joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f740
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x14018fc08], 0
jne 0x14004f77d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14004f770
mov dword [rdi], eax
mov dword [0x14018fc10], eax
mov qword [0x14018fc08], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x140050790
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400507a5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x140052d80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140190c40]
cmp rdi, 1
jbe 0x140052da9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400803b0
lea rcx, [0x140190c40]
call fcn.140043fd0
test al, al
je 0x140052dee
xorps xmm0, xmm0
movups xmmword [0x140190c48], xmm0
lea rbx, [0x140190c40]
lea rdi, [0x140190c48]
mov rcx, rdi
xor edx, edx
call fcn.140042090
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140044070
jmp 0x140052d97
mov rdi, qword [0x140190c40]
jmp 0x140052d97

Function at 0x140057910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov ebx, ecx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x1400578e0]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x140190d28]
lea rdx, [0x140057730]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140057a11
cmp dword [0x140190d30], 0
jne 0x140057a1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x140190d34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
jne 0x1400579c7
mov ecx, 0x28
call fcn.1400891b0
test rax, rax
je 0x140057a1e
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x20], 0
mov ecx, dword [0x140190d34]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140057a16
lea rbp, [0x140190d38]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x140190d40]
mov qword [rax + rbx*8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsi + rbx*8], r14
mov esi, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a8490
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400bc5c0
mov rcx, rsi
call fcn.1400891f0
mov rcx, r14
mov rax, rdi
call qword [0x14019d008]
xor esi, esi
jmp 0x1400579f7
Function at 0x140057fc0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x140057ffc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140058006
add rdi, rbx
sub rsi, rbx
jne 0x140057fda
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400bc5c0
int3

Function at 0x14005a2f0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
push rbx
mov r8, rcx
xor ebx, ebx
xor eax, eax
xor ecx, ecx
xchg rbx, rsi
cpuid
xchg rbx, rsi
test eax, eax
jle 0x14005a402
mov esi, eax
mov eax, 1
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r9d, ecx
mov r10d, edx
mov r11d, eax
cmp esi, 7
jb 0x14005a33d
mov eax, 7
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
and ebx, 0x20
mov dword [r8], r11d
mov eax, r11d
and eax, 0xf
mov dword [r8 + 8], eax
shr r11d, 0xc
and r11d, 3
mov dword [r8 + 4], r11d
mov eax, r10d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r10d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r10d, 0x1a
and r10b, 1
mov byte [r8 + 0xe], r10b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x19], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x14005a439
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov eax, 0x80000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp eax, 0x80000006
jle 0x14005a43d
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
shr edx, 8
and dl, 1
mov byte [r8 + 0x18], dl
test dl, dl
je 0x14005a443
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14005a3d5
mov dl, byte [r8 + 0x18]
jmp 0x14005a431
cmp byte [r8 + 0x19], 0
je 0x14005a435
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp ebx, 0x7263694d
jne 0x14005a435
cmp ecx, 0x666f736f
jne 0x14005a435
cmp edx, 0x76482074
jne 0x14005a435
mov byte [r8 + 0x18], 1
jmp 0x14005a435
Function at 0x140064c00
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x140064c3c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140064c46
add rdi, rbx
sub rsi, rbx
jne 0x140064c1a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x14006e580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm10, r8d
pxor xmm10, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x14006e67f
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1401573f0]
nop word [rax + rax]
movdqa xmm6, xmm10
pclmulqdq xmm6, xmm9, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm9, 0
movdqa xmm5, xmm2
pclmulqdq xmm5, xmm9, 0
movdqa xmm4, xmm1
pclmulqdq xmm4, xmm9, 0
pclmulqdq xmm10, xmm8, 0x11
pclmulqdq xmm3, xmm8, 0x11
pclmulqdq xmm2, xmm8, 0x11
pclmulqdq xmm1, xmm8, 0x11
movdqu xmm0, xmmword [rcx]
pxor xmm0, xmm6
pxor xmm10, xmm0
movdqu xmm0, xmmword [rcx + 0x10]
pxor xmm0, xmm7
pxor xmm3, xmm0
movdqu xmm0, xmmword [rcx + 0x20]
pxor xmm0, xmm5
pxor xmm2, xmm0
movdqu xmm0, xmmword [rcx + 0x30]
pxor xmm0, xmm4
pxor xmm1, xmm0
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x14006e5f0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm0, xmm10
pclmulqdq xmm0, xmm4, 0
pxor xmm0, xmm3
movdqa xmm3, xmmword [0x140157400]
pclmulqdq xmm10, xmm3, 0x11
pxor xmm10, xmm0
movdqa xmm0, xmm10
pclmulqdq xmm0, xmm4, 0
pxor xmm0, xmm2
pclmulqdq xmm10, xmm3, 0x11
pxor xmm10, xmm0
movdqa xmm0, xmm10
pclmulqdq xmm0, xmm4, 0
pxor xmm0, xmm1
pclmulqdq xmm10, xmm3, 0x11
pxor xmm10, xmm0
cmp rdx, 0x10
jb 0x14006e71a
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm10
pclmulqdq xmm1, xmm4, 0
pxor xmm1, xmm0
pclmulqdq xmm10, xmm3, 0x11
pxor xmm10, xmm1
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x14006e6ed
movdqa xmm0, xmmword [0x140157400]
pclmulqdq xmm0, xmm10, 1
psrldq xmm10, 8
pxor xmm10, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm10, 3
psrldq xmm10, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm10
pxor xmm1, xmm1
pblendw xmm1, xmm2, 3
pclmulqdq xmm1, xmmword [0x140157410], 0x10
pblendw xmm1, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm1, 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1400719e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140071a28
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140071a31
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140071a18
mov qword [rdi], rsi
call fcn.140072b20
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140072b20
mov rcx, qword [rdi]
call fcn.1400759f0
mov qword [rdi], 0
jmp 0x140071a06

Function at 0x1400751e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x50], r12
movaps xmm0, xmmword [0x140156180]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x5b
call fcn.140072b00
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140079ca0
test esi, esi
js 0x1400752e9
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.1400780e0
test al, al
jne 0x1400752f0
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007530c
mov esi, dword [rsp + 0x2c]
test esi, esi
js 0x14007531f
lea rcx, [rsp + 0x30]
call fcn.140078170
lea rcx, [rsp + 0x50]
call fcn.140079d00
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400a8490
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x1400752bc
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1400f5f50
jmp 0x140075282
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400752b2
int3

Function at 0x140075330
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140075377
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140075391
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14007536f
mov qword [rsi], rdi
call fcn.140072b20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400753a7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140072b20
mov rcx, qword [rsi]
call fcn.1400759f0
mov qword [rsi], 0
jmp 0x14007535d
int3
Function at 0x1400753e0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jae 0x140075459
cmp qword [rsi], rbx
je 0x140075435
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140075460
cmp rbp, 2
jb 0x14007542c
mov qword [rsi], rbx
call fcn.140072b20
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140075476
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140072b20
jmp 0x140075404
call fcn.140072b20
mov rcx, qword [rsi]
call fcn.1400759f0
mov qword [rsi], 0
jmp 0x14007541e
call fcn.140072b20
mov rcx, qword [rdi]
call fcn.1400759f0
mov qword [rdi], 0
jmp 0x14007544b

Function at 0x1400754d0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140075567
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140075551
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14007552e
mov qword [rsi], rdi
call fcn.140072b20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x14007556b
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140072b20
mov rcx, qword [rsi]
call fcn.1400759f0
mov qword [rsi], 0
jmp 0x14007551c
mov byte [rsi + 8], 1
int3
Function at 0x14007a270
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.140079220
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x14018a3a8]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14007a2cd
jnp 0x14007a332
ucomisd xmm0, xmm6
jne 0x14007a2d9
jnp 0x14007a448
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x14015d940]
subpd xmm1, xmmword [0x14015d950]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x14015d960]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a8490
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x14018a3b8]
mov ecx, dword [0x140187544]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a44f
mov eax, dword [0x14018a3c8]
mov ecx, dword [0x140187544]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a489
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x14018a3c0]
cvtsi2sd xmm1, rbp
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x14015d938]
ucomisd xmm2, xmm1
ja 0x14007a2cd
shl r15, 0x20
or r14, r15
sub r14, qword [0x14018a3b0]
movq xmm0, r14
punpckldq xmm0, xmmword [0x14015d940]
subpd xmm0, xmmword [0x14015d950]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x14018a3a8], xmm0
jmp 0x14007a2cd
xor eax, eax
jmp 0x14007a30b
lea rcx, [0x14018a3b8]
call fcn.1400a71c0
cmp dword [0x14018a3b8], 0xffffffff
jne 0x14007a37c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x14018a3b0], rdx
lea rcx, [0x14018a3b8]
call fcn.1400a7258
jmp 0x14007a37c
lea rcx, [0x14018a3c8]
call fcn.1400a71c0
cmp dword [0x14018a3c8], 0xffffffff
jne 0x14007a3a1
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x14018a3c0], rax
lea rcx, [0x14018a3c8]
call fcn.1400a7258
jmp 0x14007a3a1
Function at 0x14007a840
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14018a408]
mov ecx, dword [0x140187544]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a8a0
mov rsi, qword [0x14018a400]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a8490
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14018a408]
call fcn.1400a71c0
cmp dword [0x14018a408], 0xffffffff
jne 0x14007a87c
lea rsi, [rsp + 0x34]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400aa5c0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1400a7064
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14018a450]
mov ecx, dword [0x140187544]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a960
lea r8, [0x14018a420]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r9d, edi
call fcn.140039fb0
mov qword [0x14018a400], rsi
lea rcx, [0x14018a408]
call fcn.1400a7258
jmp 0x14007a87c
lea rcx, [0x14018a450]
call fcn.1400a71c0
cmp dword [0x14018a450], 0xffffffff
jne 0x14007a931
xorps xmm0, xmm0
movups xmmword [0x14018a440], xmm0
movups xmmword [0x14018a430], xmm0
movups xmmword [0x14018a420], xmm0
lea rcx, [0x14018a420]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14018a450]
call fcn.1400a7258
jmp 0x14007a931
Function at 0x14007a9b0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14018a408]
mov ecx, dword [0x140187544]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007aa11
mov rax, qword [0x14018a400]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a8490
mov eax, esi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14018a408]
call fcn.1400a71c0
cmp dword [0x14018a408], 0xffffffff
jne 0x14007a9ec
lea rsi, [rsp + 0x34]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400aa5c0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1400a7064
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14018a450]
mov ecx, dword [0x140187544]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007aad1
lea r8, [0x14018a420]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r9d, edi
call fcn.140039fb0
mov qword [0x14018a400], rsi
lea rcx, [0x14018a408]
call fcn.1400a7258
jmp 0x14007a9ec
lea rcx, [0x14018a450]
call fcn.1400a71c0
cmp dword [0x14018a450], 0xffffffff
jne 0x14007aaa2
xorps xmm0, xmm0
movups xmmword [0x14018a440], xmm0
movups xmmword [0x14018a430], xmm0
movups xmmword [0x14018a420], xmm0
lea rcx, [0x14018a420]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14018a450]
call fcn.1400a7258
jmp 0x14007aaa2

Function at 0x140080370
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140187370]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400803a4
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x1400803a4
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14008039e

Function at 0x1400803b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140187370]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400803ee
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400803e7
call fcn.140041e80
jmp 0x1400803ce

Function at 0x1400813b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400813ec
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400813f6
add rdi, rbx
sub rsi, rbx
jne 0x1400813ca
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140083240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x14008331b
test rax, rax
jne 0x14008330c
cmp dword [rsi + 0x50], 0
jne 0x14008330c
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x14008335b
lea rdi, [rsi + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.14006fae0
cmp rax, 0xffffffffffffffff
jne 0x140083349
cmp dword [rsi + 0x58], 1
je 0x140083324
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x140083361
nop dword [rax]
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.14006fae0
cmp rax, 0xffffffffffffffff
jne 0x140083361
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x1400832f1
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400832c0
jmp 0x140083361
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x1400832e2
movabs rdx, 0x100003600
bt rdx, rcx
jae 0x1400832e2
jmp 0x140083361
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1401050f0
mov rax, qword [rsi + 0x40]
jmp 0x140083256
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x1400832a9
movabs rcx, 0x100003600
bt rcx, rax
jae 0x1400832a9
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x140083283
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400872c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x14008732e
xor r11d, r11d
mov r14, qword [r8 + r11*8]
mov r15, qword [rcx + r11*8]
mov rbx, r15
xor rbx, r14
mov edi, eax
lea rax, [rbx - 1]
mov rsi, r15
sub rsi, r14
xor rsi, r15
or rsi, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor rsi, r15
sar rsi, 0x3f
mov rbx, rsi
not rsi
and esi, 1
or rsi, rbx
mov rbx, rax
and edi, ebx
not rax
and rax, rsi
or rax, rdi
inc r11
cmp r10, r11
jne 0x1400872db
cmp rdx, r9
jb 0x14008733d
ja 0x140087369
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x14008733f
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x140087335
xor esi, esi
or rsi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14008736b
mov rcx, rsi
not rcx
dec rsi
and rsi, rcx
sar rsi, 0x3f
mov rcx, rsi
and ecx, eax
not rsi
and esi, 1
or esi, ecx
mov eax, esi
jmp 0x140087335