joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100049e10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov edi, dword [rcx + 0x48]
mov r12, rdx
mov rbx, rcx
lea r14, [0x100080250]
test edi, edi
js 0x100049fce
add rcx, 0x20
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x60]
mov eax, dword [rbx + 0x60]
cmp eax, dword [rbx + 0x5c]
jae 0x100049f6e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x64]
cmp eax, dword [rbx + 0x58]
jae 0x100049f6e
cmp qword [rbx + 0x50], 0
jne 0x100049fa5
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x100080250]
cmp rcx, r14
je 0x100049e9f
test byte [rcx + 0x1c], 2
je 0x100049e9f
mov rcx, qword [rcx + 0x10]
lea r8, [0x10007a6e8]
mov edx, 0xb
call fcn.10001c100
and qword [rsp + 0x70], 0
xor edx, edx
lea rax, [rsp + 0x70]
lea r9, [0x10007a8c0]
lea rcx, [0x10007a8d0]
lea r8d, [rdx + 4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
and qword [rsp + 0x60], 0
mov edi, eax
test eax, eax
js 0x100049ef7
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov edi, eax
test eax, eax
js 0x100049ef7
mov rcx, qword [rsp + 0x60]
call fcn.10004b7b8
mov edi, eax
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
js 0x100049f46
cmp qword [rbx + 0x50], 0
jne 0x100049f46
mov rax, qword [rsp + 0x60]
xor esi, esi
test rax, rax
je 0x100049f21
and qword [rsp + 0x60], 0
mov rsi, rax
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x100049f35
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rbx + 0x50], 0
mov qword [rbx + 0x50], rsi
and dword [rbx + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x64], eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x100049f5c
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x100049fa5
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x100049fa5
mov edi, 0x800106ba
mov rcx, qword [0x100080250]
cmp rcx, r14
je 0x100049fa5
test byte [rcx + 0x1c], 2
je 0x100049fa5
mov eax, dword [rbx + 0x58]
mov r9d, dword [rbx + 0x60]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10007a6e8]
mov edx, 0xa
mov dword [rsp + 0x20], eax
call fcn.100034a94
test r12, r12
je 0x100049fc0
test edi, edi
js 0x100049fc0
mov rax, qword [rbx + 0x50]
mov qword [r12], rax
mov rcx, qword [rbx + 0x50]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jns 0x100049ff8
mov rcx, qword [0x100080250]
cmp rcx, r14
je 0x100049ff8
test byte [rcx + 0x1c], 1
je 0x100049ff8
mov rcx, qword [rcx + 0x10]
lea r8, [0x10007a6e8]
mov edx, 0xc
mov r9d, edi
call fcn.10001c124
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10004b86c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov esi, edx
mov rbp, rcx
lea eax, [rbx + 4]
lea rdx, str.PrintersDefaults
lea r9d, [rbx + 1]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x70], eax
lea rax, [r11 - 0x20]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x78], ebx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebx
mov edi, ebx
sete dil
cmp edi, ebx
je 0x10004b93c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
lea rdx, [0x10007aa48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10004b900
cmp dword [rsp + 0x78], 1
mov edi, ebx
setne dil
cmp edi, ebx
je 0x10004b93c
mov rcx, qword [rsp + 0x38]
lea eax, [rsi + rsi]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
lea rdx, str.NetID
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, ebx
cmp eax, ebx
sete dil
mov rcx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x10004b94c
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, ebx
mov edx, 0x1016
setne bl
xor ecx, ecx
mov r8d, ebx
call sub.ntdll.dll_WinSqmSetDWORD
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x10004bd70
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x30
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov edi, ecx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x18], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x10004bde1
mov rcx, qword [rsp + 0x50]
test edi, edi
lea r9d, [rbx + 4]
setne al
mov dword [rsp + 0x28], r9d
lea rdx, str.UserSelectedDefault
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x10004bdf1
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x10004be04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rcx
mov eax, ebx
cmp rcx, rbx
jne 0x10004be1f
lea eax, [rbx + 0x57]
jmp 0x10004be25
mov dword [rcx], 1
mov ecx, ebx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x58], 4
cmp eax, ebx
jne 0x10004be75
lea rax, [rsp + 0x58]
lea r8, str.UserSelectedDefault
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov ecx, dword [rsp + 0x50]
cmp eax, 2
jne 0x10004be85
xor ecx, ecx
mov dword [rdi], ebx
call fcn.10004bd70
jmp 0x10004be91
cmp eax, ebx
jne 0x10004be91
cmp ecx, 1
sete bl
mov dword [rdi], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x10004bef4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x480
mov rax, qword [0x100080258]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r12d, r12d
mov ebp, edx
mov rsi, rcx
mov ebx, r12d
cmp rcx, r12
je 0x10004bf31
cmp word [rcx], r12w
jne 0x10004bf36
mov ebx, 0x57
mov edi, r12d
cmp ebx, r12d
jne 0x10004bf4f
mov edx, 0x2c
call sub.msvcrt.dll_wcschr
cmp rax, r12
sete dil
lea rcx, [rsp + 0x50]
call fcn.1000026a4
cmp edi, r12d
je 0x10004bfdb
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x60], r12w
call sub.msvcrt.dll_memset
mov dword [rsp + 0x48], 0x410
cmp ebx, r12d
jne 0x10004bff0
lea rax, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDevices
mov r9d, 2
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov ebx, eax
cmp eax, r12d
jne 0x10004bff0
lea r9, [rsp + 0x60]
lea rdx, str._s__s
lea rcx, [rsp + 0x50]
mov r8, rsi
call fcn.10000a910
jmp 0x10004bfed
cmp ebx, r12d
jne 0x10004bff0
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.1000027ac
movzx ebx, ax
mov qword [rsp + 0x40], r12
cmp ebx, r12d
jne 0x10004c0b7
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10004c0a2
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.10001adfc
lea rdx, str.Device
mov r9d, 1
add eax, eax
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov ebx, eax
cmp eax, r12d
jne 0x10004c0a2
xor r8d, r8d
lea r9, str.Windows
mov ecx, 0xffff
lea edx, [r8 + 0x1a]
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
cmp eax, r12d
jne 0x10004c091
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r12d
jne 0x10004c0a2
mov edx, ebp
mov rcx, rsi
call fcn.10004bea4
mov ebx, eax
mov rcx, qword [rsp + 0x40]
cmp rcx, r12
je 0x10004c0b7
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x50]
call fcn.1000026c0
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1000010b0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140066c50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140066c5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140066c6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140066c55
lea eax, [rcx + 1]
jmp 0x140066c7b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140066c8e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140066c74
sub eax, 3
jb 0x140066cae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140066cfd
sar eax, 1
movsxd rbp, eax
jb 0x140066ce4
jmp 0x140066cbc
add ebx, ebx
jne 0x140066cba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140066ce4
inc ecx
add ebx, ebx
jne 0x140066cca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140066ce4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140066cdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140066ccc
add ecx, 2
jmp 0x140066ce9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140066c12
jmp 0x140066c5d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140066d49
cmp rsi, rcx
jae 0x140066d51
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140066d30
cmp al, 0x8f
ja 0x140066d30
cmp byte [rsi - 2], 0xf
je 0x140066d36
sub al, 0xe8
cmp al, 1
ja 0x140066d1a
cmp rsi, rcx
jae 0x140066d51
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140066d20
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140066d51
lodsb al, byte [rsi]
jmp 0x140066d30
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x64000]
mov eax, dword [rdi]
or eax, eax
je 0x140066dae
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x777f0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140066d5e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140066da8
mov qword [rbx], rax
add rbx, 8
jmp 0x140066d7e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140066de8
cmp al, 0xef
ja 0x140066dda
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140066dba
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140066dc9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140066e3c
sub rsp, 0xffffffffffffff80
jmp 0x14000a340
Function at 0x7ff9b3912960
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x2c]
cmp eax, dword [rsp + 0x34]
jae 0x7ff9b3912a0a
mov ebp, dword [rsp + 0x30]
shr ebp, 8
mov rax, qword [rsp + 0x38]
movsxd rcx, dword [rsp + 0x2c]
movzx esi, byte [rax + rcx]
mov edi, dword [rsp + 0x30]
mov ecx, esi
call fcn.7ff9b39294c0
mov r14d, eax
mov ecx, 0xad6b43b0
call fcn.7ff9b392c2f0
mov ebx, eax
and ebx, r14d
mov eax, 0xffffffff
xor eax, 0x5d546002
and esi, eax
mov ecx, edi
xor ecx, 0xffffffff
and ecx, 0x5d546002
and edi, eax
or ebx, esi
or ecx, edi
xor ebx, ecx
mov ecx, 0xf03f234d
call fcn.7ff9b392c2f0
and ebx, eax
mov eax, ebx
lea rcx, [0x7ff9b393b140]
xor ebp, dword [rcx + rax*4]
mov dword [rsp + 0x30], ebp
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x2c], eax
jmp 0x7ff9b3912983
mov ecx, dword [rsp + 0x30]
call fcn.7ff9b39294c0
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x7ff9b39137d0
Capabilities:
Generate random numbers using a mersenne twister
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x30
mov dword [0x7ff9b393b130], 0
lea rcx, [0x7ff9b39395f0]
mov edx, 0x9c0
call fcn.7ff9b3925500
lea rcx, [0x7ff9b393b140]
mov edx, 0x400
call fcn.7ff9b3925500
mov dword [0x7ff9b3939378], 0
mov dword [0x7ff9b3939384], 0
mov dword [0x7ff9b3939388], 0x9908b0df
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0x100
jge 0x7ff9b39138b4
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x2c], 8
cmp dword [rsp + 0x2c], 0
jle 0x7ff9b3913891
mov esi, dword [rsp + 0x24]
mov ecx, 0xf03f23b3
call fcn.7ff9b392c2f0
and esi, eax
cmp esi, 0
je 0x7ff9b3913877
mov eax, dword [rsp + 0x24]
shr eax, 1
xor eax, 0xedb88320
mov dword [rsp + 0x24], eax
jmp 0x7ff9b3913882
mov eax, dword [rsp + 0x24]
shr eax, 1
mov dword [rsp + 0x24], eax
jmp 0x7ff9b3913884
mov eax, dword [rsp + 0x2c]
add eax, 0xffffffff
mov dword [rsp + 0x2c], eax
jmp 0x7ff9b3913849
mov eax, dword [rsp + 0x24]
movsxd rcx, dword [rsp + 0x28]
lea rdx, [0x7ff9b393b140]
mov dword [rdx + rcx*4], eax
mov eax, dword [rsp + 0x28]
add eax, 1
mov dword [rsp + 0x28], eax
jmp 0x7ff9b391382f
add rsp, 0x30
pop rsi
ret
Function at 0x7ff9b3930520
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x10
mov eax, ecx
or eax, 0x1000
sub eax, ecx
imul eax, ecx
mov dword [rsp + 4], eax
imul eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
cmp eax, dword [rsp + 4]
je 0x7ff9b3930561
mov eax, dword [rsp + 8]
cmp eax, dword [rsp + 4]
jle 0x7ff9b3930561
mov eax, dword [rsp + 4]
cmp eax, dword [section..data]
je 0x7ff9b3930574
cmp ecx, dword [rsp + 4]
je 0x7ff9b3930574
mov eax, 0x272
xor eax, dword [rsp + 8]
mov dword [rsp + 4], eax
sub eax, ecx
mov dword [rsp + 8], eax
mov eax, ecx
and eax, 0x9d2c5680
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
cmp eax, dword [section..data]
jne 0x7ff9b39305af
mov eax, dword [rsp + 4]
cmp eax, dword [section..data]
je 0x7ff9b39305af
mov eax, dword [rsp + 8]
lea eax, [rax + rcx + 0x3c6]
mov dword [rsp + 8], eax
xor eax, 0x1cc
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 4]
add rsp, 0x10
ret
Function at 0x140010d20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140010d48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140010d48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1410a4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410a41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1410a4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410a406f
add dl, dl
jne 0x1410a4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410a40f6
xor eax, eax
add dl, dl
jne 0x1410a40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410a41ad
add dl, dl
jne 0x1410a40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410a40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1410a407e
mov eax, 1
add dl, dl
jne 0x1410a4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410a40fb
sub eax, ebx
mov ebx, 1
jne 0x1410a414c
mov ecx, 1
add dl, dl
jne 0x1410a412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410a413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410a4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410a407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1410a4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410a4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410a415d
cmp eax, 0x7d00
jae 0x1410a419b
cmp eax, 0x500
jb 0x1410a4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410a407e
cmp eax, 0x7f
ja 0x1410a419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410a407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410a41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1410a407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400032d0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [0x140237df8], 0
jne 0x140003341
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x140237de8], rax
mov eax, dword [rsp + 0x48]
mov qword [0x140237df0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x140237df8], rax
lea rax, [0x140237de8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140079bc0
add rsp, 0x68
ret
Function at 0x1400050a0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
xor esi, esi
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rsi
mov dword [rsp + 0x20], 1
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jg 0x140005110
jmp 0x140005252
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x4c], xmm0
mov qword [rsp + 0x5c], rsi
mov dword [rsp + 0x48], 0x1c
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140005248
lea r12, vtable.std::_Ref_count_obj2_class_blackbone::Thread_.0
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r15]
mov eax, dword [rbp + 8]
cmp dword [rsp + 0x54], eax
jne 0x140005232
mov ecx, 0x28
call fcn.140079a68
mov rsi, rax
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], r12
lea r14, [rax + 0x10]
mov r8d, dword [rsp + 0x50]
mov qword [r14], rbp
mov dword [r14 + 8], r8d
xor edx, edx
mov ecx, 0x10005b
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [r14 + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
or dword [rsp + 0x20], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rsi
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x1400051df
mov qword [rdx], r14
mov qword [rdx + 8], rsi
movdqu xmmword [rsp + 0x28], xmm0
add qword [rdi + 8], 0x10
jmp 0x1400051ed
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.140005310
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140005232
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000522d
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000522d
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140005150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140079bc0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140006ba0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x108
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.1400b18d0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x140006c8e
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov r9d, 0x40
mov rdx, rbx
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140006c8e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x140006c8e
movsxd rdx, dword [rsp + 0x7c]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
add rdx, rbx
je 0x140006c8e
mov rax, qword [rax + 0x70]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140006c8e
cmp dword [rsp + 0x80], 0x4550
sete al
jmp 0x140006c90
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140079bc0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret