joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400170a0
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.140041270
xor ebx, ebx
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x40], 0x38
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
lea r8, [rsi + 0x50]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400172f0
mov r15, rax
test rax, rax
je 0x1400172b2
test rdi, rdi
jne 0x140017219
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x190]
call fcn.140041270
lea rdx, [rbp + 0x190]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, str.ImageManifest
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140017184
mov eax, 0xc0150002
jmp 0x1400172b4
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
setg r14b
test rax, rax
jle 0x140017205
mov dword [rbp - 0x80], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x80]
mov r8d, dword [rsp + 0x78]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14b, r14b
je 0x1400171e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], rbx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rsi + 0x118]
lea rdx, [rbp - 0x70]
call fcn.140003db0
nop
jmp 0x14001726c
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x1400172b4
mov dword [rsp + 0x44], 8
movzx eax, word [rsi + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rdi
lea r14, [rsi + 0xf8]
lea r15, [rsi + 0x118]
cmp r15, r14
je 0x14001726c
mov rcx, r15
call fcn.1400035e0
mov rcx, r14
call fcn.1400035e0
mov rdi, qword [r14 + 0x10]
mov rcx, r14
call fcn.140004700
mov r8, rdi
mov rdx, rax
mov rcx, r15
call fcn.140004bc0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rdi, rax
mov rcx, qword [rsi + 0x48]
cmp rax, rcx
je 0x140017295
test rcx, rcx
jle 0x14001728e
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rsi + 0x48], rdi
mov rcx, rdi
test rcx, rcx
jg 0x1400172b2
mov rax, qword gs:[0x30]
cmp dword [rax + 0x1250], 0xc0000022
jne 0x1400172df
mov dword [rsi + 0x50], ebx
xor eax, eax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14003ecb0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x1400172b4
Function at 0x1400175f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov rbx, qword [r8 + 0x10]
mov rcx, r8
call fcn.140003d90
movabs rdi, 0xcbf29ce484222325
xor r9d, r9d
add rbx, rbx
je 0x140017654
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rax + r9]
xor rdi, rcx
imul rdi, rdx
inc r9
cmp r9, rbx
jb 0x140017640
mov rax, qword [rbp + 0x30]
and rax, rdi
add rax, rax
mov r15, qword [rbp + 0x18]
mov rbx, qword [r15 + rax*8 + 8]
lea r13, [rbp + 8]
mov r12, qword [r13]
cmp rbx, r12
je 0x1400176c7
mov r15, qword [r15 + rax*8]
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.14000ff10
test al, al
jne 0x1400176a1
cmp rbx, r15
je 0x1400176c4
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.14000ff10
test al, al
je 0x140017688
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, rbx
mov rbx, qword [rbp + 0x10]
movabs rax, 0x38e38e38e38e38e
mov qword [rsp + 0x80], rax
call fcn.140001780
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x90]
call fcn.140003610
cmp rbx, qword [rax]
je 0x14001785b
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 0
mov ecx, 0x48
call fcn.140005c30
mov qword [rsp + 0x38], rax
lea r15, [rax + 0x10]
mov rdx, r15
mov ecx, 0x38
call fcn.1400011d0
mov rbx, rax
mov rdx, rsi
mov rcx, rax
call fcn.14000e470
lea rcx, [rbx + 0x20]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
lea rdx, [0x14007f163]
call fcn.140001860
nop
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140017776
cvtsi2ss xmm0, rcx
jmp 0x14001778b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14001779e
cvtsi2ss xmm1, rcx
jmp 0x1400177b3
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
seta al
test al, al
je 0x14001782b
mov rcx, rbp
call fcn.14000f930
mov rsi, qword [rbp + 0x30]
and rsi, rdi
add rsi, rsi
mov rcx, qword [rbp + 0x18]
mov rbx, qword [rcx + rsi*8 + 8]
mov rax, qword [r13]
cmp rbx, rax
jne 0x1400177f1
mov qword [rsp + 0x28], 0
jmp 0x140017821
mov rsi, qword [rcx + rsi*8]
lea rdx, [rbx + 0x10]
mov rcx, r15
call fcn.14000ff10
test al, al
jne 0x14001781e
cmp rbx, rsi
je 0x14001784b
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rcx, r15
call fcn.14000ff10
test al, al
je 0x140017805
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov r12, qword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call fcn.14000f9f0
mov qword [r14], rax
mov byte [r14 + 8], 1
jmp 0x1400176a9
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
jmp 0x140017826
lea rcx, str.unordered_map_set_too_long
call fcn.14003c7d8
int3
Function at 0x140019ff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rdx
mov rsi, rcx
call fcn.140025990
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, r14
call fcn.140003ea0
mov rcx, r14
mov rbx, rax
call fcn.140003eb0
xor edi, edi
movabs r9, 0xcbf29ce484222325
mov edx, edi
test rbx, rbx
je 0x14001a063
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rax + rdx]
inc rdx
xor r9, rcx
imul r9, r8
cmp rdx, rbx
jb 0x14001a050
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140010af0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14001a086
cmp rcx, qword [rsi + 8]
je 0x14001a086
mov rdi, qword [rcx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14001dec0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 0x68]
xor esi, esi
mov qword [rsp + 0x48], rsi
mov rbx, rcx
test rax, rax
je 0x14001dfa9
mov rdx, qword [rax]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x50], rsi
add rdx, 0x18
je 0x14001dfa9
mov rax, qword [rcx + 0x70]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r9d, [rsi + 8]
lea r8, [rsp + 0x48]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp qword [rsp + 0x48], rsi
je 0x14001dfa9
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r8, rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov rcx, qword [rcx]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001df72
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x68]
mov qword [rsp + 0x40], rsi
test rdx, rdx
je 0x14001dfa9
mov rax, qword [rdx + 0x18]
lea r8, [rsp + 0x40]
mov rdx, qword [rdx]
mov r9d, 8
add rdx, 0x18
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14001dfbc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], rsi
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001e03b
call fcn.14001ba00
test al, al
je 0x14001e03b
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov qword [rsp + 0x78], rdi
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
mov edx, 0xffffffff
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001e00f
jle 0x14001e00b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], rsi
mov dword [rdi + 8], esi
mov rcx, qword [rbx + 0x28]
mov rdi, qword [rsp + 0x78]
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test rcx, rcx
je 0x14001e02d
call fcn.140001890
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14001e03b
call fcn.14001b710
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ecb0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret
Function at 0x140025310
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
xor edi, edi
mov qword [rdx], rdi
mov qword [rdx + 8], rdi
mov qword [rdx + 0x10], rdi
lea rdx, [0x14007f163]
mov rcx, rsi
call fcn.140001860
nop
mov r13d, 1
mov dword [rsp + 0x20], r13d
xor edx, edx
lea ecx, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jg 0x140025399
jmp 0x1400254c5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x54], rdi
mov dword [rsp + 0x40], 0x1c
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400254bb
lea rdi, vtable.std::_Ref_count_obj2_class_blackbone::Thread_.0
nop dword [rax]
mov rbp, qword [r12]
mov eax, dword [rbp + 8]
cmp dword [rsp + 0x4c], eax
jne 0x1400254a5
mov ecx, 0x28
call fcn.14003e768
mov r14, rax
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rdi
lea r15, [rax + 0x10]
mov rdx, r15
mov ecx, 0x18
call fcn.1400011d0
mov rdi, rax
mov r8d, dword [rsp + 0x48]
mov qword [rax], rbp
mov dword [rax + 8], r8d
xor edx, edx
mov ecx, 0x10005b
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
or r13d, 2
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r14
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140025481
mov ecx, 0x10
call fcn.1400011d0
mov qword [rax], r15
mov qword [rax + 8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
add qword [rsi + 8], 0x10
jmp 0x14002548f
lea r8, [rsp + 0x28]
mov rcx, rsi
call fcn.14000f250
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002549e
call fcn.140001890
lea rdi, vtable.std::_Ref_count_obj2_class_blackbone::Thread_.0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400253d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003ecb0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140025700
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor edi, edi
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140025951
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.140041270
mov dword [rsp + 0x6c], 0x208
mov dword [rsp + 0x68], 1
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.BuildLabEx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140025946
movzx edx, byte [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140003290
nop
lea rcx, [rbp - 0x60]
call fcn.140004b50
mov rcx, rax
call fcn.1400032c0
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call fcn.14000ecc0
nop
mov rbx, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.140004700
test rbx, rbx
je 0x140025833
mov rcx, rax
mov esi, edi
cmp word [rax], 0x2e
je 0x140025823
cmp rbx, 1
je 0x140025826
dec rbx
add rcx, 2
cmp word [rcx], 0x2e
jne 0x140025810
mov rsi, rcx
test rsi, rsi
je 0x140025833
sub rsi, rax
sar rsi, 1
jmp 0x14002583a
mov rsi, 0xffffffffffffffff
lea r14, [rsi + 1]
mov rbx, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.140004700
cmp r14, rbx
jae 0x140025883
sub rbx, r14
lea rcx, [rax + r14*2]
je 0x140025876
cmp word [rcx], 0x2e
je 0x140025873
cmp rbx, 1
je 0x140025876
dec rbx
add rcx, 2
cmp word [rcx], 0x2e
jne 0x140025860
mov rdi, rcx
test rdi, rdi
je 0x140025883
sub rdi, rax
sar rdi, 1
jmp 0x14002588a
mov rdi, 0xffffffffffffffff
cmp rdi, rsi
jbe 0x14002593c
cmp rsi, 0xffffffffffffffff
je 0x14002593c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x30]
call fcn.1400032c0
lea rcx, [rsp + 0x40]
call fcn.1400032d0
nop
mov rax, qword [rbp - 0x80]
cmp rax, r14
jb 0x14002597f
sub rdi, rsi
dec rdi
mov qword [rbp - 0x70], rdi
sub rax, r14
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x70]
call fcn.140003610
mov rbx, qword [rax]
lea rcx, [rsp + 0x70]
call fcn.140004700
lea rdx, [rax + r14*2]
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.14000ecc0
nop
lea rcx, [rsp + 0x40]
call fcn.140003d90
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.14004bb28
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.140003de0
nop
lea rcx, [rsp + 0x70]
call fcn.140003de0
mov eax, ebx
jmp 0x140025953
lea rcx, [rsp + 0x70]
call fcn.140003de0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14003ecb0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140011510
nop
int3
Function at 0x140028280
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [0x140090528], 0
jne 0x1400282f1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x140090518], rax
mov eax, dword [rsp + 0x48]
mov qword [0x140090520], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x140090528], rax
lea rax, [0x140090518]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ecb0
add rsp, 0x68
ret
Function at 0x140029640
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov qword [rcx + 8], rdx
lea rax, vtable.blackbone::Native.0
mov rdi, rcx
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 0x10], rsi
movzx ebx, r8b
lea rcx, [rsp + 0x28]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [rsp + 0x2c]
mov dword [rdi + 0x18], ecx
test bl, bl
je 0x1400296ad
mov word [rdi + 0x14], 0x101
mov byte [rdi + 0x16], 1
jmp 0x140029709
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x24], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov ecx, dword [rsp + 0x20]
cmp ecx, 1
mov edx, dword [rsp + 0x24]
sete al
cmp edx, 1
mov byte [rdi + 0x14], al
sete al
mov byte [rdi + 0x15], al
cmp ecx, 1
jne 0x14002972f
cmp edx, ecx
je 0x140029709
cmp ecx, 1
mov byte [rdi + 0x17], 1
setne sil
add esi, 2
mov dword [rdi + 0x10], esi
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ecb0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
test ecx, ecx
jne 0x1400296fb
test edx, edx
jne 0x1400296fb
mov dword [rdi + 0x10], 1
jmp 0x14002970c
Function at 0x140029a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov r15d, r9d
mov dword [rsp + 0x24], r9d
mov rbp, r8
mov qword [rsp + 0x30], r8
mov esi, edx
mov dword [rsp + 0x20], edx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
call fcn.140010200
mov r13, rax
lea rdx, str.NtSetInformationProcess
lea rcx, [rsp + 0x38]
call fcn.140003230
nop
call fcn.140025990
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x38]
call fcn.140003ea0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.140003eb0
movabs rdx, 0xcbf29ce484222325
xor r14d, r14d
mov r8d, r14d
test rbx, rbx
je 0x140029af4
movabs r9, 0x100000001b3
nop
movzx ecx, byte [r8 + rax]
xor rdx, rcx
imul rdx, r9
inc r8
cmp r8, rbx
jb 0x140029ae0
mov rcx, qword [r13 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
je 0x140029b68
mov r15, qword [rax + rcx*8]
lea rcx, [rbx + 0x10]
mov rdi, qword [rcx + 0x10]
call fcn.140004b00
mov rbp, rax
mov rsi, qword [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140004b00
cmp rsi, rdi
jne 0x140029b47
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1400416b0
test eax, eax
je 0x140029b52
cmp rbx, r15
je 0x140029b55
mov rbx, qword [rbx + 8]
jmp 0x140029b11
mov r14, rbx
mov r15d, dword [rsp + 0x24]
mov rbp, qword [rsp + 0x30]
mov esi, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
test r14, r14
je 0x140029b98
cmp r14, qword [r13 + 8]
je 0x140029b98
mov rbx, qword [r14 + 0x30]
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140029ba2
mov r9d, r15d
mov r8, rbp
mov edx, esi
mov rcx, qword [rdi + 8]
call rbx
mov ebx, eax
jmp 0x140029ba7
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x38]
call fcn.1400040b0
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140029bd0
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r14, r9
mov qword [rsp + 0x68], r9
mov rbp, r8
mov qword [rsp + 0x60], r8
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x70], rcx
call fcn.140010200
mov r13, rax
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x78]
call fcn.140003230
nop
call fcn.140025990
lea rdi, [r13 + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x78]
call fcn.140003ea0
mov rbx, rax
lea rcx, [rsp + 0x78]
call fcn.140003eb0
movabs rdx, 0xcbf29ce484222325
xor esi, esi
mov r8d, esi
test rbx, rbx
je 0x140029c74
movabs r9, 0x100000001b3
movzx ecx, byte [r8 + rax]
xor rdx, rcx
imul rdx, r9
inc r8
cmp r8, rbx
jb 0x140029c60
mov rcx, qword [r13 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
je 0x140029cfd
mov r15, qword [rax + rcx*8]
lea rcx, [rbx + 0x10]
mov rdi, qword [rcx + 0x10]
call fcn.140004b00
mov r14, rax
mov rbp, qword [rsp + 0x88]
lea rcx, [rsp + 0x78]
call fcn.140004b00
cmp rbp, rdi
jne 0x140029cca
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.1400416b0
test eax, eax
je 0x140029cd5
cmp rbx, r15
je 0x140029cea
mov rbx, qword [rbx + 8]
jmp 0x140029c91
lea rdi, [r13 + 0x40]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
jmp 0x140029d00
lea rdi, [r13 + 0x40]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
mov rbx, rsi
test rbx, rbx
je 0x140029d1a
cmp rbx, qword [r13 + 8]
je 0x140029d1a
mov rbx, qword [rbx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140029d26
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, rsi
lea rcx, [rsp + 0x78]
call fcn.1400040b0
mov rcx, qword [r15 + 8]
mov eax, dword [rsp + 0x110]
xor r8d, r8d
test rbx, rbx
je 0x140029d86
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
mov r9, rcx
mov edx, dword [rsp + 0x118]
mov rcx, r12
call rbx
test eax, eax
jns 0x140029dbf
mov qword [r12], rsi
jmp 0x140029dbf
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [r12], rax
test rax, rax
jne 0x140029dbd
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x1250]
mov eax, esi
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140029e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov qword [rsp + 0x28], r8
mov rsi, rdx
mov qword [rsp + 0x20], rdx
cmp byte [rcx + 0x15], 0
jne 0x140029e41
xor eax, eax
jmp 0x140029f7f
call fcn.140010200
mov r13, rax
lea rdx, str.Wow64GetThreadContext
lea rcx, [rsp + 0x30]
call fcn.140003230
nop
call fcn.140025990
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
call fcn.140003ea0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140003eb0
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov edx, ebp
test rbx, rbx
je 0x140029eb3
movabs r9, 0x100000001b3
nop
movzx ecx, byte [rdx + rax]
xor r8, rcx
imul r8, r9
inc rdx
cmp rdx, rbx
jb 0x140029ea0
mov rcx, qword [r13 + 0x30]
and rcx, r8
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r13 + 8]
je 0x140029f27
mov r14, qword [rax + rcx*8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rcx + 0x10]
call fcn.140004b00
mov r15, rax
mov rsi, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140004b00
cmp rsi, rbx
jne 0x140029f06
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.1400416b0
test eax, eax
je 0x140029f11
cmp rdi, r14
je 0x140029f1d
mov rdi, qword [rdi + 8]
jmp 0x140029ed0
mov rsi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
jmp 0x140029f2a
mov rsi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, rbp
test rdi, rdi
je 0x140029f54
cmp rdi, qword [r13 + 8]
je 0x140029f54
mov rbx, qword [rdi + 0x30]
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140029f5e
mov rdx, r14
mov rcx, rsi
call rbx
mov ebx, eax
jmp 0x140029f60
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, ebp
lea rcx, [rsp + 0x30]
call fcn.1400040b0
test ebx, ebx
jne 0x140029f7d
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x1250]
mov eax, ebp
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret