joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079f30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401afdfc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140079f80
lea ecx, [rax + 0xc]
mov qword [rsp + 0x20], rbx
call fcn.140013490
mov rbx, rax
test rax, rax
je 0x140079f67
mov byte [rax], 5
mov qword [rax + 4], 0
jmp 0x140079f69
xor ebx, ebx
mov ecx, dword [0x1401afdfc]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x14007cd20
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
mov rbx, r8
mov r10d, edx
mov r9, rcx
test edx, edx
je 0x14007cd43
nop
lea ecx, [r10 - 1]
cmp word [r9 + rcx*2], 0x3d
jne 0x14007cd43
mov r10d, ecx
test ecx, ecx
jne 0x14007cd30
mov eax, r10d
mov qword [rsp + 0x10], rsi
and al, 3
mov qword [rsp + 0x18], rdi
cmp al, 1
je 0x14007ce29
xor edx, edx
lea rsi, [0x1401303d0]
mov edi, 0x100
cmp r10d, 4
jb 0x14007cdc0
nop
mov eax, edx
mov r11d, edx
movzx ecx, word [r9]
add r9, 2
cmp cx, di
jae 0x14007ce29
movzx r8d, byte [rcx + rsi]
cmp r8b, 0xff
je 0x14007ce29
shl eax, 6
inc r11d
or eax, r8d
cmp r11d, 4
jl 0x14007cd75
mov byte [rbx + 2], al
add r10d, 0xfffffffc
shr eax, 8
mov byte [rbx + 1], al
shr eax, 8
mov byte [rbx], al
add rbx, 3
cmp r10d, 4
jae 0x14007cd70
test r10d, r10d
je 0x14007ce1b
mov r8d, edx
nop dword [rax + rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
cmp ax, di
jae 0x14007ce29
movzx ecx, byte [rax + rsi]
cmp cl, 0xff
je 0x14007ce29
shl edx, 6
inc r8d
or edx, ecx
cmp r8d, r10d
jb 0x14007cdd0
cmp r10d, 4
jge 0x14007ce0a
mov ecx, 4
sub ecx, r10d
shl edx, 6
sub rcx, 1
jne 0x14007ce01
shr edx, 8
cmp r10d, 3
jb 0x14007ce16
mov byte [rbx + 1], dl
shr edx, 8
mov byte [rbx], dl
mov al, 1
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
pop rbx
ret
mov rdi, qword [rsp + 0x18]
xor al, al
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x14007d7a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rbx, r8
mov r11d, edx
mov r10, rcx
mov r9, r8
cmp edx, 3
jb 0x14007d84a
mov eax, 0xaaaaaaab
mov qword [rsp + 0x10], rdi
mul r11d
shr edx, 1
mov edi, edx
movzx ecx, byte [r10 + 1]
add r11d, 0xfffffffd
movzx r8d, byte [r10]
movzx edx, byte [r10 + 2]
add r10, 3
shl r8d, 8
or r8d, ecx
shl r8d, 8
or r8d, edx
mov eax, r8d
shr r8d, 6
and eax, 0x3f
mov ecx, r8d
shr rcx, 6
movzx eax, byte [rax + rsi]
mov word [r9 + 6], ax
mov eax, r8d
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov word [r9 + 4], ax
mov rax, rcx
and eax, 0x3f
shr rcx, 6
movzx eax, byte [rax + rsi]
mov word [r9 + 2], ax
movzx eax, byte [rcx + rsi]
mov word [r9], ax
add r9, 8
sub rdi, 1
jne 0x14007d7d3
mov rdi, qword [rsp + 0x10]
test r11d, r11d
je 0x14007d8b3
movzx ecx, byte [r10]
xor al, al
cmp r11d, 2
jne 0x14007d860
movzx eax, byte [r10 + 1]
shl ecx, 8
mov r8d, 0x3d
movzx eax, al
or ecx, eax
mov word [r9 + 6], r8w
shl ecx, 8
shr ecx, 6
mov edx, ecx
cmp r11d, 1
je 0x14007d88b
mov eax, ecx
and eax, 0x3f
movzx r8d, byte [rax + rsi]
mov word [r9 + 4], r8w
shr rdx, 6
mov rax, rdx
shr rdx, 6
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov word [r9 + 2], ax
movzx eax, byte [rdx + rsi]
mov word [r9], ax
add r9, 8
xor eax, eax
mov word [r9], ax
sub r9, rbx
mov rbx, qword [rsp + 0x18]
sar r9, 1
mov eax, r9d
pop rsi
ret
Function at 0x14007f830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push r14
sub rsp, 0x58
mov r14, rdx
mov rsi, rcx
cmp rcx, rdx
je 0x14007fa1f
mov qword [rsp + 0x50], rbx
mov r9d, 4
mov qword [rsp + 0x48], rbp
lea rbx, [rcx + 0x38]
mov qword [rsp + 0x40], rdi
mov rcx, rbx
movsxd rdi, dword [rdx + 0x48]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x28], r15
call fcn.140018cf0
mov rax, qword [r14 + 0x40]
lea rdx, [r14 + 0x38]
mov r9, qword [rbx + 8]
mov r8, rdi
shl r8, 2
test rax, rax
cmovne rdx, rax
test r9, r9
cmovne rbx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + 0x48], edi
mov rcx, rsi
movsxd rbx, dword [r14 + 8]
mov edx, ebx
call fcn.14005dfb0
mov edx, dword [rsi + 8]
lea eax, [rdx + rbx]
mov dword [rsi + 8], eax
cmp eax, dword [rsi + 0xc]
jle 0x14007f8ca
mov rcx, rsi
call fcn.140070870
mov eax, dword [r14 + 0x30]
lea r15, [r14 + 0x10]
lea rcx, [rsi + 0x10]
mov dword [rsi + 0x30], eax
mov eax, dword [r14 + 0x34]
mov dword [rsi + 0x34], eax
cmp rcx, r15
je 0x14007f8ed
mov rdx, r15
call fcn.1400219e0
mov rax, qword [r14]
xor ebp, ebp
mov rcx, qword [rsi]
mov r14, rbx
test ebx, ebx
jle 0x14007fa1a
sub rax, rcx
mov qword [rsp + 0x38], r12
lea rbx, [rcx + 0x1c]
mov qword [rsp + 0x30], r13
lea edi, [rbp + 1]
lea rcx, [rax - 0xc]
mov qword [rsp + 0x78], rcx
lea r12, [rax - 0x18]
mov rsi, qword [rsp + 0x78]
lea rcx, [rax + 0x44]
mov qword [rsp + 0x80], rcx
lea r13, [rax - 0x1c]
lea rcx, [rax + 0x48]
mov qword [rsp + 0x88], rcx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r15 + 0x10]
lea rdx, [rbx + r13]
test rax, rax
lea rcx, [rbx - 0x1c]
mov r8, r15
cmovne r8, rax
mov eax, ebp
test ebp, ebp
jns 0x14007f96f
lea eax, [rbp + 0x1f]
sar eax, 5
cdqe
test dword [r8 + rax*4], edi
je 0x14007f9d2
call fcn.140013200
xor eax, eax
mov dword [rbx + 0x20], 0x80
lea rcx, [rbx - 0xc]
mov qword [rbx - 4], rax
lea rdx, [rsi + rbx]
mov qword [rcx], rax
mov qword [rbx + 0x14], rax
mov dword [rbx + 0x1c], eax
mov dword [rbx + 0x28], eax
mov qword [rbx + 0x34], rax
mov dword [rbx + 0x3c], eax
mov dword [rbx + 0x24], 0xffffffff
call fcn.140024600
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx + rbx]
mov dword [rbx + 0x44], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + rbx]
mov dword [rbx + 0x48], eax
jmp 0x14007f9dd
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rbx + r12]
mov dword [rbx - 0x18], eax
inc ebp
rol edi, 1
add rbx, 0x68
sub r14, 1
jne 0x14007f950
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x28]
add rsp, 0x58
pop r14
pop rsi
ret
mov rax, rsi
jmp 0x14007f9fe
mov rax, rsi
add rsp, 0x58
pop r14
pop rsi
ret
Function at 0x14008d960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea r9d, [rcx + 3]
mov ebx, edx
and r9d, 0xfffffffc
lea rsi, [0x1401597c0]
sub r9d, ecx
mov r11, rcx
not r8d
cmp edx, r9d
jle 0x14008da77
sub ebx, r9d
mov qword [rsp + 0x10], rdi
test r9d, r9d
je 0x14008d9c1
nop word [rax + rax]
movzx eax, byte [r11]
inc r11
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub r9d, 1
jne 0x14008d9a0
mov eax, ebx
cdq
and edx, 7
add eax, edx
mov edi, eax
and eax, 7
sub eax, edx
sar edi, 3
mov ebx, eax
test edi, edi
je 0x14008da72
nop dword [rax]
mov r10d, dword [r11 + 4]
mov ecx, dword [r11]
add r11, 8
xor ecx, r8d
mov r9d, ecx
mov eax, ecx
shr rax, 0x10
movzx edx, al
mov eax, ecx
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
add edi, 0xffffffff
jne 0x14008d9e0
mov rdi, qword [rsp + 0x10]
test ebx, ebx
je 0x14008daa1
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub ebx, 1
jne 0x14008da80
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x14009c180
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov eax, dword [rcx + 0x38]
mov rbx, rcx
test eax, eax
je 0x14009c1bf
dec eax
test eax, eax
jle 0x14009c1bf
lea rdx, [rcx + 0x18]
mov r8b, 1
mov rcx, qword [rcx + 0x30]
call fcn.14009f410
test al, al
je 0x14009c21a
mov r8, qword [rbx + 0x10]
lea rax, [rsp + 0xa0]
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xe0], rax
xor eax, eax
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
call fcn.1400ab1d0
lea rcx, [rsp + 0x20]
call fcn.14009d410
cmp byte [rbx + 0x41], 0
je 0x14009c229
mov rcx, qword [rbx + 8]
call fcn.140044390
test rbx, rbx
je 0x14009c23c
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14010f320
add rsp, 0x100
pop rbx
ret
Function at 0x14009d410
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edx, dword [rcx + 0x18]
mov rbx, rcx
mov ecx, dword [rcx + 0x14]
mov eax, edx
shr eax, 0x18
mov r9d, ecx
mov byte [rsp + 0x20], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x21], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x22], al
mov eax, ecx
shr eax, 0x18
mov byte [rsp + 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x23], dl
shl rdx, 0x20
shr r9, 3
or rdx, rcx
mov byte [rsp + 0x25], al
add rdx, 8
mov eax, ecx
mov dword [rbx + 0x14], edx
shr eax, 8
and r9d, 0x3f
shr rdx, 0x20
mov qword [rsp + 0x48], rbp
lea rbp, [0x1401342b8]
mov byte [rsp + 0x26], al
lea rax, [r9 + 1]
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x27], cl
mov dword [rbx + 0x18], edx
cmp rax, 0x3f
jbe 0x14009d50a
mov esi, 0x40
mov qword [rsp + 0x58], rdi
sub rsi, r9
lea rcx, [rbx + 0x20]
mov r8, rsi
add rcx, r9
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rbx + 0x20]
mov rdx, rbx
mov rcx, rbx
call fcn.1400a9ce0
lea rdi, [rsi + 0x3f]
cmp rdi, 1
jae 0x14009d500
nop
lea r8, [rbp - 0x3f]
mov rdx, rbx
add r8, rdi
mov rcx, rbx
call fcn.1400a9ce0
add rsi, 0x40
add rdi, 0x40
cmp rdi, 1
jb 0x14009d4e0
mov rdi, qword [rsp + 0x58]
xor r9d, r9d
jmp 0x14009d50c
xor esi, esi
mov r8d, 1
lea rcx, [rbx + 0x20]
sub r8, rsi
lea rdx, [rsi + rbp]
add rcx, r9
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rbx + 0x14]
mov rsi, qword [rsp + 0x50]
and eax, 0x1f8
mov rbp, qword [rsp + 0x48]
cmp eax, 0x1c0
je 0x14009d564
nop
mov r8d, 1
lea rdx, [0x1401342bc]
mov rcx, rbx
call fcn.1400ab1d0
mov eax, dword [rbx + 0x14]
and eax, 0x1f8
cmp eax, 0x1c0
jne 0x14009d540
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400ab1d0
mov ecx, dword [rbx]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x60], al
shr ecx, 0x10
mov byte [rbx + 0x61], cl
mov eax, dword [rbx]
shr eax, 8
mov byte [rbx + 0x62], al
movzx eax, byte [rbx]
mov byte [rbx + 0x63], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0x64], al
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
mov eax, dword [rbx + 4]
shr eax, 8
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 0x69], al
mov eax, dword [rbx + 8]
shr eax, 8
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx + 8]
mov byte [rbx + 0x6b], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0x6c], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0x6d], al
mov eax, dword [rbx + 0xc]
shr eax, 8
mov byte [rbx + 0x6e], al
movzx eax, byte [rbx + 0xc]
mov byte [rbx + 0x6f], al
movzx eax, byte [rbx + 0x13]
mov byte [rbx + 0x70], al
movzx eax, byte [rbx + 0x12]
mov byte [rbx + 0x71], al
mov eax, dword [rbx + 0x10]
shr eax, 8
mov byte [rbx + 0x72], al
movzx eax, byte [rbx + 0x10]
mov byte [rbx + 0x73], al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14010f320
add rsp, 0x30
pop rbx
ret
Function at 0x1400a77c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rcx
mov r8d, dword [0x1402374f4]
movzx edi, dl
mov ecx, 0x1c
mov r9, qword [rax + r8*8]
mov eax, dword [rcx + r9]
cmp dword [0x1401db560], eax
jg 0x1400a784f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x40]
mulsd xmm1, qword [0x14016fa60]
addsd xmm1, qword [0x14011dd38]
test dil, dil
jne 0x1400a7834
movaps xmm0, xmm1
subsd xmm0, qword [0x1401db558]
comisd xmm0, xmmword [0x14015c8a0]
jbe 0x1400a7844
mov rcx, rbx
movsd qword [0x1401db558], xmm1
call fcn.1400ab370
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1401db560]
call fcn.14010f50c
cmp dword [0x1401db560], 0xffffffff
jne 0x1400a77f5
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
lea rcx, [0x1401db560]
cvtsi2sd xmm0, qword [rsp + 0x40]
mulsd xmm0, qword [0x14016fa60]
addsd xmm0, qword [0x14011dd38]
movsd qword [0x1401db558], xmm0
call fcn.14010f4ac
jmp 0x1400a77f5
Function at 0x1400adfd0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
mov rdi, rcx
mov qword [rsp + 0x58], rsi
mov rbx, r8
lea rsi, [rcx + 0x18]
movaps xmmword [rsp + 0x20], xmm6
mov rcx, r8
movaps xmm6, xmm1
call fcn.1400676f0
test al, al
je 0x1400ae006
call fcn.140063240
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.140051540
cmp byte [rdi + 0x51], 0
movss xmm1, dword [rdi + 0x34]
addss xmm1, dword [rdi + 0x38]
movss xmm0, dword [rdi + 0x30]
subss xmm0, xmm1
movss dword [rdi + 0x34], xmm1
minss xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x20]
movss dword [rdi + 0x38], xmm0
jne 0x1400ae13c
cmp byte [rdi + 0x4c], 0
je 0x1400ae13c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x40]
mulsd xmm0, qword [0x14016fa60]
addsd xmm0, qword [0x14011dd38]
subsd xmm0, qword [rdi + 0x40]
cvtpd2ps xmm0, xmm0
comiss xmm0, dword [rdi + 0x48]
jbe 0x1400ae13c
mov rcx, qword [rdi + 0x58]
movzx ebx, byte [rdi + 0x60]
mov qword [rsp + 0x50], rbp
movzx ebp, bl
and bpl, 1
mov rax, qword [rcx]
call qword [rax + 0x70]
test al, al
je 0x1400ae0aa
test bl, 2
jne 0x1400ae0aa
mov al, 1
jmp 0x1400ae0ac
xor al, al
cmp byte [rdi + 0x50], 0
je 0x1400ae0e4
cmp byte [0x1401ba364], 0
jne 0x1400ae0e4
test al, al
jne 0x1400ae0e4
cmp byte [0x1401ba380], al
je 0x1400ae0da
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1401ba378]
sete al
test al, al
je 0x1400ae0e4
cmp dword [rdi + 0x3c], 2
je 0x1400ae0e4
mov al, 1
jmp 0x1400ae0e6
xor al, al
cmp byte [0x1401ba365], 0
jne 0x1400ae137
test al, al
je 0x1400ae137
mov rcx, rsi
call fcn.1400676f0
mov rcx, qword [rdi + 0x58]
test al, al
movzx r8d, bpl
cmovne rsi, rdi
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp byte [0x1401ba365], 0
je 0x1400ae137
mov rbx, qword [rdi + 0x58]
mov dl, 1
mov rcx, rbx
mov byte [rdi + 0x51], 1
call fcn.1400a77c0
mov dl, 1
mov rcx, rbx
call fcn.1400a77c0
mov rbp, qword [rsp + 0x50]
cmp byte [rdi + 0x50], 0
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
je 0x1400ae15c
mov rcx, qword [rdi + 0x58]
xor edx, edx
add rsp, 0x30
pop rdi
jmp fcn.1400a77c0
add rsp, 0x30
pop rdi
ret
Function at 0x1400b8750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov qword [rcx + 8], r15
mov dword [rcx], r15d
mov dword [rcx + 0x10], r15d
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x40], r15
mov dword [rcx + 0x58], r15d
mov dword [rcx + 0x9470], r15d
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x30], r15d
mov qword [rcx + 0x38], r15
mov qword [rcx + 0x48], r15
mov qword [rcx + 0x50], r15
add rcx, 0xb4b0
call fcn.140023530
xor r9d, r9d
mov qword [rdi + 0xb520], r15
xor r8d, r8d
lea edx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r15 + 1]
xor r8d, r8d
mov qword [rdi + 0x18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [0x1400c3430]
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r9, rdi
mov qword [rsp + 0x28], rdi
lea r8, [0x1400bd8c0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
je 0x1400b8824
lea edx, [r15 - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rdi + 0x40], r15
je 0x1400b8833
mov eax, dword [rdi + 0x58]
mov dword [0x14016f244], eax
call fcn.14008aac0
xor r8d, r8d
xor ecx, ecx
mov rbp, rax
lea edx, [r8 + 0x30]
call fcn.140047220
mov rbx, rax
mov r14d, 3
test rax, rax
je 0x1400b8883
lea rax, [0x14011b438]
mov qword [rbx], rax
call fcn.1400211e0
mov qword [rbx + 0x10], rax
lea rax, [0x14011de40]
mov qword [rbx], rax
lea rax, [0x1400c09b0]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x18], rdi
mov rsi, rbx
test rbx, rbx
je 0x1400b88d7
mov dl, 1
mov rcx, rbp
call fcn.140014180
mov rax, qword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x38]
movsxd rsi, dword [rbp + 8]
lea eax, [rsi + 1]
mov dword [rbp + 8], eax
cmp eax, dword [rbp + 0xc]
jle 0x1400b88bc
mov edx, esi
mov rcx, rbp
call fcn.1400190f0
mov rax, rsi
mov rsi, r15
shl rax, 4
add rax, qword [rbp]
mov qword [rax], rbx
mov rbx, r15
mov dword [rax + 8], r14d
mov r14d, r15d
test r14d, r14d
mov rcx, rsi
cmove rcx, r15
test rcx, rcx
je 0x1400b88f7
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
test rsi, rsi
je 0x1400b891b
mov rcx, rsi
jmp 0x1400b890e
test r14d, r14d
je 0x1400b891b
test rbx, rbx
je 0x1400b8928
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call fcn.140047220
mov rbx, rax
test rbx, rbx
je 0x1400b8928
mov rcx, rbx
call fcn.140044390
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400b8950
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x140136d88]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov r10, rdx
xor eax, eax
mov dword [rcx + 0x40], r8d
mov qword [rcx + 0x30], rax
mov rbx, rcx
mov qword [rcx + 0x38], rax
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x48], eax
lea rax, [rdx - 1]
mov dword [rcx + 0x44], r9d
cmp rax, 0xfffffffffffffffd
ja 0x1400b89a4
lea rdx, [rsp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x38], rax
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
add rsp, 0x20
pop rbx
ret
Function at 0x1400bbf20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push r12
push r13
sub rsp, 0x28
mov qword [rsp + 0x58], rdi
mov r12, rdx
mov qword [rsp + 0x60], r14
mov rsi, rcx
mov qword [rsp + 0x20], r15
call fcn.14002ad20
mov r14, rax
call fcn.14002fb10
mov r8, qword [rsi]
xor r13d, r13d
mov rdi, 0xffffffffffffffff
mov r15, rax
mov rdx, rdi
mov r9, qword [r8]
mov word [r9], r13w
mov r8, qword [rsi]
mov rcx, qword [r8]
nop dword [rax]
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bbf70
mov r8d, dword [rsi + 8]
movsxd rax, edx
mov qword [rsp + 0x50], rbx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bbfb6
movsxd rbx, eax
mov rdx, r14
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov r14, qword [rsp + 0x60]
mov rdx, rdi
nop
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bbfc0
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bc001
movsxd rbx, eax
lea rdx, str.Binaries_
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov rdx, rdi
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bc004
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bc041
movsxd rbx, eax
mov rdx, r15
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov r15, qword [rsp + 0x20]
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bc050
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bc091
movsxd rbx, eax
lea rdx, [0x140128070]
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x1400bc091
movsxd rax, edi
sub r8d, edi
mov rdi, qword [rsp + 0x58]
lea rbp, [rcx + rax*2]
test r8d, r8d
jle 0x1400bc0ce
movsxd rbx, r8d
mov rdx, r12
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, qword [rsp + 0x50]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1400be5e0
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [0x140165070], 0
jne 0x1400be72c
xorps xmm0, xmm0
mov qword [r11 + 8], rbx
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 + 0x10], rsi
lea rcx, [r11 - 0x58]
mov qword [r11 - 8], rdi
mov edi, 0x40
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x28], xmm0
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rsp + 0x58]
mov r9d, 0x3f
mov ecx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x78]
mov qword [0x140165078], rax
mov eax, dword [rsp + 0x24]
mov qword [0x140165098], rax
mov qword [0x140165080], rax
lea rax, [rbx - 1]
mov qword [0x140165090], rcx
mov qword [0x140165088], rcx
bsr r10, rbx
mov qword [0x140165070], rbx
setne r11b
bsr rcx, rax
mov eax, r9d
setne r8b
sub eax, ecx
mov ecx, eax
xor esi, esi
test r8b, r8b
mov eax, edi
mov edx, esi
cmovne eax, esi
cmovne edx, ecx
or dl, al
sub r9d, r10d
sub dil, dl
mov eax, r9d
test r11b, r11b
mov ecx, esi
mov edx, 1
cmovne ecx, eax
mov eax, 0xffffffff
cmovne eax, esi
mov rsi, qword [rsp + 0xb8]
or rcx, rax
lea rax, [rbx + 0x3fffffff]
mov rbx, qword [rsp + 0xb0]
shl rcx, 0x39
sar rcx, 0x3f
not cl
and cl, dil
mov rdi, qword [rsp + 0xa0]
shl rdx, cl
shr rax, 0x1e
mov dword [0x1401650a8], eax
mov qword [0x1401650a0], rdx
lea rax, [0x140165070]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14010f320
add rsp, 0xa8
ret