joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016e50
Capabilities:
Execute command

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140089180]
xor rax, rsp
mov qword [rbp + 0x60], rax
movabs rax, 0x730a43697542140b
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xc3b6a2eb9a276f56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x399d495f7b371d9e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xe0ef76002b292a0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x1f662a021e31757f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xe3d08dcbff5f0a78
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x51fe3f2c5b5a74b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xe08a0e65055d5962
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14004c980
add rsp, 0xb0
pop rbp
ret

Function at 0x140016f60
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140089180]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x28], 0x101
lea rcx, [rsp + 0x30]
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
test eax, eax
je 0x140016fd0
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x140016fc0
lea rdx, [rsp + 0x30]
jmp 0x140016fdd
mov r8d, 7
lea rdx, str.Unknown
mov rcx, rbx
call fcn.14000be70
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004c980
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140017de0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x160
mov rax, qword [0x140089180]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rcx
mov dword [rsp + 0x20], 0x130
mov ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140017e27
xor eax, eax
jmp 0x140017f16
mov qword [rsp + 0x170], rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov qword [rsp + 0x178], rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140017e51
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
mov rdi, qword [rsi + 0x10]
jbe 0x140017e6b
mov rcx, qword [rsi]
cmp rbx, rdi
lea rdx, [rsp + 0x4c]
mov r8, rdi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140017e8e
cmp rdi, rbx
jb 0x140017e8e
jbe 0x140017f37
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140017efb
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140017eb0
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
mov rdi, qword [rsi + 0x10]
jbe 0x140017eca
mov rcx, qword [rsi]
cmp rbx, rdi
lea rdx, [rsp + 0x4c]
mov r8, rdi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140017ee9
cmp rdi, rbx
jb 0x140017ee9
jbe 0x140017f37
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140017ea0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14004c980
mov rbp, qword [rsp + 0x180]
add rsp, 0x160
pop rsi
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140017f06
Function at 0x140021bf0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
mov r9, qword [r11 + 0x30]
xor r15d, r15d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140021c98
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140021c98
mov edi, dword [rbx + 0x20]
nop dword [rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140021c93
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140021c70
cmp edx, 0x53b2070f
je 0x140021d8b
test r8d, r8d
jne 0x140021c50
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140021cad
cmp qword [rax + 0x30], r15
jne 0x140021c22
mov rax, r15
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2a], 0x6c6c64
mov dword [rbp - 0x30], 0x6c64746e
mov word [rbp - 0x2c], 0x2e6c
mov byte [rbp - 0x26], r15b
call rax
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140021e00
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140021d74
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140021d74
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140021d6f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140021d50
cmp edx, 0xf8f45725
je 0x140021da7
test r8d, r8d
jne 0x140021d30
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140021dbf
cmp qword [rax + 0x30], r15
jne 0x140021d00
jmp 0x140021dbf
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140021cb0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r15d, dword [rcx + rdx*4]
add r15, r9
movdqa xmm0, xmmword [str.NtQueryInformati]
lea rdx, [rbp - 0x20]
mov rcx, r14
mov dword [rbp - 0xa], 0x737365
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x72506e6f
mov word [rbp - 0xc], 0x636f
mov byte [rbp - 6], 0
call r15
test rax, rax
je 0x140021e00
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, 1
jmp 0x140021e02
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140021e20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140089180]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140021ee8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140021ee8
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140021ee3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140021ec0
cmp edx, 0x4cfe97c1
je 0x140021fab
test r8d, r8d
jne 0x140021ea0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140021efd
cmp qword [rax + 0x30], r14
jne 0x140021e70
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140021f94
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140021f94
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140021f8f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140021f70
cmp edx, 0x6dd8a845
je 0x140021fc7
test r8d, r8d
jne 0x140021f50
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140021fdf
cmp qword [rax + 0x30], r14
jne 0x140021f20
jmp 0x140021fdf
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x140021f00
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call r14
lea rdx, [rsp + 0x20]
mov rcx, rax
call rbp
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14004c980
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140022020
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x140089180]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400220f8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400220f8
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400220f3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400220d0
cmp edx, 0x9bc5a608
je 0x14002221e
test r8d, r8d
jne 0x1400220b0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14002210e
cmp qword [rax + 0x30], 0
jne 0x140022080
xor eax, eax
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400221b8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400221b8
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400221b3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140022190
cmp edx, 0x85cca27e
je 0x14002223a
test r8d, r8d
jne 0x140022170
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1400221ce
cmp qword [rax + 0x30], 0
jne 0x140022140
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x140022258
cmp qword [rsp + 0x68], 0
jne 0x140022217
cmp qword [rsp + 0x70], 0
jne 0x140022217
cmp qword [rsp + 0x78], 0
jne 0x140022217
cmp qword [rsp + 0x80], 0
jne 0x140022217
cmp qword [rsp + 0x88], 0
jne 0x140022217
cmp qword [rsp + 0x90], 0
je 0x140022258
mov eax, 1
jmp 0x14002225a
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140022110
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400221d0
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.14004c980
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140047400
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x140047437
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x140047420
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x140047528
sub rcx, r10
cmp r9, 8
jb 0x140047509
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x140047490
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x140047528
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x140047510
test r8d, r8d
sete al
ret
Function at 0x140047530
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1400476d4
cmp r9, 4
jb 0x14004757a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x140047560
xor r11d, r11d
test r9, r9
je 0x1400476d4
cmp r9, 8
jb 0x1400476ad
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1400475ac
cmp rdx, r8
jae 0x1400476ad
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1400475c1
cmp rdx, r10
jae 0x1400476ad
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x140047667
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x140047600
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x14004769f
mov rdx, r9
and rdx, 0xfffffffffffffff8
mov rbx, r10
lea rax, [r11 + r8]
sub rbx, r8
mov rdi, rcx
sub rdi, r8
nop
movq xmm1, qword [rax + rbx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rdx
jb 0x140047680
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x1400476d4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400476c0
add rsp, 8
ret

Function at 0x14004d690
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004d6da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004d6da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004d6da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004d6da
cmp dword [rcx + 0x84], 0xe
jbe 0x14004d6da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004d6dc
xor al, al
add rsp, 0x28
ret
Function at 0x18001dc30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18012c038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xor eax, eax
mov qword [rcx], rax
mov ecx, 0xe0
call fcn.1800b2720
mov rdi, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, vtable.kjellkod::Active.0
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x58], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
lea ecx, [rbp + 0x10]
call fcn.1800b2720
mov qword [rax + 8], rbp
mov qword [rbx], rax
mov qword [rax], rbx
lea rcx, [rbx + 0x28]
lea edx, [rbp + 2]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [rbx + 0x78]
call qword [sym.imp.MSVCP140.dll__Cnd_init_in_situ]
xorps xmm0, xmm0
movups xmmword [rdi + 0xc8], xmm0
mov byte [rdi + 0xd8], bpl
mov qword [rsi], rdi
mov dword [rsp + 0x30], 1
lea ecx, [rbp + 0x10]
call fcn.1800b2720
mov qword [rax], rdi
lea rcx, [0x18001d9b0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x18003f620]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18001dd95
mov rcx, qword [rsi]
cmp dword [rcx + 0xd0], ebp
jne 0x18001dd8e
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movups xmmword [rcx + 0xc8], xmm1
cmp dword [rsp + 0x48], ebp
jne 0x18001dd8e
mov rax, rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800b2700
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x48], ebp
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180027410
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rsi, rdx
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x20], 0
lea rcx, str.appdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180027446
call fcn.1800b1ba8
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov edx, eax
mov rcx, rsi
call fcn.18001b200
mov dword [rsp + 0x20], 0xe
mov rcx, rsi
call fcn.180031180
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.18001b860
mov rcx, rax
call fcn.1800a36f0
nop
mov dword [rsp + 0x20], 0xd
call fcn.1800b1ba8
lea rcx, str.Config.json
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0xb
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.18001b200
mov dword [rsp + 0x20], 0x3d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.18001b480
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180027521
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002751c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002751c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800b2ae4
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180027e10
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov qword [rsp + 0x60], rdi
lea rcx, str.ntdll.dll
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x180027ee9
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
movabs rbp, 0x7fffffffffffffff
mov qword [rsp + 0x38], r14
movabs r14, 0x7ffffffed5fa0dfe
mov qword [rsp + 0x30], r15
movabs r15, 0x12a05f200
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180027e86
imul rax, rax, 0x64
jmp 0x180027ea4
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jg 0x180027eb4
lea rcx, [rax + r15]
mov qword [rsp + 0x68], rcx
jmp 0x180027eb9
mov qword [rsp + 0x68], rbp
lea rcx, [rsp + 0x68]
call fcn.1800388b0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180027e68
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp edi, 1
mov rdi, qword [rsp + 0x60]
jne 0x180027f32
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rax, [0x18012d420]
mov qword [0x18012d428], rsi
mov qword [rsp + 0x28], rax
lea r8, [0x180028490]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x18012d418], rax
mov eax, 1
add rsp, 0x40
pop rsi
ret