mov edx, 0x212
call fcn.140036ab0
cmp byte [rax], 0
je 0x140067270
mov rcx, qword [0x14022d050]
mov edx, 0x212
call fcn.140023900
cmp byte [rax + 8], 0
jne 0x140067270
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140067270
cmp qword [0x14022d050], 0
jne 0x140067238
mov r8d, 0x1122
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1400f9f24
mov rbx, qword [0x14022d050]
cmp byte [rbx + 0x3909], 0
je 0x14006725c
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140023f90
mov dword [rbx + 0x264], 0x212
mov dword [rbx + 0x940], 0x5b
mov rcx, qword [0x14022d050]
mov edx, 0x216
call fcn.140036ab0
cmp byte [rax], 0
je 0x140067310
mov rcx, qword [0x14022d050]
mov edx, 0x216
call fcn.140023900
cmp byte [rax + 8], 0
jne 0x140067310
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140067310
mov rbx, qword [0x14022d050]
test rbx, rbx
jne 0x1400672df
mov r8d, 0x1122
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1400f9f24
mov rbx, qword [0x14022d050]
cmp byte [rbx + 0x3909], 0
je 0x1400672fc
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140023f90
mov dword [rbx + 0x268], 0x216
mov dword [rbx + 0x950], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140070380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
movsxd r14, dword [rdx + 0xc]
xor esi, esi
mov dword [rsp + 0x88], esi
mov r12d, r8d
mov rbp, rdx
mov rbx, rcx
mov r13d, esi
mov edi, esi
cmp r8d, r14d
jne 0x1400703f9
test r9d, r9d
je 0x1400703f9
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.14006fa60
movss xmm0, dword [rsp + 0x38]
subss xmm0, dword [rsp + 0x34]
mov dword [rbx + 4], esi
mov dword [rbx + 0xc], esi
mov dword [rbx + 0x10], r14d
movss dword [rbx + 8], xmm0
movss xmm0, dword [rsp + 0x2c]
movss dword [rbx], xmm0
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rcx + 4], esi
xor r8d, r8d
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x80], r15
call fcn.14006fa60
mov r15d, dword [rsp + 0x3c]
cmp r12d, r15d
jl 0x1400704e3
lea eax, [r15 + rdi]
mov rcx, r14
mov dword [rsp + 0x20], eax
cmp eax, r14d
jne 0x140070497
test rcx, rcx
jle 0x140070497
lea r12d, [r14 - 1]
lea r13, [rcx - 1]
cmp r12d, dword [rbp + 0xc]
jle 0x14007045b
mov r8d, 0xe88
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui_widgets.cpp
lea rcx, [0x140209ef8]
call fcn.1400f9f24
test r13, r13
js 0x140070466
cmp r12d, dword [rbp + 0x18]
jl 0x14007047f
mov r8d, 0x7e0
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui.h
lea rcx, str.i___0__i___Size
call fcn.1400f9f24
mov rax, qword [rbp + 0x20]
cmp word [rax + r13*2], 0xa
jne 0x1400704db
mov r12d, dword [rsp + 0x90]
mov eax, dword [rsp + 0x20]
movss xmm0, dword [rsp + 0x30]
mov dword [rsp + 0x88], edi
mov edi, eax
addss xmm0, dword [rbx + 4]
movss dword [rbx + 4], xmm0
cmp eax, r14d
je 0x1400704d8
mov r8d, eax
lea rcx, [rsp + 0x28]
mov rdx, rbp
call fcn.14006fa60
mov r15d, dword [rsp + 0x3c]
lea eax, [r15 + rdi]
cmp r12d, eax
jl 0x1400704db
jmp 0x14007041f
mov r15d, esi
mov r13d, dword [rsp + 0x88]
movss xmm0, dword [rsp + 0x38]
subss xmm0, dword [rsp + 0x34]
mov r14d, dword [rsp + 0x90]
mov dword [rbx + 0x10], r15d
mov r15, qword [rsp + 0x80]
mov dword [rbx + 0xc], edi
movss dword [rbx + 8], xmm0
movss xmm0, dword [rsp + 0x28]
movss dword [rbx], xmm0
mov dword [rbx + 0x14], r13d
cmp edi, r14d
jge 0x14007053f
nop
mov r8d, esi
mov edx, edi
mov rcx, rbp
call fcn.14006f9c0
addss xmm0, dword [rbx]
inc esi
lea eax, [rdi + rsi]
movss dword [rbx], xmm0
cmp eax, r14d
jl 0x140070520
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007cb10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push r12
mov eax, 0x13e0
call fcn.1400f3ed0
sub rsp, rax
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov rsi, rcx
call fcn.1400f2650
mov dword [rsp + 0x24], eax
mov edx, 1
mov dword [rsp + 0x13a4], 0xffffffff
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14007cb50
mov r12, qword [rsi]
xor ebp, ebp
mov rax, qword [rsi + 8]
sub rax, r12
mov dword [rsp + 0x20], 0x270
sar rax, 3
test rax, rax
je 0x14007cd9a
mov rax, qword [rsi + 0x18]
xorps xmm5, xmm5
movss xmm4, dword [0x14020bed0]
mov qword [rsp + 0x1408], rbx
mov rbx, rax
mov qword [rsp + 0x1410], rdi
mov qword [rsp + 0x1418], r13
mov r13, qword [0x14022d050]
mov qword [rsp + 0x13d8], r14
mov qword [rsp + 0x13d0], r15
mov r15, qword [rsi + 0x30]
movaps xmmword [rsp + 0x13c0], xmm6
movsd xmm6, qword [0x14020b960]
nop word [rax + rax]
movss xmm1, dword [rbx]
mov rdi, r12
mov r14d, dword [r15]
sub rdi, rax
cvtps2pd xmm1, xmm1
add rdi, rbx
movss xmm0, dword [rdi]
xorps xmm2, xmm2
mulsd xmm1, xmm6
cvtps2pd xmm0, xmm0
cvtsi2ss xmm2, r14d
addsd xmm1, xmm0
movss xmm0, dword [rdi + 4]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm3, xmm1
movss dword [rdi], xmm3
movss xmm1, dword [rbx + 4]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm6
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movaps xmm1, xmm3
subss xmm1, xmm2
movss dword [rdi + 4], xmm0
comiss xmm5, xmm1
ja 0x14007cc67
mov rax, qword [r13 + 0x4180]
addss xmm2, xmm3
comiss xmm2, dword [rax + 0x60]
ja 0x14007cc67
movss xmm2, dword [rbx + 4]
jmp 0x14007ccc2
movss xmm0, dword [rbx]
lea rcx, [rsp + 0x20]
xorps xmm0, xmm4
movss dword [rbx], xmm0
call fcn.140020eb0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x77
ja 0x14007cca8
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.140020eb0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x78
jb 0x14007cc90
shr rax, 0x20
and eax, 1
lea eax, [rax*2 - 1]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
movss dword [rbx + 4], xmm2
movss xmm3, dword [rdi + 4]
movd xmm0, r14d
movaps xmm1, xmm3
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
comiss xmm5, xmm1
ja 0x14007ccf4
mov rax, qword [r13 + 0x4180]
movd xmm0, r14d
cvtdq2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, dword [rax + 0x64]
jbe 0x14007cd45
xorps xmm2, xmm4
lea rcx, [rsp + 0x20]
movss dword [rbx + 4], xmm2
call fcn.140020eb0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x77
ja 0x14007cd2c
lea rcx, [rsp + 0x20]
call fcn.140020eb0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x78
jb 0x14007cd14
shr rax, 0x20
and eax, 1
lea eax, [rax*2 - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx], xmm0
mov rcx, qword [rsi + 8]
inc ebp
sub rcx, qword [rsi]
add rbx, 8
movsxd rax, ebp
add r15, 4
sar rcx, 3
cmp rax, rcx
mov rax, qword [rsi + 0x18]
jb 0x14007cbf0
movaps xmm6, xmmword [rsp + 0x13c0]
mov r15, qword [rsp + 0x13d0]
mov r14, qword [rsp + 0x13d8]
mov r13, qword [rsp + 0x1418]
mov rdi, qword [rsp + 0x1410]
mov rbx, qword [rsp + 0x1408]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400f3120
add rsp, 0x13e0
pop r12
pop rsi
pop rbp
ret
Function at 0x140080440
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
xor esi, esi
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rsi
mov dword [rsp + 0x20], 1
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jg 0x1400804b2
jmp 0x1400805f2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x4c], xmm0
mov qword [rsp + 0x5c], rsi
mov dword [rsp + 0x48], Ordinal_33
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400805e8
lea r12, vtable.std::_Ref_count_obj2_class_blackbone::Thread_.0
nop word [rax + rax]
mov rbp, qword [r15]
mov eax, dword [rbp + 8]
cmp dword [rsp + 0x54], eax
jne 0x1400805d2
mov ecx, Ordinal_41
call fcn.1400f3140
mov rsi, rax
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], r12
lea r14, [rax + 0x10]
mov r8d, dword [rsp + 0x50]
mov qword [r14], rbp
mov dword [r14 + 8], r8d
xor edx, edx
mov ecx, 0x10005b
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [r14 + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
or dword [rsp + 0x20], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rsi
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14008057f
mov qword [rdx], r14
mov qword [rdx + 8], rsi
movdqu xmmword [rsp + 0x28], xmm0
add qword [rdi + 8], 0x10
jmp 0x14008058d
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.140080730
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400805d2
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400805cd
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400805cd
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400804f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140081780
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x108
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.14012ade0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x14008186e
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov r9d, 0x40
mov rdx, rbx
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
test eax, eax
jne 0x14008186e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x14008186e
movsxd rdx, dword [rsp + 0x7c]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
add rdx, rbx
je 0x14008186e
mov rax, qword [rax + 0x70]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
test eax, eax
jne 0x14008186e
cmp dword [rsp + 0x80], 0x4550
sete al
jmp 0x140081870
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400f3120
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret
Function at 0x1400825e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor ebx, ebx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140082845
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.14012ade0
mov dword [rsp + 0x5c], 0x208
mov dword [rsp + 0x58], 1
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.BuildLabEx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008283a
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x1400826c0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.14007fa30
nop
lea r8, [rsp + 0x60]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x78]
cmp r10, 7
cmova r8, r9
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140082733
mov rcx, rax
mov rdx, r8
mov rdi, rbx
cmp word [r8], 0x2e
je 0x140082723
nop word [rax + rax]
cmp rcx, 1
je 0x140082726
dec rcx
add rdx, 2
cmp word [rdx], 0x2e
jne 0x140082710
mov rdi, rdx
test rdi, rdi
je 0x140082733
sub rdi, r8
sar rdi, 1
jmp 0x14008273a
mov rdi, 0xffffffffffffffff
lea rsi, [rdi + 1]
lea rdx, [rsp + 0x60]
cmp r10, 7
cmova rdx, r9
cmp rsi, rax
jae 0x140082783
sub rax, rsi
lea rcx, [rdx + rsi*2]
je 0x140082776
cmp word [rcx], 0x2e
je 0x140082773
nop
cmp rax, 1
je 0x140082776
dec rax
add rcx, 2
cmp word [rcx], 0x2e
jne 0x140082760
mov rbx, rcx
test rbx, rbx
je 0x140082783
sub rbx, rdx
sar rbx, 1
jmp 0x14008278a
mov rbx, 0xffffffffffffffff
cmp rbx, rdi
jbe 0x140082830
cmp rdi, 0xffffffffffffffff
je 0x140082830
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov rax, qword [rsp + 0x70]
cmp rax, rsi
jb 0x14008286f
sub rbx, rdi
lea r8, [rbx - 1]
sub rax, rsi
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
lea rdx, [rax + rsi*2]
lea rcx, [rsp + 0x30]
call fcn.14007fa30
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0xa
call fcn.1400fecf8
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.14007f6e0
nop
lea rcx, [rsp + 0x60]
call fcn.14007f6e0
mov eax, ebx
jmp 0x140082847
lea rcx, [rsp + 0x60]
call fcn.14007f6e0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140011b70
nop
int3
Function at 0x1400852e0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov byte [rcx + 0x60], 0
mov rcx, qword [rcx + 0x48]
xor esi, esi
test rcx, rcx
je 0x14008531c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + 0x48], rsi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140085331
jle 0x14008532d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rsi
mov edi, esi
mov edx, edi
mov rcx, rbx
call fcn.140085040
inc edi
cmp edi, 4
jl 0x140085333
cmp qword [rbx + 0x10], rsi
je 0x1400853bc
call fcn.14007fe90
mov rcx, qword [rbx]
mov dword [rsp + 0x40], esi
mov edx, dword [rcx + 8]
mov rcx, qword [rax]
mov dword [rsp + 0x44], edx
cmp rcx, 0xffffffffffffffff
jne 0x14008536c
lea rcx, [rbx + 8]
jmp 0x1400853ab
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x44]
mov dword [rsp + 0x28], esi
mov r9d, 4
mov edx, 0x8005e020
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbx + 8]
test eax, eax
jne 0x1400853ab
mov rax, qword gs:[0x30]
call fcn.1400853e0
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x58], rsi
mov qword [rbx + 0x50], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f3120
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret