joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800abb20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push r14
sub rsp, 0x28
mov r14d, ecx
mov rbp, rdx
cmp ecx, 0x3e8
jbe 0x1800abb53
mov eax, 0x10624dd3
mul r14d
mov ecx, edx
xor edx, edx
shr ecx, 6
add rsp, 0x28
pop r14
pop rbp
jmp qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, r14
movabs rax, 0x431bde82d7b634db
imul rcx, qword [rsp + 0x50]
mov ebx, 1
imul rcx
mov rsi, rdx
sar rsi, 0x12
mov rax, rsi
shr rax, 0x3f
add rsi, rax
add rsi, qword [rsp + 0x58]
xor edi, edi
nop dword [rax + rax]
test ebx, ebx
jle 0x1800abbbe
mov eax, ebx
pause
sub rax, 1
jne 0x1800abbb6
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [rsp + 0x50], rsi
jg 0x1800abbd9
inc edi
rol ebx, 1
cmp edi, 0x1e
jl 0x1800abbb0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
test rbp, rbp
je 0x1800abbf1
add dword [rbp], r14d
add rsp, 0x28
pop r14
pop rbp
ret
Function at 0x1800accc0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x18018c480]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800acdaf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x1800acdaf
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x1800acd8a
xorps xmm0, xmm0
test rdx, rdx
js 0x1800acd31
cvtsi2ss xmm0, rdx
jmp 0x1800acd49
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x180165b40]
test rdi, rdi
js 0x1800acd63
cvtsi2ss xmm0, rdi
jmp 0x1800acd7b
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x1800acda1
cmp rdx, rdi
jbe 0x1800acd9b
mov qword [rbx], rax
jmp 0x1800acda1
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x1800ace78
jmp 0x1800ace75
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x1800ace52
test r14, r14
je 0x1800ace41
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x1800acdeb
cvtsi2ss xmm0, rcx
jmp 0x1800ace00
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x180165b40]
test rdx, rdx
js 0x1800ace1a
cvtsi2ss xmm0, rdx
jmp 0x1800ace32
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x1800ace49
mov qword [rbx], rdx
test rsi, rsi
je 0x1800ace78
xor eax, eax
jmp 0x1800ace75
test r14, r14
je 0x1800ace5e
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x1800ace6b
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x1800ace78
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180105570
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret
Function at 0x1800acea0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x18018c480]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
test rcx, rcx
je 0x1800aced4
mov byte [rcx], 0
xor esi, esi
xor ebp, ebp
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x1800acfb1
cmp dword [rsp + 0x30], esi
je 0x1800acfb1
mov r9d, 0x90
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0xc0]
mov edx, 9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x1800acfb1
mov eax, dword [rsp + 0xd0]
mov rcx, 0xffffffffffffffff
bt eax, 9
mov rbx, rcx
mov rdx, rcx
cmovb rbx, qword [rsp + 0x138]
bt eax, 8
cmovb rdx, qword [rsp + 0x130]
test al, 1
cmovne rcx, qword [rsp + 0xe0]
cmp rbx, 0xffffffffffffffff
jne 0x1800acf75
cmp rdx, rbx
jne 0x1800acf75
cmp rcx, rbx
je 0x1800acfb1
cmp rdx, rbx
mov dword [rsp + 0x40], 0x40
cmovb rbx, rdx
cmp rcx, rbx
cmovb rbx, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x68]
cmovb rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp rbx, 0xffffffffffffffff
jne 0x1800acfb3
xor ebx, ebx
test rbp, rbp
jne 0x1800acfd5
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x48]
test rbx, rbx
cmovne rsi, rbx
cmp rbp, rsi
jb 0x1800acff3
test rbx, rbx
je 0x1800acff3
test rdi, rdi
je 0x1800acfee
mov byte [rdi], 1
mov rax, rbx
jmp 0x1800ad025
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0xa8], rax
cmovb rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180105570
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800ad070
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18018c480]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180105570
add rsp, 0x78
ret
Function at 0x1800ad2d0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov dword [0x1801920a0], eax
mov eax, dword [rsp + 0x24]
mov dword [0x1801920a4], eax
mov eax, dword [rsp + 0x48]
mov dword [0x1801920a8], eax
mov dword [rsp + 0x60], ebx
mov byte [0x1801920ad], bl
call fcn.1800ae560
test al, al
je 0x1800ad33e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
test eax, eax
je 0x1800ad33e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1800ad33e
inc eax
mov byte [0x1801920ad], 1
mov dword [0x180192130], eax
mov byte [0x1801920ae], bl
mov word [rsp + 0x60], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov edi, 1
test eax, eax
jne 0x1800ad37b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800ad37b
movzx eax, word [rsp + 0x60]
jmp 0x1800ad382
mov eax, edi
mov word [rsp + 0x60], ax
cmp ax, di
seta cl
call fcn.1800ae450
test al, al
je 0x1800ad3ab
call fcn.1800ad0b0
test al, al
je 0x1800ad3ab
cmp dword [0x180192134], edi
seta al
mov byte [0x1801920ae], al
jmp 0x1800ad3b2
movzx eax, byte [0x1801920ae]
test al, al
je 0x1800ad400
mov r9d, dword [0x180192138]
test r9, r9
je 0x1800ad483
lea r8, [0x1801920b0]
nop dword [rax]
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
inc rbx
mov rax, qword [rdx]
bts rax, rcx
mov qword [rdx], rax
cmp rbx, r9
jb 0x1800ad3d0
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x1800ad483
mov r9, qword [rsp + 0x60]
lea r8, [0x1801920b0]
nop dword [rax]
test r9, rdi
je 0x1800ad451
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rcx
mov qword [rdx], rax
rol rdi, 1
test r9, rdi
je 0x1800ad476
lea rdx, [rbx + 1]
mov rax, rdx
and edx, 0x3f
shr rax, 6
lea rcx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rdx
mov qword [rcx], rax
rol rdi, 1
add rbx, 2
cmp rbx, 0x40
jb 0x1800ad430
mov rbx, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x1800f8160
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.1800f5e00
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.1800f6530
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.1800f6c60
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1800f6c60

Function at 0x1800f8280
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.1800f6530
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.1800f5e00
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.1800f6e60
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1800f6e60
Function at 0x1800f9960
Capabilities:
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r14
call fcn.1800f8160
mov r15, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r15
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.1800f6530
vmovdqu32 zmm3, zmmword [rbx]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
vpmaxsd zmm1, zmm3, zmmword [rax]
mov rcx, qword [rsp + 0x80]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [rax]
vmovdqu32 zmmword [rax], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r13]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r13]
vmovdqu32 zmmword [r13], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r12]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r12]
vmovdqu32 zmmword [r12], zmm0
vmovdqu32 zmm4, zmmword [r15]
vpmaxsd zmm0, zmm4, zmmword [r14]
vmovdqu32 zmmword [r15], zmm0
vpminsd zmm1, zmm4, zmmword [r14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
vmovdqu32 zmmword [r14], zmm1
mov qword [rsp + 0x20], r14
vzeroupper
call fcn.1800f83a0
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.1800f6c60
Function at 0x1800fb860
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x50], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x58], rax
call fcn.1800f8160
mov rax, qword [rsp + 0xf8]
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r14
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov r15, qword [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.1800f8280
vmovdqu32 zmm3, zmmword [rbx]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa0]
vpmaxsd zmm1, zmm3, zmmword [r9]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r9]
vmovdqu32 zmmword [r9], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r8]
mov r10, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r11, qword [rsp + 0x90]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r8]
vmovdqu32 zmmword [r8], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rdx], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
vmovdqu32 zmm3, zmmword [r15]
vpmaxsd zmm1, zmm3, zmmword [r10]
vmovdqu32 zmmword [r15], zmm1
vpminsd zmm0, zmm3, zmmword [r10]
vmovdqu32 zmmword [r10], zmm0
vmovdqu32 zmm4, zmmword [r12]
vpmaxsd zmm0, zmm4, zmmword [r11]
vmovdqu32 zmmword [r12], zmm0
vpminsd zmm1, zmm4, zmmword [r11]
vmovdqu32 zmmword [r11], zmm1
vmovdqu32 zmm3, zmmword [r13]
vpmaxsd zmm1, zmm3, zmmword [rcx]
vmovdqu32 zmmword [r13], zmm1
vpminsd zmm0, zmm3, zmmword [rcx]
vmovdqu32 zmmword [rcx], zmm0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x38], r9
mov r9, r10
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
vmovdqu32 zmm4, zmmword [rcx]
vpmaxsd zmm0, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rcx], zmm0
vpminsd zmm1, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rbx], zmm1
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x88]
mov r8, r11
vzeroupper
call fcn.1800f83a0
mov rax, qword [rsp + 0xf8]
mov r9, r14
mov rcx, qword [rsp + 0xc0]
mov r8, rsi
mov qword [rsp + 0xb8], rax
mov rdx, rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.1800f83a0
Function at 0x180109820
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180109848
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180109848
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x407a80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x007900a8], 0
je 0x407b3b
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.0040ef20
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x007470c0]
call fcn.0040ef20
mov rcx, rsi
mov rdx, qword [0x007470c0]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.0040ef20
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x407b50
xor rcx, rcx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x40c2c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.0040c920
mov esi, eax
test sil, sil
jne 0x40c482
test ebx, ebx
je 0x40c482
xor rdi, rdi
test r13d, r13d
jle 0x40c3a7
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x40c386
cmp ebx, 0xffffffff
je 0x40c333
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x40c333
xor rsi, rsi
jmp 0x40c482
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x40c386
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x40c374
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x40c374
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x40c482
lea rcx, [rbp + 0x3c]
call fcn.0040be70
sub r13d, 1
test r13d, r13d
jg 0x40c31a
nop
cmp ebx, 0xffffffff
je 0x40c3a7
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jb 0x40c3a2
xor rsi, rsi
jmp 0x40c482
sub eax, r14d
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x40c2dd
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40c3a7
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.0040c530
xor rcx, rcx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x007909a0]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x40c411
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jae 0x40c40e
sub eax, r14d
sub ebx, eax
jmp 0x40c411
xor rbx, rbx
test sil, sil
je 0x40c443
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x40c440
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40c416
mov dil, 1
nop
jmp 0x40c460
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40c443
mov dil, 1
test dil, dil
je 0x40c3ca
nop
test sil, sil
je 0x40c482
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x40e180
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x007900a8], 0
je 0x40e21e
cmp word [0x007903b8], 0xd7b2
jne 0x40e1b3
cmp dword [0x007903c0], 0
jbe 0x40e1b3
lea rcx, [0x007903b0]
call qword [0x007903d8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00748a1c]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x0040e254]
call fcn.0040f610
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40e240
cmp byte [0x00747052], 0
jne 0x40e240
xor rcx, rcx
lea rdx, [0x00748a1c]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40e520
Capabilities:
Create thread

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov ebx, edx
mov rsi, r8
mov rdi, r9
cmp qword [0x00747058], 0
je 0x40e551
mov rcx, rsi
mov rdx, rdi
call qword [0x00747058]
mov r13, rax
jmp 0x40e567
mov ecx, 0x10
call fcn.00408d10
mov r13, rax
mov qword [r13], rsi
mov qword [r13 + 8], rdi
mov byte [0x007900a9], 1
mov rcx, qword [rsp + 0x38]
mov edx, ebx
lea r8, [0x0040e4b0]
mov r9, r13
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov rbx, rax
test rbx, rbx
jne 0x40e5ac
mov rcx, r13
call fcn.00408d40
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x412530
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x00794e70]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x00794e98], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x00794e68], al
cmp byte [0x00794e68], 0
je 0x4125cf
lea rcx, [0x004125d4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x004125ee]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00794e50], rax
lea rcx, [0x004125d4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0041260c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00794e58], rax
lea rcx, [0x004125d4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0041262a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00794e60], rax
add rsp, 0x28
ret
Function at 0x4128b0
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.0040e730
movzx rax, word [rbp + 0x4e]
cmp word [0x00749160], ax
ja 0x412998
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x00749560]
mov word [rbp + 0x4e], ax
ja 0x412998
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x412997
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x00749160]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x412951
mov ecx, eax
sub ecx, 1
jmp 0x412992
lea rdx, [0x00749160]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x412973
mov r8d, eax
add r8d, 1
jmp 0x412992
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x00749168]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.00412740
jmp 0x412997
cmp ecx, r8d
jae 0x412920
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x412a7a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x412a7a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040fd30
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.0040fd30
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040fd30
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x00412ad4]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x00412ae4]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.004101b0
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.0040e810
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret