joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d880
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SeBackupPrivilege
call fcn.14007eb50
lea rcx, str.SeRestorePrivilege
call fcn.14007eb50
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, str.Started__tid__u_
mov rcx, rbx
mov r9d, eax
lea rdx, str.FunctionalStriderHashClassifier
add rsp, 0x20
pop rbx
jmp fcn.14003bcd0

Function at 0x1400503e0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rbx
push rdi
push r12
sub rsp, 0x60
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [r11 - 0x28], r15
mov rbx, rcx
mov r15d, r12d
cmp qword [rcx + 0x68], r12
jbe 0x14005050f
mov qword [r11 + 0x10], rbp
lea rdi, [rcx + 0x88]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x20], r14
mov ecx, 0x58
call fcn.140091bc8
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
mov rbp, rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
mov qword [rax + 0x38], r12
mov word [rax + 0x38], r12w
mov qword [rax + 0x48], r12
mov qword [rax + 0x50], 7
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov r8, rcx
lea eax, [rcx + rdx]
test al, 1
jne 0x140050490
lea rax, [rcx + 2]
shr rax, 1
cmp qword [rdi + 0x10], rax
ja 0x140050490
mov rcx, rdi
call fcn.140039970
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx*2 - 1]
and rax, rdx
mov qword [rdi + 0x18], rax
dec rcx
lea rsi, [rax + r8]
mov rax, rsi
shr rax, 1
and rcx, rax
mov rax, qword [rdi + 8]
cmp qword [rax + rcx*8], r12
lea r14, [rcx*8]
jne 0x1400504de
lfence
mov ecx, 0x10
call fcn.140091bc8
mov rcx, qword [rdi + 8]
mov qword [r14 + rcx], rax
mov rax, qword [rdi + 8]
mov rax, qword [r14 + rax]
and esi, 1
inc r15
mov qword [rax + rsi*8], rbp
inc qword [rdi + 0x20]
cmp r15, qword [rbx + 0x68]
jb 0x140050424
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r9d, dword [rbx + 0x48]
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r15, qword [rsp + 0x50]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x1400505ca
mov rax, qword [rbx + 0x48]
mov byte [rbx + 0x38], 1
cmp rax, 0x40
jbe 0x14005054c
mov qword [rbx + 0x48], 0x40
jmp 0x140050551
test rax, rax
je 0x1400505b8
mov rdi, r12
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140050c30]
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400505af
mov rdx, qword [rbx + 0x58]
lea rcx, [rbx + 0x50]
cmp rdx, qword [rbx + 0x60]
je 0x1400505a5
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x1400505af
lea r8, [rsp + 0x30]
call fcn.140050c80
inc rdi
cmp rdi, qword [rbx + 0x48]
jb 0x140050560
mov rax, qword [rbx + 0x58]
sub rax, qword [rbx + 0x50]
sar rax, 3
test rax, rax
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140091ba0
add rsp, 0x60
pop r12
pop rdi
pop rbx
ret
Function at 0x140051760
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rcx, str.SeBackupPrivilege
call fcn.14007eb50
lea rcx, str.SeRestorePrivilege
call fcn.14007eb50
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, str.Started__tid__u_
mov rcx, rbx
mov r9d, eax
lea rdx, str.FunctionalPrescan
add rsp, 0x20
pop rbx
jmp fcn.14003bcd0

Function at 0x1400517c0
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [rcx + 8]
lea r8, str.Stopped
lea rdx, str.FunctionalPrescan
jmp fcn.14003bcd0
Function at 0x140052430
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.sha256
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + 0xc0]
mov qword [rbx + 0xd8], rax
mov rax, qword [rcx + 0xc8]
mov qword [rbx + 0xd0], rax
call fcn.14003a8c0
mov rcx, rbx
mov qword [rbx + 0xe0], rax
add rsp, 0x20
pop rbx
jmp method.Clean::FunctionalBaseAsync_unsigned_int__class_Clean::FunctionalPrescanInfo_.virtual_16
mov r11, rsp
push rbx
push rdi
push r12
sub rsp, 0x60
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [r11 + 0x10], rbp
mov rbx, rcx
mov ebp, r12d
cmp qword [rcx + 0x68], r12
jbe 0x140052537
mov qword [r11 + 0x18], rsi
lea rdi, [rcx + 0x88]
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov ecx, 0x20
call fcn.140091bc8
xorps xmm0, xmm0
mov r15, rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov r8, rax
lea ecx, [rax + rdx]
test cl, 1
jne 0x1400524bb
add rax, 2
shr rax, 1
cmp qword [rdi + 0x10], rax
ja 0x1400524bb
mov rcx, rdi
call fcn.140039970
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx*2 - 1]
and rax, rdx
mov qword [rdi + 0x18], rax
dec rcx
lea rsi, [rax + r8]
mov rax, rsi
shr rax, 1
and rcx, rax
mov rax, qword [rdi + 8]
cmp qword [rax + rcx*8], r12
lea r14, [rcx*8]
jne 0x140052509
lfence
mov ecx, 0x10
call fcn.140091bc8
mov rcx, qword [rdi + 8]
mov qword [r14 + rcx], rax
mov rax, qword [rdi + 8]
mov rax, qword [r14 + rax]
and esi, 1
inc rbp
mov qword [rax + rsi*8], r15
inc qword [rdi + 0x20]
cmp rbp, qword [rbx + 0x68]
jb 0x140052474
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x90]
mov r9d, dword [rbx + 0x48]
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rbp, qword [rsp + 0x88]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x1400525ea
mov rax, qword [rbx + 0x48]
mov byte [rbx + 0x38], 1
cmp rax, 0x40
jbe 0x140052577
mov qword [rbx + 0x48], 0x40
jmp 0x14005257c
test rax, rax
je 0x1400525d8
mov rdi, r12
nop
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140050c30]
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400525cf
mov rdx, qword [rbx + 0x58]
lea rcx, [rbx + 0x50]
cmp rdx, qword [rbx + 0x60]
je 0x1400525c5
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x1400525cf
lea r8, [rsp + 0x30]
call fcn.140050c80
inc rdi
cmp rdi, qword [rbx + 0x48]
jb 0x140052580
mov rax, qword [rbx + 0x58]
sub rax, qword [rbx + 0x50]
sar rax, 3
test rax, rax
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140091ba0
add rsp, 0x60
pop r12
pop rdi
pop rbx
ret
Function at 0x1400543c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
cmp qword [rcx + 0xd8], 0
jne 0x14005459b
xor esi, esi
mov qword [rbp + 7], rsi
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], si
lea r8d, [rsi + 0xc]
lea rdx, str.wintrust.dll
lea rcx, [rbp + 7]
call fcn.140009140
nop
lea rbx, [0x140111a90]
cmp word [0x140111a90], si
jne 0x140054444
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rbp - 0x19], rsi
mov qword [rbp - 9], rsi
mov qword [rbp - 1], 7
mov word [rbp - 0x19], si
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x140054460
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.140009140
nop
lea r8, [rbp + 7]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.1400853e0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x1400544cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400544c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140054650
call fcn.140091bc0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14005450b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054506
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140054656
call fcn.140091bc0
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rcx, qword [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rdi + 0xd8], rax
test rax, rax
jne 0x1400545c8
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.wintrust.dll
lea r8, str.Could_not_load__S__error__d_
lea rdx, str.FunctionalComputeAuthenticode
mov rcx, rbx
call fcn.14003bcd0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x14005459b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054596
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005464a
call fcn.140091bc0
mov rcx, rdi
call fcn.140055e00
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140091ba0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0xe0], rax
test rax, rax
jne 0x14005455b
lea r9, str.WinVerifyTrust
lea r8, str.Could_not_resolve__S
lea rdx, str.FunctionalComputeAuthenticode
mov rcx, qword [rdi + 8]
call fcn.14003bcd0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x140054643
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005463e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005464a
call fcn.140091bc0
xor al, al
jmp 0x1400545a3
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
int3
Function at 0x140054660
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SeBackupPrivilege
call fcn.14007eb50
lea rcx, str.SeRestorePrivilege
call fcn.14007eb50
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, str.Started__tid__u_
mov rcx, rbx
mov r9d, eax
lea rdx, str.FunctionalComputeAuthenticode
add rsp, 0x20
pop rbx
jmp fcn.14003bcd0

Function at 0x1400546b0
Capabilities:
Print debug messages

Disassembly:
mov r9, qword [rcx + 0xc0]
lea r8, str.Stopped___zu_objects_
mov rcx, qword [rcx + 8]
lea rdx, str.FunctionalComputeAuthenticode
jmp fcn.14003bcd0
Function at 0x140055e00
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rbx
push rdi
push r12
sub rsp, 0x60
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [r11 + 0x10], rbp
mov rbx, rcx
mov ebp, r12d
cmp qword [rcx + 0x68], r12
jbe 0x140055f13
mov qword [r11 + 0x18], rsi
lea rdi, [rcx + 0x88]
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov ecx, 0x30
call fcn.140091bc8
mov r14, rax
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r12
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov r8, rcx
lea eax, [rcx + rdx]
test al, 1
jne 0x140055e97
lea rax, [rcx + 2]
shr rax, 1
cmp qword [rdi + 0x10], rax
ja 0x140055e97
mov rcx, rdi
call fcn.140039970
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx*2 - 1]
and rax, rdx
mov qword [rdi + 0x18], rax
dec rcx
lea rsi, [rax + r8]
mov rax, rsi
shr rax, 1
and rcx, rax
mov rax, qword [rdi + 8]
cmp qword [rax + rcx*8], r12
lea r15, [rcx*8]
jne 0x140055ee5
lfence
mov ecx, 0x10
call fcn.140091bc8
mov rcx, qword [rdi + 8]
mov qword [r15 + rcx], rax
mov rax, qword [rdi + 8]
mov rax, qword [r15 + rax]
and esi, 1
inc rbp
mov qword [rax + rsi*8], r14
inc qword [rdi + 0x20]
cmp rbp, qword [rbx + 0x68]
jb 0x140055e44
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x90]
mov r9d, dword [rbx + 0x48]
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rbp, qword [rsp + 0x88]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x140055fca
mov rax, qword [rbx + 0x48]
mov byte [rbx + 0x38], 1
cmp rax, 0x40
jbe 0x140055f53
mov qword [rbx + 0x48], 0x40
jmp 0x140055f58
test rax, rax
je 0x140055fb8
mov rdi, r12
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140050c30]
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140055faf
mov rdx, qword [rbx + 0x58]
lea rcx, [rbx + 0x50]
cmp rdx, qword [rbx + 0x60]
je 0x140055fa5
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x140055faf
lea r8, [rsp + 0x30]
call fcn.140050c80
inc rdi
cmp rdi, qword [rbx + 0x48]
jb 0x140055f60
mov rax, qword [rbx + 0x58]
sub rax, qword [rbx + 0x50]
sar rax, 3
test rax, rax
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140091ba0
add rsp, 0x60
pop r12
pop rdi
pop rbx
ret
Function at 0x14005dcd0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
lea r8, str.Start
lea rdx, str.CollectorAutoruns
mov rcx, qword [rcx + 8]
call fcn.14003bb00
lea rax, vtable.Stopwatch.0
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
mov rdi, qword [rsi + 0x38]
mov rbx, qword [rsi + 0x30]
cmp rbx, rdi
je 0x14005dd59
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14007fe1f.0]
add rbx, 8
cmp rbx, rdi
jne 0x14005dd40
cmp qword [rsp + 0x30], 0
jne 0x14005dd65
xor eax, eax
jmp 0x14005dd9d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x14005dd8a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
sub rax, qword [rsp + 0x30]
imul rax, rax, 0x3e8
cqo
idiv qword [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14007e400
nop
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
lea r8, str.Finish___s_
lea rdx, str.CollectorAutoruns
mov rcx, qword [rsi + 8]
call fcn.14003bb00
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14005de13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005de0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005de32
call fcn.140091bc0
nop
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140091ba0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14009b188
nop
int3
Function at 0x14005fd50
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SeBackupPrivilege
call fcn.14007eb50
lea rcx, str.SeRestorePrivilege
call fcn.14007eb50
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, str.Started__tid__u_
mov rcx, rbx
mov r9d, eax
lea rdx, str.FunctionalComputeHash
add rsp, 0x20
pop rbx
jmp fcn.14003bcd0

Function at 0x14005fda0
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [rcx + 8]
lea r8, str.Stopped
lea rdx, str.FunctionalComputeHash
jmp fcn.14003bcd0
Function at 0x1400603c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.sha1
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + 0xc0]
mov qword [rbx + 0xd0], rax
call fcn.14003a8c0
mov rcx, qword [rbx + 8]
lea rdx, str.sha256
mov qword [rbx + 0xd8], rax
call fcn.14003a8c0
mov rcx, rbx
mov qword [rbx + 0xe0], rax
add rsp, 0x20
pop rbx
jmp method.Clean::FunctionalBaseAsync_unsigned_int__class_Clean::FunctionalComputeHashResult_.virtual_16
mov r11, rsp
push rbx
push rdi
push r12
sub rsp, 0x60
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [r11 - 0x28], r15
mov rbx, rcx
mov r15d, r12d
cmp qword [rcx + 0x68], r12
jbe 0x1400604ec
mov qword [r11 + 0x10], rbp
lea rdi, [rcx + 0x88]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x20], r14
mov ecx, 0x48
call fcn.140091bc8
mov qword [rsp + 0x30], rax
mov rbp, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
mov dword [rbp + 0x44], eax
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov r8, rcx
lea eax, [rcx + rdx]
test al, 1
jne 0x14006046d
lea rax, [rcx + 2]
shr rax, 1
cmp qword [rdi + 0x10], rax
ja 0x14006046d
mov rcx, rdi
call fcn.140039970
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx*2 - 1]
and rax, rdx
mov qword [rdi + 0x18], rax
dec rcx
lea rsi, [rax + r8]
mov rax, rsi
shr rax, 1
and rcx, rax
mov rax, qword [rdi + 8]
cmp qword [rax + rcx*8], r12
lea r14, [rcx*8]
jne 0x1400604bb
lfence
mov ecx, 0x10
call fcn.140091bc8
mov rcx, qword [rdi + 8]
mov qword [r14 + rcx], rax
mov rax, qword [rdi + 8]
mov rax, qword [r14 + rax]
and esi, 1
inc r15
mov qword [rax + rsi*8], rbp
inc qword [rdi + 0x20]
cmp r15, qword [rbx + 0x68]
jb 0x140060404
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r9d, dword [rbx + 0x48]
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r15, qword [rsp + 0x50]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14006059b
mov rax, qword [rbx + 0x48]
mov byte [rbx + 0x38], 1
cmp rax, 0x40
jbe 0x140060529
mov qword [rbx + 0x48], 0x40
jmp 0x14006052e
test rax, rax
je 0x140060589
mov rdi, r12
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140050c30]
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140060580
mov rdx, qword [rbx + 0x58]
lea rcx, [rbx + 0x50]
cmp rdx, qword [rbx + 0x60]
je 0x140060576
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x140060580
lea r8, [rsp + 0x30]
call fcn.140050c80
inc rdi
cmp rdi, qword [rbx + 0x48]
jb 0x140060531
mov rax, qword [rbx + 0x58]
sub rax, qword [rbx + 0x50]
sar rax, 3
test rax, rax
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140091ba0
add rsp, 0x60
pop r12
pop rdi
pop rbx
ret
Function at 0x140061a00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14007fe1f.0]
cmp eax, 3
jne 0x140061a58
mov rcx, rsi
call fcn.140062490
jmp 0x140061b13
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14007fe1f.0]
cmp eax, 4
jne 0x140061a7b
mov rcx, rsi
call fcn.1400621f0
jmp 0x140061b13
movzx edi, word [0x140111a90]
test di, di
jne 0x140061aa5
mov edx, 0x104
lea rcx, [0x140111a90]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edi, word [0x140111a90]
test di, di
je 0x140061b13
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0xc0]
mov rax, qword [rcx]
movzx edx, di
mov rax, qword [rax + 0x20]
call qword [case.0x14007fe1f.0]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x140061aeb
movzx r9d, di
lea r8, str.No_scan_available_for__c:
lea rdx, str.CollectorFile
mov rcx, qword [rsi + 8]
call fcn.14003bcd0
nop
jmp 0x140061b13
xor r9d, r9d
movzx r8d, di
mov rdx, rbx
mov rcx, rsi
call fcn.140061e80
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
nop
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140091ba0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400653c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400653e7
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140065450]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x20], rax
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140091ba0
add rsp, 0x40
pop rbx
ret
Function at 0x140071500
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rdx
lea r15, [0x140111250]
cmp word [0x140111250], 0
jne 0x140071558
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x28]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbp, 0xffffffffffffffff
mov r8, rbp
inc r8
cmp word [r15 + r8*2], 0
jne 0x140071562
cmp qword [rsi + 0x10], r8
jb 0x14007170b
lfence
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140071587
mov rcx, qword [rsi]
mov rdx, r15
call fcn.1400a1aa4
test eax, eax
jne 0x14007170b
mov r8, r14
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140070ac0
nop
cmp qword [rsp + 0x68], 0
je 0x1400716cd
mov rcx, rbp
nop word [rax + rax]
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x1400715c0
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bx
cmp qword [rsi + 0x10], rcx
jb 0x140071745
lfence
mov rax, qword [rsi + 0x10]
sub rax, rcx
cmp rax, 0xffffffffffffffff
cmovb rbp, rax
cmp qword [rsi + 0x18], 8
jb 0x14007160b
mov rsi, qword [rsi]
lea rdx, [rsi + rcx*2]
mov r8, rbp
lea rcx, [rsp + 0x38]
call fcn.140009140
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14006ed20
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140071672
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007166d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007174b
call fcn.140091bc0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bx
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14007171f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400716c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071751
call fcn.140091bc0
jmp 0x14007171f
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14007170b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007173f
call fcn.140091bc0
xor ebx, ebx
mov qword [rdi], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140091ba0
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14009b188
nop
call fcn.14000fc80
nop
call fcn.14009b188
nop
call fcn.14009b188
int3