joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c72f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.Entered_NaClCalibrateWindowsClockQpc_n
mov ecx, 5
call fcn.1400c46f0
lea rdi, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rdi]
mov esi, dword [rdi + 4]
mov rax, rsi
shl rax, 0x20
or rax, rbx
movabs rcx, 0x346dc5d63886594b
mul rcx
mov r15, rdx
shr r15, 0xb
add r15, 0x3e8
mov r14, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea r12, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call r14
xor ebp, ebp
test eax, eax
je 0x1400c7450
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, r12
call r14
test eax, eax
je 0x1400c7450
mov r8, qword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov rdi, r8
sub rdi, r9
imul rax, rdi, 0x3e8
cqo
idiv qword [r13 + 0x48]
mov r10, rax
mov edx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov ecx, eax
xor ecx, esi
mov ebp, edx
xor ebp, ebx
or ebp, ecx
setne cl
test rdi, rdi
js 0x1400c73d6
cmp r10, 4
jg 0x1400c73d6
test cl, cl
jne 0x1400c7403
test cl, cl
cmovne ebx, edx
cmovne esi, eax
shl rax, 0x20
or rax, rdx
movabs rcx, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
cmp rdx, r15
jb 0x1400c7367
xor ebp, ebp
jmp 0x1400c7420
shl rax, 0x20
or rax, rdx
movabs rcx, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
mov ebp, 1
mov qword [r13 + 0x28], rdx
mov rax, rdi
shr rax, 0x3f
add rax, rdi
sar rax, 1
add rax, r9
mov qword [r13 + 0x50], rax
mov qword [r13 + 0x58], r8
lea rdx, str.Leaving_NaClCalibrateWindowsClockQpc_:__d_n
mov ecx, 5
mov r8d, ebp
call fcn.1400c46f0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cbe90
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, qword [0x14034d5f0]
test rbx, rbx
je 0x1400cbed4
mov r14, rcx
mov rdi, qword [0x14034d5f8]
xor esi, esi
mov rdx, qword [rdi]
mov rcx, r14
call fcn.1401b31d0
test eax, eax
je 0x1400cbedb
inc rsi
add rdi, 0x28
cmp rsi, rbx
jb 0x1400cbeb7
jmp 0x1400cbef6
xor edi, edi
jmp 0x1400cc0d0
lea rdx, str.NaClFaultInject:_found__s_n
mov ecx, 6
mov r8, r14
call fcn.1400c46f0
mov rbx, qword [0x14034d5f0]
xor edi, edi
cmp rsi, rbx
je 0x1400cc0d0
mov r15, qword [0x14034d5f8]
lea r12, [rsi + rsi*4]
cmp dword [r15 + r12*8 + 8], 0
je 0x1400cbff3
lea rdx, str.NaClFaultInject:_thread_specific_counter_n
mov ecx, 6
call fcn.1400c46f0
cmp qword [0x14034d5f0], rsi
ja 0x1400cbf5c
lea rax, str.counter_ix___gNaClNumFaultInjectInfo
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0x168
call fcn.1400c46f0
cmp dword [0x14034d5e8], 0
je 0x1400cc0d0
mov ecx, dword [0x14034d604]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r13, rax
test rax, rax
jne 0x1400cc01e
mov r14, qword [0x14034d5f0]
mov rcx, r14
shl rcx, 4
call fcn.1400a12f0
mov r13, rax
test rax, rax
jne 0x1400cbfcd
lea rax, str.NULL___counters
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0x177
call fcn.1400c46f0
mov r14, qword [0x14034d5f0]
test r14, r14
je 0x1400cbfe3
shl r14, 4
mov rcx, r13
xor edx, edx
mov r8, r14
call fcn.140193a00
mov ecx, dword [0x14034d604]
mov rdx, r13
call fcn.1400cc200
jmp 0x1400cc01e
lea rdx, str.NaClFaultInject:_global_counter_n
mov ecx, 6
call fcn.1400c46f0
mov rcx, rsi
shl rcx, 4
add rcx, qword [0x14034d5e0]
call fcn.1400c47c0
mov r13, qword [0x14034d5d8]
shl rsi, 4
mov rbx, r13
add rbx, rsi
je 0x1400cc0d0
lea r14, [r15 + r12*8]
add r14, 8
mov r9, qword [r13 + rsi + 8]
mov r8, qword [rbx]
lea rdx, str.NaClFaultInject:_counter__I64x__I64x__n
mov ecx, 6
call fcn.1400c46f0
mov rax, qword [rbx]
xor edi, edi
cmp rax, qword [r14 + 0x10]
jae 0x1400cc0bb
add r13, rsi
add r13, 8
mov r15, qword [r15 + r12*8 + 0x10]
lea r12, [rax + rax*2]
xor edi, edi
cmp dword [r15 + r12*8], 0
jne 0x1400cc09e
mov r8, qword [r15 + r12*8 + 8]
lea rdx, str.NaClFaultInject:_should_fail__value__I64x_n
mov ecx, 6
call fcn.1400c46f0
mov rdx, qword [r15 + r12*8 + 8]
mov ecx, dword [0x14034d608]
call fcn.1400cc200
mov edi, 1
mov rax, qword [r13]
inc rax
mov qword [r13], rax
cmp rax, qword [r15 + r12*8 + 0x10]
jb 0x1400cc0bb
mov qword [r13], 0
inc qword [rbx]
cmp dword [r14], 0
jne 0x1400cc0d0
add rsi, qword [0x14034d5e0]
mov rcx, rsi
call fcn.1400c47f0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cc0f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x14034d5e8], 0
je 0x1400cc10b
mov ecx, dword [0x14034d608]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x1400cc10d
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400cc200
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x14034d5e8], 0
je 0x1400cc241
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400cc241
lea rax, str.status
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0xf6
call fcn.1400c46f0
nop
add rsp, 0x28
ret

Function at 0x1400ccea0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rsp + 0x5c]
xor esi, esi
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.140193a00
mov dword [rdi - 4], 0x114
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400ccf19
cmp dword [rsp + 0x5c], 5
jb 0x1400ccf19
jne 0x1400ccef8
cmp dword [rsp + 0x60], 0
je 0x1400ccf19
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rdi]
cmp ax, 9
je 0x1400ccf14
test ax, ax
jne 0x1400ccf19
mov esi, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x1400cd950
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14034d618]
test rcx, rcx
jne 0x1400cd991
lea rax, str.g_socket_binding___NULL
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_debug_stub_nacl_debug.cc
mov ecx, 0xfffffffc
mov r9d, 0x97
call fcn.1400c46f0
mov rcx, qword [0x14034d618]
add rsp, 0x28
jmp fcn.140111810
Function at 0x1400cf7c0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x7fffffff
jbe 0x1400760cc
xor eax, eax
ret
jmp 0x1400cf7c0
push rsi
xor eax, eax
test rcx, rcx
je 0x1400cf8f1
test edx, edx
jle 0x1400cf8f1
mov r8d, edx
and r8d, 3
mov r11d, edx
shr r11d, 2
je 0x1400cf872
lea r10d, [r11 - 1]
test dl, 4
jne 0x1400cf7f9
mov r9d, r11d
mov rsi, rcx
jmp 0x1400cf821
movzx r9d, word [rcx]
add r9d, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, r9d
shl r9d, 0x10
xor r9d, eax
lea rsi, [rcx + 4]
mov edx, r9d
shr edx, 0xb
add edx, r9d
mov r9d, r10d
lea r10, [r10*4 + 4]
cmp r11d, 1
je 0x1400cf86f
nop
movzx eax, word [rsi]
add eax, edx
movzx edx, word [rsi + 2]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
movzx eax, word [rsi + 4]
add eax, edx
movzx edx, word [rsi + 6]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
add rsi, 8
add r9d, 0xfffffffe
jg 0x1400cf830
add rcx, r10
cmp r8d, 1
je 0x1400cf8a0
cmp r8d, 2
je 0x1400cf8b2
cmp r8d, 3
jne 0x1400cf8c5
movzx eax, word [rcx]
add edx, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, edx
mov ecx, edx
shl ecx, 0x10
xor eax, ecx
mov edx, eax
shr edx, 0xb
jmp 0x1400cf8c3
movsx eax, byte [rcx]
add edx, eax
mov eax, edx
shl eax, 0xa
xor eax, edx
mov edx, eax
shr edx, 1
jmp 0x1400cf8c3
movzx eax, word [rcx]
add edx, eax
mov eax, edx
shl eax, 0xb
xor eax, edx
mov edx, eax
shr edx, 0x11
add edx, eax
lea eax, [rdx*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret

Function at 0x1400d0c60
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14034d7e8]
mov ecx, dword [0x14034d688]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1400d0c95
lea rcx, [0x14034d7e0]
add rsp, 0x28
jmp fcn.14008d540
lea rcx, [0x14034d7e8]
call fcn.140190a20
cmp dword [0x14034d7e8], 0xffffffff
jne 0x1400d0c85
mov qword [0x14034d7e0], 0
lea rcx, [0x14034d7e0]
xor edx, edx
call fcn.14008d5d0
lea rcx, [0x14034d7e8]
call fcn.140190ac0
jmp 0x1400d0c85
Function at 0x1400d37e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rdi, rcx
mov rcx, r8
call fcn.14011ad40
test al, al
je 0x1400d3965
movsd xmm0, qword [rdi + 0x48]
mov r9b, 1
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x1400d3982
movsd xmm0, qword [rdi + 0xac8]
subsd xmm0, qword [rdi + 0xac0]
mov rcx, qword [rdi + 0xab8]
lea rax, [rcx + 1]
shr rax, 3
movabs r10, 0xd20d20d20d20d21
mul r10
shr rdx, 1
imul rax, rdx, 0x138
neg rax
lea r8, [rcx + rax]
add r8, 1
mov rax, 0xffffffff80000000
and rax, qword [rdi + rcx*8 + 0xf8]
mov rbx, qword [rdi + r8*8 + 0xf8]
mov esi, ebx
and esi, 0x7ffffffe
or rsi, rax
lea rax, [rcx + 0x9c]
shr rax, 3
mul r10
shr rdx, 1
imul rax, rdx, 0x138
neg rax
add rax, rcx
add rax, 0x9c
and ebx, 1
movabs rdx, 0xb5026f5aa96619e9
imul rdx, rbx
xor rdx, qword [rdi + rax*8 + 0xf8]
shr rsi, 1
xor rdx, rsi
mov qword [rdi + rcx*8 + 0xf8], rdx
mov rax, qword [rdi + 0xab8]
mov rax, qword [rdi + rax*8 + 0xf8]
mov rcx, rax
shr rcx, 0x1d
movabs rdx, 0x555555555
and rdx, rcx
xor rdx, rax
mov qword [rdi + 0xab8], r8
mov rax, rdx
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rcx, rax
xor rcx, rdx
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rax, rcx
mov rcx, rax
shr rcx, 0x2b
xor rcx, rax
movq xmm1, rcx
punpckldq xmm1, xmmword [0x1401ca780]
subpd xmm1, xmmword [0x1401ca790]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
mulsd xmm2, qword [0x1401e2e40]
mulsd xmm2, xmm0
addsd xmm2, qword [rdi + 0xac0]
movsd xmm0, qword [rdi + 0x48]
ucomisd xmm0, xmm2
seta r8b
jmp 0x1400d3985
cmp dword [rdi + 0x78], 0
jne 0x1400d397f
mov rax, qword [rdi + 0xd28]
cmp rax, qword [rdi + 0xd30]
jne 0x1400d37ff
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov edx, r9d
call fcn.1400d88e0
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400e9420
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400e9439
mov dword [rsi], eax
mov al, 1
jmp 0x1400e943b
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1400ed2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r9, rdx
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov rax, qword [rcx + 0x18]
add rax, 1
js 0x1400ed2cb
cvtsi2ss xmm0, rax
jmp 0x1400ed2e0
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, rsi
shr rcx, 1
mov eax, esi
and eax, 1
or rax, rcx
test rsi, rsi
js 0x1400ed301
cvtsi2ss xmm1, rsi
movss xmm2, dword [rdi + 0x20]
jne 0x1400ed311
jmp 0x1400ed31a
cvtsi2ss xmm1, rax
addss xmm1, xmm1
movss xmm2, dword [rdi + 0x20]
je 0x1400ed31a
mulss xmm1, xmm2
ucomiss xmm0, xmm1
jbe 0x1400ed38d
mov r14, r9
mov rbx, r8
divss xmm0, xmm2
call fcn.1401ab560
movss xmm1, dword [0x1401c8a60]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
movabs rcx, 0x8000000000000000
xor rcx, rax
cvttss2si rax, xmm0
ucomiss xmm0, xmm1
cmovae rax, rcx
lea rcx, [rsi + rsi]
mov edx, 1
cmp rsi, 3
jb 0x1400ed371
lea rbp, [rsi - 1]
xor edx, edx
test rbp, rsi
setne dl
or rdx, rcx
cmp rdx, rax
cmovb rdx, rax
mov rcx, rdi
call fcn.14002e160
mov rsi, qword [rdi + 8]
mov r8, rbx
mov r9, r14
lea r13, [rsi - 1]
test r13, rsi
je 0x1400ed3ab
mov r12, r9
cmp rsi, r9
ja 0x1400ed3b1
mov rax, r9
xor edx, edx
div rsi
mov r12, rdx
jmp 0x1400ed3b1
mov r12, r13
and r12, r9
mov rax, qword [rdi]
mov rbp, qword [rax + r12*8]
test rbp, rbp
je 0x1400ed4ff
movzx r10d, byte [r8 + 0x17]
test r10b, r10b
jns 0x1400ed3d2
mov r10, qword [r8 + 8]
mov r8, qword [r8]
xor r14d, r14d
mov r11d, 1
nop dword [rax + rax]
mov rdi, rbp
mov rbp, qword [rbp]
test rbp, rbp
je 0x1400ed501
mov rcx, qword [rbp + 8]
mov rdx, rcx
test r13, rsi
je 0x1400ed420
cmp rcx, rsi
jb 0x1400ed423
mov rax, rcx
xor edx, edx
div rsi
cmp rdx, r12
je 0x1400ed42c
jmp 0x1400ed501
and rdx, r13
cmp rdx, r12
jne 0x1400ed501
mov eax, r14d
and al, 1
movzx r15d, al
cmp rcx, r9
jne 0x1400ed4a0
movzx eax, byte [rbp + 0x27]
mov rcx, rax
test al, al
jns 0x1400ed449
mov rcx, qword [rbp + 0x18]
cmp rcx, r10
jne 0x1400ed4a0
lea rcx, [rbp + 0x10]
mov rdx, qword [rcx]
test al, al
cmovs rcx, rdx
js 0x1400ed4c4
test r10, r10
je 0x1400ed4fb
cmp byte [r8], dl
jne 0x1400ed4a0
add rax, 0xffffffffffffffff
xor edx, edx
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp rax, rdx
je 0x1400ed4fb
movzx ebx, byte [rbp + rdx + 0x11]
xor ecx, ecx
cmp bl, byte [r8 + rdx + 1]
lea rdx, [rdx + 1]
je 0x1400ed480
jmp 0x1400ed4a2
xor ecx, ecx
movzx eax, cl
cmp r15d, eax
movzx r14d, r14b
cmovne r14d, r11d
test r15b, r15b
je 0x1400ed3e0
cmp r15d, eax
je 0x1400ed3e0
jmp 0x1400ed501
test r10, r10
je 0x1400ed4fb
mov rdx, r8
mov qword [rsp + 0x30], r8
mov r8, r10
mov rbx, r9
mov qword [rsp + 0x28], r10
call fcn.140193490
mov r11d, 1
mov r10, qword [rsp + 0x28]
mov r9, rbx
mov r8, qword [rsp + 0x30]
test eax, eax
sete cl
jmp 0x1400ed4a2
mov cl, 1
jmp 0x1400ed4a2
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400f1640
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebp, 0x57
test rcx, rcx
je 0x1400f16f6
mov rdi, rdx
test rdx, rdx
je 0x1400f16f6
mov ebx, r8d
test r8d, r8d
je 0x1400f16f6
mov rsi, rcx
mov dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x30]
mov r8d, gethostbyname
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400f16ee
test byte [rsp + 0x54], 0xf0
mov eax, 4
mov r8d, 0x40
cmove r8d, eax
movsxd rbx, ebx
lea r9, [rsp + 0x2c]
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400f16ee
