joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059220
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x240]
xor esi, esi
mov ebx, edx
mov rbp, rcx
test rdi, rdi
je 0x140059288
mov rsi, rdi
mov eax, 1
lock xadd dword [rdi], eax
inc eax
cmp eax, 1
jle 0x140059276
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rdi + 4], ecx
je 0x140059285
mov rcx, qword [rdi + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rdi + 4], ecx
inc dword [rdi + 8]
mov r8, qword [rbp + 0x160]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx edx, bl
xor rdx, rax
movzx eax, byte [rsp + 0x59]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x5a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x5b]
imul rdx, rcx
xor rdx, rax
mov rax, qword [rbp + 0x170]
imul rdx, rcx
mov rcx, qword [rbp + 0x188]
and rcx, rdx
add rcx, rcx
mov r9, qword [rax + rcx*8 + 8]
cmp r9, r8
je 0x140059311
mov rax, qword [rax + rcx*8]
cmp ebx, dword [r9 + 0x10]
je 0x140059314
nop dword [rax]
cmp r9, rax
je 0x140059311
mov r9, qword [r9 + 8]
cmp ebx, dword [r9 + 0x10]
jne 0x140059300
jmp 0x140059314
xor r9d, r9d
mov rcx, qword [rbp + 0x208]
test r9, r9
mov rax, qword [rbp + 0x1f0]
cmove r9, r8
and rcx, rdx
mov rdx, qword [rbp + 0x1e0]
shl rcx, 4
add rax, rcx
mov rcx, qword [rax + 8]
cmp rcx, rdx
je 0x140059360
mov rax, qword [rax]
cmp ebx, dword [rcx + 0x10]
je 0x140059362
nop dword [rax + rax]
cmp rcx, rax
je 0x140059360
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x140059350
jmp 0x140059362
xor ecx, ecx
test rcx, rcx
cmove rcx, rdx
cmp r8, r9
je 0x140059392
cmp rdx, rcx
je 0x140059392
mov r9, qword [r9 + 0x18]
mov edx, 1
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test rsi, rsi
je 0x1400593c9
add dword [rsi + 8], 0xffffffff
mov ecx, dword [rsi + 8]
jne 0x1400593a7
mov dword [rsi + 4], 0
mov eax, 0xffffffff
lock xadd dword [rsi], eax
cmp eax, 1
je 0x1400593c9
test ecx, ecx
jne 0x1400593c9
lea edx, [rcx + 1]
xor r8d, r8d
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140059450
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r8d, edx
mov r14, rcx
mov dword [rsp + 0x58], edx
mov rbx, qword [rcx + 0x240]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1400594dc
mov qword [rsp + 0x30], rbx
mov eax, 1
lock xadd dword [rbx], eax
inc eax
cmp eax, 1
jle 0x1400594c5
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rbx + 4], ecx
je 0x1400594d4
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbx + 4], ecx
inc dword [rbx + 8]
mov r8d, dword [rsp + 0x58]
mov edx, r8d
call fcn.1400593e0
mov esi, eax
mov ebx, 0xffffffff
cmp eax, ebx
je 0x14005963b
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
movzx ecx, byte [rsp + 0x59]
xor rdx, rcx
imul rdx, r9
movzx eax, byte [rsp + 0x5a]
xor rdx, rax
imul rdx, r9
movzx eax, byte [rsp + 0x5b]
xor rdx, rax
imul rdx, r9
mov rcx, qword [r14 + 0x148]
and rcx, rdx
shl rcx, 4
add rcx, qword [r14 + 0x130]
mov rax, qword [rcx + 8]
mov rdx, qword [r14 + 0x120]
cmp rax, rdx
je 0x140059583
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x140059573
cmp rax, rcx
je 0x140059583
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x140059564
test rax, rax
cmove rax, rdx
cmp rax, rdx
jne 0x14005963b
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov ebp, ebx
cmp qword [0x14023d298], 0
je 0x1400595ec
cmp qword [0x14023d380], 0
je 0x1400595ec
call fcn.140003d00
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9d, esi
mov r8d, 2
mov edx, ebx
call qword [0x14023d380]
call fcn.140003d00
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9d, esi
mov r8d, 2
mov edx, ebx
call qword [0x14023d298]
mov ebp, eax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov r9d, esi
mov r8d, ebx
lea rdx, str.ADL2_RegisterEventX2_adapter_index__d__event_id__d__event_handle__ul__ret__d
mov ecx, 3
call fcn.140083970
test ebp, ebp
jne 0x14005963b
lea rcx, [r14 + 0x118]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
call fcn.14005a610
mov rdx, qword [rax]
mov qword [rdx + 0x18], rdi
mov rcx, qword [r14 + 0x218]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140059677
add dword [rax + 8], 0xffffffff
mov ecx, dword [rax + 8]
jne 0x140059655
mov dword [rax + 4], 0
lock xadd dword [rax], ebx
cmp ebx, 1
je 0x140059677
test ecx, ecx
jne 0x140059677
xor r8d, r8d
lea edx, [rcx + 1]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014f2f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400596a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov edi, edx
mov r14, rcx
mov r15d, edx
shr r15d, 0x18
mov r12d, edx
shr r12d, 0x10
mov r13d, edx
shr r13d, 8
mov rbx, qword [rcx + 0x240]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x14005972a
mov qword [rsp + 0x30], rbx
mov eax, 1
lock xadd dword [rbx], eax
inc eax
cmp eax, 1
jle 0x140059718
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rbx + 4], ecx
je 0x140059727
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbx + 4], ecx
inc dword [rbx + 8]
mov edx, edi
call fcn.1400593e0
mov ebp, eax
mov esi, 0xffffffff
cmp eax, esi
je 0x140059852
mov edx, edi
mov rcx, r14
call fcn.1400587b0
test al, al
jne 0x140059852
movzx edx, dil
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, r13b
xor rdx, rax
imul rdx, rcx
movzx eax, r12b
xor rdx, rax
imul rdx, rcx
mov eax, r15d
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r14 + 0x148]
and rcx, rdx
shl rcx, 4
mov rax, qword [r14 + 0x130]
add rax, rcx
mov rbx, qword [rax + 8]
mov rcx, qword [r14 + 0x120]
cmp rbx, rcx
je 0x140059852
mov rax, qword [rax]
cmp edi, dword [rbx + 0x10]
je 0x1400597d7
cmp rbx, rax
je 0x140059852
mov rbx, qword [rbx + 8]
cmp edi, dword [rbx + 0x10]
jne 0x1400597c5
test rbx, rbx
cmove rbx, rcx
cmp rbx, rcx
je 0x140059852
mov rdi, qword [rbx + 0x18]
mov ecx, esi
mov rax, qword [0x14023d380]
test rax, rax
je 0x140059810
mov qword [rsp + 0x20], rdi
mov r9d, ebp
mov r8d, 2
mov edx, esi
mov rcx, qword [0x14023d248]
call rax
mov ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9d, ebp
mov r8d, esi
lea rdx, str.ADL2_UnRegisterEventX2_adapter_index__d__event_id__d__event_handle__ul__ret__d
mov ecx, 3
call fcn.140083970
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [r14 + 0x118]
call fcn.14005a540
mov rcx, qword [r14 + 0x218]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14005988e
add dword [rax + 8], 0xffffffff
mov ecx, dword [rax + 8]
jne 0x14005986c
mov dword [rax + 4], 0
lock xadd dword [rax], esi
cmp esi, 1
je 0x14005988e
test ecx, ecx
jne 0x14005988e
xor r8d, r8d
lea edx, [rcx + 1]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140059e40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov rdi, qword [r10 + 0x18]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r10 + 8]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r10 + 0x30]
mov r9, r8
shl r9, 4
add r9, rdi
mov rbx, qword [r9 + 8]
cmp rbx, rdx
je 0x140059f41
mov eax, dword [r11]
mov rcx, qword [r9]
cmp eax, dword [rbx + 0x10]
je 0x140059ece
nop
cmp rbx, rcx
je 0x140059f41
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140059ec0
test rbx, rbx
je 0x140059f41
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r9 + 8], rbx
jne 0x140059ef9
cmp rax, rbx
jne 0x140059eef
mov qword [rdi + r8*8], rdx
mov qword [r9 + 8], rdx
jmp 0x140059f05
mov rdx, qword [rbx + 8]
mov qword [r9 + 8], rdx
jmp 0x140059f05
cmp rax, rbx
jne 0x140059f05
mov rax, qword [rbx]
mov qword [rdi + r8*8], rax
mov rcx, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x18]
call fcn.140004ff0
mov edx, 0x38
mov rcx, rbx
call fcn.14014f59c
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14005a150
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14005a321
lea rax, [rdx - 1]
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x30], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400088d0
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14005a2d7
mov qword [rsp + 0x68], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x14005a243
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14005a2c6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x14005a280
mov r10, qword [rax]
cmp r10, rcx
je 0x14005a27a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14005a2c6
mov r8, rax
cmp r10, rax
je 0x14005a2a2
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x14005a2fb
cmp r10, rax
jne 0x14005a290
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14005a1f0
mov rbp, qword [rsp + 0x68]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call fcn.14005a080
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14005a2c6
lea rcx, str.invalid_hash_bucket_count
call fcn.140128aa0
int3
Function at 0x14005a540
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r9, rcx
movzx edx, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r8 + 0x11]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x13]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r9 + 0x30]
and rcx, rdx
mov rdx, qword [r9 + 0x18]
shl rcx, 4
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x14005a5cb
cmp rax, r8
jne 0x14005a5c1
mov rax, qword [r9 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14005a5d6
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x14005a5d6
cmp rax, r8
jne 0x14005a5d6
mov rax, qword [r8]
mov qword [rdx], rax
mov rbx, qword [r8]
mov edx, 0x20
dec qword [r9 + 0x10]
mov rcx, qword [r8 + 8]
mov qword [rcx], rbx
mov rcx, qword [r8 + 8]
mov qword [rbx + 8], rcx
mov rcx, r8
call fcn.14014f59c
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140060790
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, r8d
test rdx, rdx
je 0x1400608b6
mov eax, dword [rdx + 8]
test eax, eax
je 0x1400608cb
mov r8d, dword [rdx + 0xc]
test r8d, r8d
je 0x1400608cb
cmp byte [rsp + 0x80], 0
je 0x1400608cb
cmp ebx, 0x8095
jne 0x140060843
cmp r9d, eax
jne 0x1400608b6
mov byte [rcx + 0x38], 0
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x8013
lea rcx, [0x14002eb20]
mov qword [rsp + 0x28], 0xd
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.1400616f0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, qword [rax + 0x50]
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14014f2f0
add rsp, 0x50
pop rbx
ret
cmp ebx, 0x8094
jne 0x1400608b1
cmp r9d, r8d
jne 0x1400608b1
movdqa xmm0, xmmword [reloc.d2d1.dll_Ordinal_1]
lea rdx, [rsp + 0x20]
mov byte [rcx + 0x38], 1
lea rcx, [0x14002eb20]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 0x8013
mov qword [rsp + 0x28], 0xd
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.1400616f0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, qword [rax + 0x50]
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14014f2f0
add rsp, 0x50
pop rbx
ret
cmp r9d, eax
je 0x14006092f
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14014f2f0
add rsp, 0x50
pop rbx
ret
mov eax, dword [rdx]
cmp eax, dword [rcx + 0x2c]
je 0x1400608d6
test eax, eax
jne 0x1400608b6
cmp dword [rdx + 4], r9d
jne 0x1400608b6
cmp ebx, 0x8095
jne 0x1400608f2
xorps xmm0, xmm0
mov byte [rcx + 0x38], 0
movups xmmword [rsp + 0x30], xmm0
jmp 0x14006090c
cmp ebx, 0x8094
jne 0x14006092f
movdqa xmm0, xmmword [reloc.d2d1.dll_Ordinal_1]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rcx + 0x38], 1
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x8013
lea rcx, [0x14002eb20]
mov qword [rsp + 0x28], 0xd
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.1400616f0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, qword [rax + 0x50]
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14014f2f0
add rsp, 0x50
pop rbx
ret
Function at 0x140064910
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov rbx, qword [rcx + 0x18]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x20], xmm1
test rbx, rbx
je 0x140064985
mov qword [rsp + 0x20], rbx
mov eax, 1
lock xadd dword [rbx], eax
inc eax
cmp eax, 1
jle 0x140064973
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rbx + 4], ecx
je 0x140064982
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbx + 4], ecx
inc dword [rbx + 8]
cmp byte [rdi + 0x20], 0
je 0x1400649a3
lea rdx, str.SystemServices::Is64bitOS___called_while_Paused
mov ecx, 1
call fcn.1400838f0
mov bl, 1
jmp 0x140064a48
cmp byte [rdi + 0x2d], 0
je 0x140064a44
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, 9
movzx eax, word [rsp + 0x38]
cmp cx, ax
je 0x140064a39
mov ecx, 6
cmp cx, ax
je 0x140064a39
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14023d450], rax
test rax, rax
je 0x140064a28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [0x14023d450]
cmp dword [rsp + 0x30], 1
sete bl
mov byte [rdi + 0x2d], 0
mov byte [rdi + 0x2c], bl
jmp 0x140064a48
mov bl, 1
mov byte [rdi + 0x2d], 0
mov byte [rdi + 0x2c], bl
jmp 0x140064a48
movzx ebx, byte [rdi + 0x2c]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140064a8c
add dword [rax + 8], 0xffffffff
mov r8d, dword [rax + 8]
jne 0x140064a63
mov dword [rax + 4], 0
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
je 0x140064a8c
test r8d, r8d
jne 0x140064a8c
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14014f2f0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140064ab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov rbx, qword [rcx + 0x18]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x140064b25
mov qword [rsp + 0x30], rbx
mov eax, 1
lock xadd dword [rbx], eax
inc eax
cmp eax, 1
jle 0x140064b13
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rbx + 4], ecx
