joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ad120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, r8
mov rbx, rdx
mov r12, rcx
mov r15, qword [rsp + 0xa0]
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r13, [rcx + 8]
cmp r13, rdx
je 0x1401ad1c0
mov rdi, r9
lea rsi, [rbx + 0x20]
movzx eax, byte [rbx + 0x37]
mov rcx, rsi
test al, al
jns 0x1401ad172
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, r15
call fcn.1400e5390
test eax, eax
js 0x1401ad1c0
movzx eax, byte [r15 + 0x17]
mov rcx, r15
test al, al
jns 0x1401ad19d
mov rax, qword [r15 + 8]
mov rcx, qword [r15]
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1400e5390
test eax, eax
js 0x1401ad1e4
mov qword [r14], rbx
mov qword [rdi], rbx
jmp 0x1401ad27b
cmp qword [r12], rbx
je 0x1401ad1dc
mov rax, qword [rbx]
test rax, rax
je 0x1401ad21e
mov rdi, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1401ad1ce
jmp 0x1401ad23e
mov rdi, rbx
jmp 0x1401ad26e
mov rax, qword [rbx + 8]
test rax, rax
je 0x1401ad2a3
mov rdi, rax
mov rax, qword [rax]
test rax, rax
jne 0x1401ad1f1
cmp rdi, r13
je 0x1401ad2e5
movzx eax, byte [rdi + 0x37]
test al, al
jns 0x1401ad2c9
mov rax, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
jmp 0x1401ad2cd
lea rax, [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
cmp qword [rcx], rbx
jne 0x1401ad23b
mov rcx, qword [rax]
lea rax, [rcx + 0x10]
mov rdx, qword [rcx + 0x10]
cmp qword [rdx], rcx
je 0x1401ad22b
mov rdi, qword [rax]
lea rcx, [rdi + 0x20]
movzx eax, byte [r15 + 0x17]
mov rsi, r15
test al, al
jns 0x1401ad255
mov rax, qword [r15 + 8]
mov rsi, qword [r15]
lea rdx, [rsp + 0x28]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
call fcn.1400e5390
test eax, eax
jns 0x1401ad2fa
cmp qword [rbx], 0
je 0x1401ad29b
mov qword [r14], rdi
add rdi, 8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140111870
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r14], rbx
mov rdi, rbx
jmp 0x1401ad27b
mov rdi, qword [rbx + 0x10]
cmp qword [rdi], rbx
je 0x1401ad1fc
lea rax, [rbx + 0x10]
mov rcx, qword [rax]
lea rax, [rcx + 0x10]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi], rcx
jne 0x1401ad2b4
jmp 0x1401ad1fc
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, r15
call fcn.1400e5390
test eax, eax
jns 0x1401ad2fa
cmp qword [rbx + 8], 0
je 0x1401ad2f1
mov qword [r14], rdi
jmp 0x1401ad27b
mov qword [r14], rbx
add rbx, 8
jmp 0x1401ad29e
mov rcx, r12
mov rdx, r14
mov r8, r15
call fcn.140185d60
mov rdi, rax
jmp 0x1401ad27b
Function at 0x1401bea00
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1401bea4b
cmp byte [rcx], 0x4d
jne 0x1401bea4b
cmp byte [rcx + 1], 0x5a
jne 0x1401bea4b
mov r9d, dword [rcx + 0x3c]
xor eax, eax
test r9b, 7
jne 0x1401bea4d
cmp r9d, 0x40
jb 0x1401bea4d
cmp r9, rdx
jae 0x1401bea4d
mov r10, rdx
sub r10, r9
cmp r10, 0x18
jb 0x1401bea4d
cmp byte [rcx + r9], 0x50
jne 0x1401bea4b
cmp byte [rcx + r9 + 1], 0x45
jne 0x1401bea4b
cmp byte [rcx + r9 + 2], 0
je 0x1401bea4e
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x1401bea4b
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x1401bea4d
cmp rdx, 2
jb 0x1401bea4d
cmp word [rcx + r9], r8w
sete al
jmp 0x1401bea4d

Function at 0x1401c5970
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1401e90c0]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x1401c5a03
mov ecx, 1
call fcn.1400e83a0
test al, al
je 0x1401c5a03
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xb3
mov r9d, 1
call fcn.14004a130
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.1400dd7e0
mov rcx, rsi
call fcn.14004a5c0
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140111870
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
Function at 0x18000e878
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000e8a8
xor eax, eax
jmp 0x18000e96b
mov rbp, rbx
cmp word [rax], si
je 0x18000e8cd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000e8b4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000e8b0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000e7c8
movsxd r14, eax
test eax, eax
jne 0x18000e90b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000e8a1
mov rcx, r14
call fcn.18000cf38
mov rdi, rax
test rax, rax
jne 0x18000e924
xor ecx, ecx
call fcn.18000cf98
jmp 0x18000e900
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000e7c8
test eax, eax
jne 0x18000e955
mov rcx, rdi
call fcn.18000cf98
jmp 0x18000e95f
xor ecx, ecx
call fcn.18000cf98
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001774c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1800177c4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1800177c4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1800177c4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1800177b8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1800177d6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1800177a6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1800177c6

Function at 0x180017c90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180017cb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180017cb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400110f5
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001b8a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140036067]
call fcn.140011942
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001b8f7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001ba03
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001b99c
cmp qword [rbp + 0x28], 0
jle 0x14001b99c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001b93c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400118ac
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001b9f2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001b9f2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011528
Capabilities:
Terminate process

Disassembly:
jmp 0x140020250
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011681
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f600
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001f620
xor al, al
jmp 0x14001f6a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001f633
xor al, al
jmp 0x14001f6a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001f65d
xor al, al
jmp 0x14001f6a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001f671
xor al, al
jmp 0x14001f6a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001f683
xor al, al
jmp 0x14001f6a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001f69f
xor al, al
jmp 0x14001f6a1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001191f
Capabilities:
Write file on windows

Disassembly:
jmp 0x140017b00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14002e018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x140036067]
call fcn.140011942
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140017b66
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140017b6d
mov al, 1
jmp 0x140017cc7
call fcn.140011294
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140011294
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400117c6
movzx eax, al
test eax, eax
je 0x140017bc8
xor al, al
jmp 0x140017cc7
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x140017c2d
cmp dword [rbp + 0x194], 1
je 0x140017c38
cmp dword [rbp + 0x194], 3
je 0x140017cb6
jmp 0x140017cc5
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140017c88
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140017c88
xor al, al
jmp 0x140017cc7
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140017ca3
mov dword [rbp + 0x194], 1
jmp 0x140017cad
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140017cc7
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140017cc7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400287a0]
call fcn.1400117a8
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.140011479
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x1400082f0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x140012990
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x1400129cd
test rdx, rdx
je 0x1400129cd
mov rax, qword [rax]
cmp rax, r9
jne 0x1400129b0
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret
Function at 0x1400088d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1407ab0cc]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.14020ba10
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1407ab0cc]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140008a60
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140008a7c
cmp rcx, r8
jl 0x140008a6f
mov qword [rdx + 0x80], rcx
test dword [0x1407a2c80], 1
je 0x140008aab
cmp byte [rsp + 0xd0], 0
je 0x140008aab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400085d0
mov rsp, r8
jmp rax
Function at 0x140008ab0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1407ab0cc]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140062280
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.14005ff20
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.140060650
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.140060d80
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140060d80

Function at 0x1400623a0
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.140060650
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.14005ff20
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.140060f80
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140060f80
Function at 0x140063a80
Capabilities:
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r14
call fcn.140062280
mov r15, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r15
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.140060650
vmovdqu32 zmm3, zmmword [rbx]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
vpmaxsd zmm1, zmm3, zmmword [rax]
mov rcx, qword [rsp + 0x80]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [rax]
vmovdqu32 zmmword [rax], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r13]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r13]
vmovdqu32 zmmword [r13], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r12]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r12]
vmovdqu32 zmmword [r12], zmm0
vmovdqu32 zmm4, zmmword [r15]
vpmaxsd zmm0, zmm4, zmmword [r14]
vmovdqu32 zmmword [r15], zmm0
vpminsd zmm1, zmm4, zmmword [r14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
vmovdqu32 zmmword [r14], zmm1
mov qword [rsp + 0x20], r14
vzeroupper
call fcn.1400624c0
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.140060d80