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.140193590
mov r8d, dword [rsp + 0x2c]
lea r9, [rsp + 0x2c]
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebp, ebp
jmp 0x1400f16f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400f1a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400f1b24
mov rdi, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x1400f1b24
cmp word [rax + rcx + 0x14], 0x78
jb 0x1400f1b24
mov rsi, r8
mov r12, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
test rax, rax
je 0x1400f1b24
cmp r12, 0xffff
ja 0x1400f1a7f
mov word [rsi], r12w
jmp 0x1400f1b58
mov r14, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov edx, dword [r14 + 0x18]
lea rcx, [rdx*4]
test rcx, rcx
je 0x1400f1b24
lea rbp, [rax + rdx*4]
lea r13, [r12 + 1]
mov qword [rsp + 0x20], rax
mov r15, rax
mov rbx, rbp
sub rbx, r15
mov rax, rbx
sar rax, 2
shr rbx, 0x3f
add rbx, rax
movabs rax, 0x7ffffffffffffffe
and rbx, rax
mov edx, dword [r15 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov cl, byte [r12]
test cl, cl
je 0x1400f1afd
mov rdx, r13
cmp cl, byte [rax]
jne 0x1400f1aff
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400f1aed
xor ecx, ecx
lea rbx, [r15 + rbx*2]
movzx ecx, cl
movzx eax, byte [rax]
sub ecx, eax
je 0x1400f1b37
lea rax, [rbx + 4]
test ecx, ecx
cmovle rbp, rbx
cmovg r15, rax
xor eax, eax
cmp r15, rbp
jne 0x1400f1ab4
jmp 0x1400f1b26
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [r14 + 0x24]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
sub rbx, qword [rsp + 0x20]
sar rbx, 1
movzx eax, word [rax + rbx]
add ax, word [r14 + 0x10]
mov word [rsi], ax
mov al, 1
jmp 0x1400f1b26
Function at 0x1400f1ea0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400f1ed7
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400f1ed7
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x1400f1ed7
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x1400f3240
Capabilities:
Reference processor manufacturer constants

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r14, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
xor ecx, ecx
cpuid
mov ebp, eax
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], edx
mov dword [rsp + 0x28], ecx
mov byte [rsp + 0x2c], 0
lea rcx, [r14 + 0x28]
lea rdx, [rsp + 0x20]
call fcn.14006b120
test ebp, ebp
jle 0x1400f33aa
xor r8d, r8d
mov eax, 1
xor ecx, ecx
cpuid
mov esi, ecx
mov r9d, edx
mov edi, eax
cmp ebp, 7
jl 0x1400f32b7
mov eax, 7
xor ecx, ecx
cpuid
mov r8d, ebx
shr r8b, 5
and r8b, 1
mov dword [r14], edi
mov eax, edi
and eax, 0xf
mov dword [r14 + 0x10], eax
mov eax, edi
shr eax, 4
and eax, 0xf
mov ecx, edi
shr ecx, 0xc
mov edx, ecx
and edx, 0xf0
or edx, eax
mov dword [r14 + 0xc], edx
mov eax, edi
shr eax, 8
and eax, 0xf
mov dword [r14 + 8], eax
and ecx, 3
mov dword [r14 + 4], ecx
mov eax, edi
shr eax, 0x10
and eax, 0xf
mov dword [r14 + 0x14], eax
shr edi, 0x14
movzx eax, dil
mov dword [r14 + 0x18], eax
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r14 + 0x1c], al
mov eax, r9d
shr eax, 0x19
and al, 1
mov byte [r14 + 0x1d], al
shr r9d, 0x1a
and r9b, 1
mov byte [r14 + 0x1e], r9b
mov eax, esi
and al, 1
mov byte [r14 + 0x1f], al
mov eax, esi
shr eax, 9
and al, 1
mov byte [r14 + 0x20], al
mov eax, esi
shr eax, 0x13
and al, 1
mov byte [r14 + 0x21], al
mov eax, esi
shr eax, 0x14
and al, 1
mov byte [r14 + 0x22], al
mov eax, esi
shr eax, 0x17
and al, 1
mov byte [r14 + 0x23], al
test esi, esi
setns dil
mov ecx, esi
and ecx, 0x1c000000
xor ebp, ebp
mov eax, 0
cmp ecx, 0x1c000000
jne 0x1400f338c
xor ecx, ecx
xgetbv
and eax, 6
cmp rax, 6
sete al
mov byte [r14 + 0x24], al
shr esi, 0x19
and sil, 1
mov byte [r14 + 0x26], sil
test al, al
movzx eax, r8b
cmove eax, ebp
mov byte [r14 + 0x25], al
jmp 0x1400f33ad
mov dil, 1
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000004
jl 0x1400f3438
mov esi, eax
mov eax, 0x80000002
xor ecx, ecx
cpuid
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
mov eax, 0x80000003
xor ecx, ecx
cpuid
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], edx
mov eax, 0x80000004
xor ecx, ecx
cpuid
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], edx
mov byte [rsp + 0x50], 0
lea rcx, [r14 + 0x40]
lea rdx, [rsp + 0x20]
call fcn.14006b120
cmp esi, 0x80000007
jl 0x1400f3438
mov eax, 0x80000007
xor ecx, ecx
cpuid
shr edx, 8
and dl, 1
mov byte [r14 + 0x27], dl
cmp byte [r14 + 0x27], 0
setne al
or dil, al
jne 0x1400f346b
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp edx, 0x76482074
jne 0x1400f346b
cmp ebx, 0x7263694d
jne 0x1400f346b
cmp ecx, 0x666f736f
jne 0x1400f346b
mov byte [r14 + 0x27], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140190ca0
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400f3b10
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x1400f3b44
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400f3b73
bt ebx, 8
jae 0x1400f3b58
mov eax, ebx
and eax, 0x200
jne 0x1400f3b73
cmp edi, 2
lea rax, [0x14034e550]
lea rcx, [0x14034e750]
cmove rcx, rax
cmp word [rcx], 0
je 0x1400f3b92
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140190ca0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400f3b73
cmp byte [0x14034e540], 0
setne al
bt ebx, 8
jb 0x1400f3b73
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400f3b73
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
js 0x1400f3bf3
mov rdi, r12
jmp 0x1400f3bfc
mov rdi, qword [r12]
mov rbp, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x1400f3c93
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x1400f3c30
test dx, dx
jne 0x1400f3cb5
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x1400f3c5e
cmp ebp, 2
jne 0x1400f3c54
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x1400f3c5e
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x1400f3c76
dec r13
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x1400f3c68
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x1400f3cbc
mov rbx, qword [rsi + 8]
mov r13, rbp
sub r13, rbx
jb 0x1400f3cb5
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.1401a9e60
test eax, eax
je 0x1400f3c1d
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x1400f3c93
cmp dword [rsp + 0x2c], 0
je 0x1400f3b73
cmp byte [r12 + 0x17], 0
js 0x1400f3cd9
mov rax, r12
jmp 0x1400f3cdd
mov rax, qword [r12]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.14006bed0
jmp 0x1400f3b73