je 0x140064b22
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbx + 4], ecx
inc dword [rbx + 8]
cmp byte [rdi + 0x20], 0
je 0x140064b43
lea rdx, str.SystemServices::IsDetachableGraphics___called_while_Paused
mov ecx, 1
call fcn.1400838f0
mov bl, 1
jmp 0x140064c08
cmp byte [rdi + 0x39], 0
je 0x140064c04
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSet_services_amdkmdap
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140064bfa
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.DetachGfxPlatform
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140064bef
cmp dword [rsp + 0x48], 4
jne 0x140064bef
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x4c], 0
je 0x140064bfa
mov bl, 1
mov byte [rdi + 0x39], 0
mov byte [rdi + 0x38], bl
jmp 0x140064c08
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov byte [rdi + 0x39], bl
mov byte [rdi + 0x38], bl
jmp 0x140064c08
movzx ebx, byte [rdi + 0x38]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140064c4c
add dword [rax + 8], 0xffffffff
mov r8d, dword [rax + 8]
jne 0x140064c23
mov dword [rax + 4], 0
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
je 0x140064c4c
test r8d, r8d
jne 0x140064c4c
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14014f2f0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400650d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x20], 0
mov rdi, rcx
mov ebx, edx
je 0x140065107
lea rdx, str.SystemServices::GetGPUDVRSupport___called_while_Paused
mov ecx, 1
call fcn.1400838f0
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call fcn.140066a80
mov rcx, rdi
call fcn.140066400
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 0x39]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3b]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rdi + 0x108]
and rcx, rdx
mov rdx, qword [rdi + 0xe0]
shl rcx, 4
add rcx, qword [rdi + 0xf0]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400650fa
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x140065199
cmp rax, rcx
je 0x1400650fa
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x140065187
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400650fa
mov rcx, qword [rax + 0x18]
mov rbx, qword [rsp + 0x40]
movzx eax, byte [rcx + 0x93]
add rsp, 0x20
pop rdi
ret
Function at 0x14006bf30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x120
mov esi, r8d
mov rdi, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0xd0
mov rcx, rdi
call fcn.140152140
mov rcx, rdi
call fcn.140063ad0
mov dword [rsp + 0x20], 1
mov rbx, qword [rbp + 0x18]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
test rbx, rbx
je 0x14006bfd3
mov qword [rsp + 0x28], rbx
mov eax, 1
lock xadd dword [rbx], eax
inc eax
cmp eax, 1
jle 0x14006bfc1
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rbx + 4], ecx
je 0x14006bfd0
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbx + 4], ecx
inc dword [rbx + 8]
cmp byte [rbp + 0x20], 0
je 0x14006bfef
lea rdx, str.SystemServices::GetGPU___called_while_Paused
mov ecx, 1
call fcn.1400838f0
jmp 0x14006c0e1
mov rcx, rbp
call fcn.140066a80
movzx edx, sil
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x151]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x152]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x153]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rbp + 0x108]
and rcx, rdx
shl rcx, 4
add rcx, qword [rbp + 0xf0]
mov rax, qword [rcx + 8]
mov rdx, qword [rbp + 0xe0]
cmp rax, rdx
je 0x14006c0e1
mov rcx, qword [rcx]
cmp esi, dword [rax + 0x10]
je 0x14006c07e
cmp rax, rcx
je 0x14006c0e1
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x14006c070
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x14006c0e1
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x50]
call fcn.140063be0
nop
mov rdx, rax
mov rcx, rdi
call fcn.140063fe0
nop
lea rcx, [rsp + 0xf0]
call fcn.140004ff0
lea rcx, [rsp + 0xb8]
call fcn.140004ff0
lea rcx, [rsp + 0x98]
call fcn.140004ff0
lea rcx, [rsp + 0x78]
call fcn.140004ff0
lea rcx, [rsp + 0x58]
call fcn.140004ff0
nop
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x14006c126
add dword [r8 + 8], 0xffffffff
mov eax, dword [r8 + 8]
jne 0x14006c0fe
mov dword [r8 + 4], 0
mov ecx, 0xffffffff
lock xadd dword [r8], ecx
cmp ecx, 1
je 0x14006c126
test eax, eax
jne 0x14006c126
xor r8d, r8d
lea edx, [rax + 1]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, rdi
mov rbx, qword [rsp + 0x158]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret