joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21019df30
Capabilities:
Check if file exists

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp qword [rcx + 0x58], 0
mov rdi, rcx
jne 0x21019e13c
cmp byte [rcx + 0x60], 0
jne 0x21019e11d
cmp byte [rcx + 0x61], 0
jne 0x21019e0fe
mov r12, qword [0x2102c8eb0]
lea rsi, [rcx + 8]
test byte [r12], 1
jne 0x21019e0ba
mov rbp, qword [0x2102c8ea0]
xor ebx, ebx
nop dword [rax]
mov qword [rsp + 0x30], 0
mov r9, rbp
mov r8d, 3
mov rcx, rsi
mov dword [rsp + 0x28], 0x20000
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call sym.CreateFileW
mov qword [rdi + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x21019e09b
cmp byte [0x21032e9f0], 0
mov qword [rdi + 0x58], 0
je 0x21019e058
cmp ebx, 0x40
jne 0x21019dfe8
jmp 0x21019df80
add ebx, 1
cmp ebx, 0x40
je 0x21019e012
mov edx, 0xa
mov rcx, rsi
call sym.WaitNamedPipeW
test eax, eax
jne 0x21019df80
call sym.GetLastError
cmp eax, 2
jne 0x21019dfe0
xor ecx, ecx
add ebx, 1
call sym.Sleep
cmp ebx, 0x40
jne 0x21019dfe8
call sym.GetLastError
lea r9, str.lost_connection_to_cygserver__error___u
mov edx, 0x8000
mov rcx, r12
mov dword [rsp + 0x20], eax
lea r8, str.virtual_int_transport_layer_pipes::connect__
mov r13d, 0xffffffff
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov byte [0x21032e9f0], 0
mov eax, r13d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call sym.GetLastError
cmp eax, 0xe7
je 0x21019dfd2
mov r13d, 0xffffffff
test byte [r12], 1
je 0x21019e043
call sym.GetLastError
lea r9, str.Error_opening_the_pipe___u_
mov edx, 0x40
mov rcx, r12
mov dword [rsp + 0x20], eax
lea r8, str.virtual_int_transport_layer_pipes::connect__
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21019e043
test rax, rax
je 0x21019e0df
xor r13d, r13d
mov byte [0x21032e9f0], 1
mov eax, r13d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x20], rsi
lea r9, str.Try_to_connect_to_named_pipe:__W
mov edx, 0x40
mov rcx, r12
lea r8, str.virtual_int_transport_layer_pipes::connect__
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21019df74
lea r9, str._hPipe
lea r8, str.virtual_int_transport_layer_pipes::connect__
mov edx, 0x10c
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
lea r9, str.__is_listening_endpoint
lea r8, str.virtual_int_transport_layer_pipes::connect__
mov edx, 0xf8
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
lea r9, str.__is_accepted_endpoint
lea r8, str.virtual_int_transport_layer_pipes::connect__
mov edx, 0xf7
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
lea r9, str.__hPipe
lea r8, str.virtual_int_transport_layer_pipes::connect__
mov edx, 0xf6
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
nop
nop dword [rax]
Function at 0x21019e2e0
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x50
mov r10, qword [rcx + 0x58]
test r10, r10
je 0x21019e407
cmp r10, 0xffffffffffffffff
je 0x21019e3e8
cmp byte [rcx + 0x61], 0
jne 0x21019e3c9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov rcx, r10
call sym.WriteFile
test eax, eax
je 0x21019e330
mov eax, dword [rsp + 0x4c]
add rsp, 0x50
pop r12
ret
mov r12, qword [0x2102c8eb0]
test byte [r12], 1
jne 0x21019e362
mov rax, qword [sym.msys_2.0.dll__impure_ptr]
mov rax, qword [rax]
mov dword [rax], 0x16
call sym.msys_2.0.dll___errno
mov dword [rax], 0x16
mov rax, 0xffffffffffffffff
jmp 0x21019e325
call sym.GetLastError
lea r9, str.error_writing_to_pipe__error___u
mov edx, 0x40
mov rcx, r12
mov dword [rsp + 0x20], eax
lea r8, str.virtual_ssize_t_transport_layer_pipes::write_void__size_t_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
test byte [r12], 1
je 0x21019e33e
mov dword [rsp + 0x30], 0x16
mov edx, 0x40
mov rcx, r12
lea rax, str.virtual_ssize_t_transport_layer_pipes::write_void__size_t_
mov dword [rsp + 0x28], 0xe3
lea r9, str._s:_d_setting_errno__d
lea r8, str.int___set_errno_const_char__int__int_
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21019e33e
lea r9, str.__is_listening_endpoint
lea r8, str.virtual_ssize_t_transport_layer_pipes::write_void__size_t_
mov edx, 0xdd
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
lea r9, str._hPipe___INVALID_HANDLE_VALUE
lea r8, str.virtual_ssize_t_transport_layer_pipes::write_void__size_t_
mov edx, 0xdc
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
lea r9, str._hPipe
lea r8, str.virtual_ssize_t_transport_layer_pipes::write_void__size_t_
mov edx, 0xdb
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
nop
nop
nop dword [rax + rax]
Function at 0x2101b4b90
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov edx, 0x28
lea r12, [rsp + 0x20]
mov rcx, r12
call sym.getentropy_1
cmp eax, 0xffffffff
je 0x2101b4cc0
cmp qword [0x21032ee98], 0
je 0x2101b4c80
mov rbx, qword [0x21032ee90]
lea r13, [rbx + 0x40]
mov rcx, rbx
mov r8, r13
mov rdx, r13
call sym.chacha_encrypt_bytes.constprop.0
xor eax, eax
nop dword [rax]
movzx edx, byte [r12 + rax]
xor byte [rbx + rax + 0x40], dl
add rax, 1
cmp rax, 0x28
jne 0x2101b4be0
mov rdx, r13
mov rcx, rbx
mov r8d, 0x28
call sym.chacha_keysetup.constprop.0
mov rax, qword [rbx + 0x60]
xor edx, edx
mov rcx, r13
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x38], rax
call sym.msys_2.0.dll_memset
mov rax, qword [0x21032ee98]
mov qword [rax], 0x3d8
mov rcx, r12
mov edx, 0x28
call sym.msys_2.0.dll_explicit_bzero
mov rax, qword [0x21032ee98]
mov r8d, 0x400
xor edx, edx
mov qword [rax], 0
mov rax, qword [0x21032ee90]
lea rcx, [rax + 0x40]
call sym.msys_2.0.dll_memset
mov rax, qword [0x21032ee98]
mov qword [rax + 8], 0x186a00
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
lea rax, [0x21032ea40]
mov rdx, r12
lea rcx, [rax + 0x10]
mov qword [0x21032ee98], rax
mov qword [0x21032ee90], rcx
call sym.chacha_keysetup.constprop.0
mov rax, qword [rsp + 0x40]
mov qword [0x21032ea80], 0
mov qword [0x21032ea88], rax
jmp 0x2101b4c2c
mov ecx, 9
call sym.raise_1
jmp 0x2101b4bb4

Function at 0x2101c8fb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rax, rcx
mov ebx, edx
mov r8d, edx
test al, 7
jne 0x2101c8fc8
jmp 0x2101c8fd0
add rax, 1
test al, 7
je 0x2101c8fd0
cmp byte [rax], r8b
jne 0x2101c8fc0
pop rbx
ret
movabs r11, 0xfefefefefefefeff
movzx ecx, bl
movabs r10, 0x8080808080808080
mov edx, ecx
shl edx, 8
or edx, ecx
movsxd rdx, edx
mov rcx, rdx
shl rcx, 0x10
or rdx, rcx
mov r9, rdx
shl r9, 0x20
or r9, rdx
mov rdx, qword [rax]
xor rdx, r9
mov rcx, rdx
add rdx, r11
not rcx
and rdx, rcx
test rdx, r10
jne 0x2101c903a
nop dword [rax]
mov rdx, qword [rax + 8]
add rax, 8
xor rdx, r9
lea rcx, [rdx + r11]
not rdx
and rdx, rcx
test rdx, r10
je 0x2101c9020
cmp bl, byte [rax]
je 0x2101c8fcd
nop
add rax, 1
cmp byte [rax], r8b
je 0x2101c8fcd
add rax, 1
cmp byte [rax], r8b
jne 0x2101c9040
jmp 0x2101c8fcd
Function at 0x2101cecb0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rdx
movzx edx, byte [rdx]
mov r13, rcx
test dl, dl
je 0x2101cedf0
movzx eax, byte [rbx + 1]
test al, al
je 0x2101cee48
movzx r8d, byte [rbx + 2]
test r8b, r8b
je 0x2101cee08
cmp byte [rbx + 3], 0
mov ecx, dword [rbx]
je 0x2101ceea8
cmp byte [rbx + 4], 0
je 0x2101cee60
mov rcx, rbx
call sym.msys_2.0.dll_strlen
mov rcx, r13
mov rdx, rax
mov rsi, rax
or dh, 2
call sym.msys_2.0.dll_strnlen
cmp rsi, rax
ja 0x2101ceddb
cmp rsi, 0xfe
ja 0x2101cef02
sub rax, rsi
mov r8d, 0x40
lea edx, [rsi + 1]
lea rcx, [rsp + 0x20]
lea rdi, [r13 + rax]
call sym.msys_2.0.dll_memset
mov r8d, esi
mov rax, rbx
lea r9, [rsi + rbx]
add r8d, ebx
test rsi, rsi
je 0x2101ced78
nop dword [rax + rax]
movzx edx, byte [rax]
mov ecx, r8d
sub ecx, eax
add rax, 1
and edx, 0x3f
mov byte [rsp + rdx + 0x20], cl
cmp rax, r9
jne 0x2101ced60
mov r12, r13
movzx eax, byte [r12 + rsi - 1]
and eax, 0x3f
movzx eax, byte [rsp + rax + 0x20]
lea r12, [r12 + rax - 1]
cmp rdi, r12
jb 0x2101cedc0
nop dword [rax + rax]
movzx eax, byte [r12 + rsi]
mov r8, rsi
mov rdx, rbx
mov rcx, r12
and eax, 0x3f
movzx r13d, byte [rsp + rax + 0x20]
call sym.msys_2.0.dll_memcmp
test eax, eax
je 0x2101cedf3
add r12, r13
cmp rdi, r12
jae 0x2101ced98
lea rcx, [rdi + rsi]
cmp byte [rcx], 0
je 0x2101ceddb
mov edx, 0x800
call sym.msys_2.0.dll_strnlen
add rdi, rax
cmp rdi, r12
jae 0x2101ced7b
xor r12d, r12d
mov rax, r12
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r12, rcx
mov rax, r12
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
movzx ecx, byte [rcx]
shl edx, 0x10
or edx, eax
xor eax, eax
test ecx, ecx
je 0x2101ceddb
nop word cs:[rax + rax]
shl eax, 0x10
mov r12, r13
add r13, 1
or eax, ecx
movzx ecx, byte [r13]
cmp edx, eax
je 0x2101cee3d
test ecx, ecx
jne 0x2101cee20
cmp edx, eax
jne 0x2101ceddb
sub r12, 1
jmp 0x2101cedf3
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp sym.msys_2.0.dll_strchr
movzx edx, byte [r13]
test edx, edx
je 0x2101ceddb
xor eax, eax
bswap ecx
jmp 0x2101cee7c
cmp eax, ecx
je 0x2101cee99
mov r12, r13
shl eax, 8
add r13, 1
or eax, edx
movzx edx, byte [r13]
test edx, edx
jne 0x2101cee78
cmp eax, ecx
jne 0x2101ceddb
sub r12, 3
jmp 0x2101cedf3
shl edx, 0x18
shl eax, 0x10
movzx ecx, byte [r13]
or edx, eax
shl r8d, 8
or edx, r8d
test ecx, ecx
je 0x2101ceddb
xor eax, eax
jmp 0x2101ceed4
test ecx, ecx
je 0x2101ceef8
or eax, ecx
mov r12, r13
add r13, 1
movzx ecx, byte [r13]
shl eax, 8
cmp edx, eax
jne 0x2101ceed0
sub r12, 2
jmp 0x2101cedf3
cmp edx, eax
jne 0x2101ceddb
jmp 0x2101ceee9
mov r9, rsi
mov r8, rbx
mov rdx, rax
mov rcx, r13
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp sym.two_way_long_needle_2

Function at 0x2101dfd90
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x2101dfdc8
xor r9d, r9d
xor r10d, r10d
nop dword [rax + rax]
movzx eax, byte [rcx + r9]
xor al, byte [rdx + r9]
add r9, 1
movzx eax, al
or r10d, eax
cmp r8, r9
jne 0x2101dfda0
xor eax, eax
test r10d, r10d
setne al
ret
xor eax, eax
ret
Function at 0x21021db60
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
mov eax, 0x1818
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.21021b550
sub rsp, rax
mov ebx, 0x13ba0
xor r12d, r12d
mov qword [rsp + 0x40], r8
mov rdi, rcx
mov esi, edx
mov qword [rcx], 0
nop word [rax + rax]
mov edx, ebx
mov rcx, r12
call sym.realloc_1
mov r8d, ebx
xor r9d, r9d
mov ecx, 5
mov rdx, rax
mov r12, rax
add ebx, ebx
call sym.NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x21021db98
test eax, eax
js 0x21021dd48
mov r15, r12
cmp dword [r12 + 0x50], esi
jne 0x21021dbe1
jmp 0x21021dc08
add r15, rax
cmp dword [r15 + 0x50], esi
je 0x21021dc08
mov eax, dword [r15]
test eax, eax
jne 0x21021dbd8
mov rcx, r12
add rsp, 0x1818
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.free_1
lea rax, [rsp + 0x80]
lea r13, [r15 + 0x100]
xor esi, esi
mov qword [rsp + 0x48], rax
mov eax, dword [r15 + 4]
lea r14, [rsp + 0x50]
test eax, eax
je 0x21021dbe8
nop dword [rax + rax]
mov eax, esi
mov ecx, 0x800
xor edx, edx
lea rbx, [rax + rax*4]
shl rbx, 4
add rbx, r13
mov r8d, dword [rbx + 0x30]
call sym.OpenThread
mov rcx, rax
test rax, rax
je 0x21021dd2f
xor edx, edx
mov r9d, 0x30
mov r8, r14
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0
call sym.NtQueryInformationThread
mov rcx, qword [rsp + 0x38]
mov ebp, eax
call sym.CloseHandle
test ebp, ebp
js 0x21021dd2f
mov ecx, 0x28
call sym.malloc_1
mov rdx, qword [rsp + 0x58]
test rax, rax
je 0x21021dcc6
mov ecx, dword [0x21034b024]
mov r9, qword [rdi]
mov qword [rax + 0x10], rdx
mov r8, qword [rbx + 0x30]
mov byte [rax + 0x20], 1
lea rcx, [rdx + rcx*2]
mov qword [rax], r9
mov dword [rax + 8], r8d
mov qword [rax + 0x18], rcx
mov qword [rdi], rax
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r9d, 0x1788
call sym.ReadProcessMemory
test eax, eax
je 0x21021dd2f
mov ecx, 0x28
call sym.malloc_1
test rax, rax
je 0x21021dd2f
mov rdx, qword [rsp + 0x14f8]
mov r8, qword [rdi]
mov byte [rax + 0x20], 0
mov rcx, qword [rbx + 0x30]
mov qword [rdi], rax
test rdx, rdx
mov qword [rax], r8
cmove rdx, qword [rsp + 0x90]
mov dword [rax + 8], ecx
mov qword [rax + 0x10], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rax + 0x18], rdx
add esi, 1
cmp dword [r15 + 4], esi
ja 0x21021dc30
jmp 0x21021dbe8
test r12, r12
je 0x21021dd5d
mov rcx, r12
mov dword [rsp + 0x38], eax
call sym.free_1
mov eax, dword [rsp + 0x38]
test byte [0x210273880], 1
jne 0x21021dd7a
add rsp, 0x1818
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x20], eax
lea r9, str.NtQuerySystemInformation___y
lea r8, str.thread_info::thread_info_DWORD__HANDLE_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21021dd66
Function at 0x14000b4c0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140019060]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14000b500
mov eax, 0xff
jmp 0x14000b6ab
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x14000b51c
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x14001acc8], r9d
mov dword [0x14001acd0], ecx
mov dword [0x14001acd4], edx
mov dword [0x14001acd8], eax
mov dword [0x14001accc], r8d
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000b593
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000b593
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x14000b593
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x14000b595
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x14000b595
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.14000d244
test eax, eax
jne 0x14000b5cb
cmp dword [0x14001a71c], 2
je 0x14000b5b7
call fcn.14000d028
mov ecx, 0x1c
call fcn.14000d074
mov ecx, 0xff
call fcn.14000cc40
call fcn.14000cb0c
test eax, eax
jne 0x14000b5f7
cmp dword [0x14001a71c], 2
je 0x14000b5e2
call fcn.14000d028
mov ecx, 0x10
call fcn.14000d074
mov ecx, 0xff
call fcn.14000cc40
nop
call fcn.14000d2b8
test eax, eax
jns 0x14000b60a
mov ecx, 0x1b
call fcn.14000cc5c
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x14001c8d0], rax
call fcn.14000da58
mov qword [0x14001a720], rax
call fcn.14000d554
test eax, eax
jns 0x14000b635
mov ecx, 8
call fcn.14000cc5c
call fcn.14000d834
test eax, eax
jns 0x14000b648
mov ecx, 9
call fcn.14000cc5c
mov ecx, edi
call fcn.14000cccc
test eax, eax
je 0x14000b65a
mov ecx, eax
call fcn.14000cc5c
mov r8, qword [0x14001acb8]
mov qword [0x14001ace8], r8
mov rdx, qword [0x14001acb0]
mov ecx, dword [0x14001acac]
call fcn.1400070f4
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x14000b68b
mov ecx, eax
call fcn.14000d018
call fcn.14000ccb8
jmp 0x14000b6a9
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000b710
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.14015b000
add rsp, 0x28
jmp 0x14000b4c0

Function at 0x14000c1ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140004a80
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x1403f0688]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.140122c40
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1403f0688]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140004c10
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140004c2c
cmp rcx, r8
jl 0x140004c1f
mov qword [rdx + 0x80], rcx
test dword [0x1403e9840], 1
je 0x140004c5b
cmp byte [rsp + 0xd0], 0
je 0x140004c5b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140004780
mov rsp, r8
jmp rax
Function at 0x140004c60
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1403f0688]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140005e00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov esi, ecx
movsxd rbx, edx
lea rcx, [rsp + 0x50]
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov rdi, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.DLL_QueryPerformanceFrequency
mov r14d, 0x1e
mov rdx, rbx
imul rdx, qword [rsp + 0x50]
movabs rax, 0x431bde82d7b634db
imul rdx
mov rbp, rdx
sar rbp, 0x12
mov rax, rbp
shr rax, 0x3f
add rbp, rax
add rbp, rdi
cmp esi, r14d
cmovb r14d, esi
xor edi, edi
test r14d, r14d
jle 0x140005ea2
mov ebx, 1
test ebx, ebx
jle 0x140005e88
mov eax, ebx
nop dword [rax]
pause
sub rax, 1
jne 0x140005e80
lea rcx, [rsp + 0x50]
call sub.KERNEL32.DLL_QueryPerformanceCounter
cmp qword [rsp + 0x50], rbp
jg 0x140005ea2
inc edi
rol ebx, 1
cmp edi, r14d
jl 0x140005e73
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret