joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rdx, qword [0x00648328]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x40], rsi
mov rsi, qword [0x00648320]
mov qword [rsp + 0x30], r12
xor r12d, r12d
cmp rsi, rdx
mov rbp, rcx
mov ebx, 1
jae 0x43cd5f
mov qword [rsp + 0x38], rdi
nop
test ebx, ebx
js 0x43cd5a
mov rdi, qword [rsi]
test rdi, rdi
je 0x43cd51
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x50], r12
test rax, rax
jne 0x43ccff
mov ebx, r12d
jmp 0x43cd51
mov rcx, qword [rdi + 0x18]
lea r8, [rsp + 0x50]
lea rdx, [0x005acc50]
call rax
test eax, eax
mov ebx, eax
js 0x43cd3a
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi]
mov r9d, 1
lea rax, [rdi + 0x28]
lea r8d, [r9 + 3]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x43cd4a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rdx, qword [0x00648328]
add rsi, 8
cmp rsi, rdx
jb 0x43cce0
mov rdi, qword [rsp + 0x38]
test ebx, ebx
mov rsi, qword [rsp + 0x40]
jne 0x43cdd2
cmp byte [rbp + 0x60], r12b
je 0x43cdd6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbp + 0x50], rax
je 0x43cdb9
lea rax, [rsp + 0x50]
lea r8, [0x0043bdd0]
mov r9, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x43cdd6
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
mov byte [rbp + 0x60], r12b
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x43d0e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
sub rsp, 0x98
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, rcx
movzx ebp, dl
call fcn.0043b990
test eax, eax
jne 0x43d10b
mov eax, 0x80004005
jmp 0x43d297
mov rcx, qword [0x00645f58]
mov qword [rsp + 0xb8], rdi
xor edi, edi
lea rax, str.APPID
mov qword [rsp + 0x90], r12
lea r12, str.0D9FFFC1_608C_4850_9240_429D6A49F1E8
lea edx, [rdi + 0x65]
lea r8d, [rdi + 1]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
call fcn.00404fd0
test eax, eax
js 0x43d287
lea rax, [rsp + 0x58]
lea rdx, str.AppID
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43d2ea
lea rax, [rsp + 0x50]
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43d2cf
mov rdi, qword [rsp + 0x60]
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test bpl, bpl
jne 0x43d20f
test rdi, rdi
je 0x43d2bd
jmp 0x43d2b4
lea rbp, [rsi + 0x68]
test rbp, rbp
jne 0x43d223
mov ecx, 0x80004005
call fcn.00401020
int3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.LocalService
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call fcn.0043b6a0
test eax, eax
jne 0x43d2af
test rdi, rdi
je 0x43d26c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x43d27a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
mov rbx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb8]
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
add rsp, 0x98
ret
test rdi, rdi
je 0x43d2bd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x43d2cb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x43d27f
mov ecx, eax
call fcn.00401110
test rbx, rbx
mov edi, eax
je 0x43d2e6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x43d27f
mov ecx, eax
call fcn.00401110
jmp 0x43d287
Function at 0x43d300
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x68
call fcn.0043b990
test eax, eax
jne 0x43d317
mov eax, 0x80004005
add rsp, 0x68
ret
lea rax, [rsp + 0x30]
mov qword [rsp + 0x80], rsi
lea rdx, str.AppID
xor esi, esi
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43d440
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x78], rbp
lea rax, [rsp + 0x38]
lea rbp, str.0D9FFFC1_608C_4850_9240_429D6A49F1E8
mov r9d, 0x20006
mov rcx, rbx
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43d425
mov rdi, qword [rsp + 0x38]
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [0x00645f58]
lea r11, str.APPID
lea r9, [rsp + 0x40]
lea edx, [rsi + 0x65]
xor r8d, r8d
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
call fcn.00404fd0
test rdi, rdi
mov esi, eax
je 0x43d3f6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x43d404
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
add rsp, 0x68
ret
mov ecx, eax
call fcn.00401110
test rbx, rbx
mov edi, eax
je 0x43d43c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x43d406
mov ecx, eax
call fcn.00401110
mov rsi, qword [rsp + 0x80]
add rsp, 0x68
ret
Function at 0x43de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x2a8
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
lea rax, [rsp + 0x38]
mov ebp, edx
mov qword [r11 - 0x18], r12
mov rsi, rcx
lea rdx, str.AppID
xor r12d, r12d
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e061
mov qword [rsp + 0x2c0], rbx
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.0D9FFFC1_608C_4850_9240_429D6A49F1E8
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov edi, eax
jne 0x43e046
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, str.LocalService
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43df54
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x43df2d
cmp eax, 2
je 0x43df2d
lea eax, [r12 + 0xd]
jmp 0x43df54
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x43df4b
test al, 1
jne 0x43df44
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], r12w
je 0x43df51
mov eax, SafeArrayGetDim
jmp 0x43df54
mov word [rsp + 0x70], r12w
mov eax, r12d
test eax, eax
mov dword [rsi + 0x28c], r12d
jne 0x43df69
mov dword [rsi + 0x28c], 1
cmp dword [rsi + 0x28c], r12d
je 0x43e014
lea rax, [rsi + 0x68]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], rax
lea rax, [0x0043de10]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x43dfb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x27c], eax
test rdi, rdi
mov esi, dword [rsi + 0x27c]
je 0x43dfc4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x43dfd2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rbx, qword [rsp + 0x2c0]
mov rdi, qword [rsp + 0x298]
mov r12, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.00568fb0
add rsp, 0x2a8
ret
mov edx, ebp
mov rcx, rsi
call fcn.0043dc20
test rdi, rdi
mov ebp, eax
mov dword [rsi + 0x27c], eax
je 0x43e034
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x43e042
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x43dfd4
test rbx, rbx
mov dword [rsi + 0x27c], eax
je 0x43e05a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x43dfd4
mov dword [rsi + 0x27c], eax
jmp 0x43dfe4
Function at 0x446be0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x340
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rbx, rcx
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareSymantecSymSnapLogging
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x446c45
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareWow6432NodeSymantecSymSnapLogging
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x446ce8
mov dword [rsp + 0x30], 0xe6
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LogLocation
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x446cdd
lea r9, [rsp + 0x70]
lea r8, [0x005b4e38]
mov edx, 0x1cc
lea rcx, [rsp + 0x160]
call fcn.00445a70
mov r8, rbx
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x48]
call fcn.0040ccb0
nop
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [0x006408a0]
call fcn.00546900
nop
cmp qword [rsp + 0x68], 8
jb 0x446cdd
mov rcx, qword [rsp + 0x50]
call fcn.00568830
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp qword [0x006408b8], rax
setne al
test eax, eax
jne 0x446d11
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x006408a0]
call fcn.00546900
call fcn.0047dfbc
mov byte [0x00646468], 1
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.00568fb0
add rsp, 0x340
pop rbx
ret
Function at 0x4757a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, rcx
call fcn.0047574c
cmp byte [rax + 1], 0
mov rdi, rax
je 0x47581d
rdtsc
movsd xmm1, qword [0x005c0570]
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
sub rax, qword [rdi + 0x10]
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rdi + 0x18]
comisd xmm0, xmm1
jbe 0x475809
subsd xmm0, xmm1
movabs rax, 0x7fffffffffffffff
mov rcx, rax
comisd xmm0, xmm1
jbe 0x475809
subsd xmm0, xmm1
add rcx, rax
cvttsd2si rax, xmm0
add rax, rcx
add rax, qword [rdi + 8]
mov qword [rsi], rax
jmp 0x475908
lea rcx, [rsp + 0x68]
call fcn.004a0380
cmp byte [rdi], 0
je 0x47583f
mov rax, qword [rsp + 0x68]
mov byte [rdi], 0
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x68]
jmp 0x475815
mov rcx, qword [rsp + 0x68]
movabs rax, 0xd6bf94d5e57a42bd
mov ebp, 5
mov rdx, rcx
sub rdx, qword [rdi + 8]
mul rdx
shr rdx, 0x17
cmp rdx, rbp
jb 0x475905
cmp qword [0x00646cf8], 0
je 0x475905
xor r13d, r13d
xor r14d, r14d
xor r12d, r12d
rdtsc
shl rdx, 0x20
lea rcx, [rsp + 0x70]
or rax, rdx
mov rbx, rax
call fcn.004a0380
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rbx
test r12, r12
je 0x4758b9
cmp rax, r12
jge 0x4758c4
mov r13, qword [rsp + 0x70]
mov r12, rax
mov r14, rcx
sub rbp, 1
jne 0x475881
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r14
mov rcx, qword [0x00646cf8]
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [0x00646cf8]
mov rax, qword [rcx]
call qword [rax + RegisterTypeLib]
mov byte [rdi + 1], 1
mulsd xmm0, qword [0x005c0568]
movsd qword [rdi + 0x18], xmm0
jmp 0x475838
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x492bd0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov eax, dword [0x00646a70]
test al, 1
jne 0x492c0d
or eax, 1
mov dword [0x00646a70], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00646a6c], eax
lea rcx, [0x005a8d80]
call fcn.0056a510
mov ecx, dword [0x00646a6c]
cmp ecx, 0xffffffff
je 0x492c94
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x492c82
lea ecx, [rax + 0x18]
call fcn.00569590
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x492c6c
mov rcx, rax
call fcn.00502e20
mov qword [rbx + 8], rax
mov byte [rax + 0x1d], 1
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov rax, qword [rbx + 8]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 0x10], rax
mov qword [rbx + 0x10], 0
jmp 0x492c6e
xor ebx, ebx
mov rdx, rbx
mov ecx, dword [0x00646a6c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rbx, rbx
je 0x492c94
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.004926e0
add rsp, 0x40
pop rbx
ret

Function at 0x492cc0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x50
mov eax, dword [0x00646a70]
test al, 1
jne 0x492cf4
or eax, 1
mov dword [0x00646a70], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea rcx, [0x005a8d80]
mov dword [0x00646a6c], eax
call fcn.0056a510
mov ecx, dword [0x00646a6c]
cmp ecx, 0xffffffff
je 0x492de7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x492de7
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.00492a50
cmp qword [rbx + 0x10], 0
jne 0x492de7
mov eax, dword [0x00646a70]
test al, 1
jne 0x492d58
or eax, 1
mov dword [0x00646a70], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea rcx, [0x005a8d80]
mov dword [0x00646a6c], eax
call fcn.0056a510
mov ecx, dword [0x00646a6c]
cmp ecx, 0xffffffff
je 0x492de7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x492de7
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rcx]
lea r8, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rcx, rax
call fcn.00492880
mov rcx, qword [rbx + 8]
call fcn.00568830
xor r11d, r11d
mov rcx, rbx
mov qword [rbx + 8], r11
mov qword [rbx + 0x10], r11
call fcn.00568830
mov ecx, dword [0x00646a6c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x50
pop rbx
ret
Function at 0x492df0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov ebx, ecx
mov eax, dword [0x00646a90]
lea rsi, [0x00646a78]
test al, 1
jne 0x492e73
or eax, 1
mov dword [0x00646a90], eax
mov rcx, rsi
call fcn.00502e20
mov qword [0x00646a80], rax
mov byte [rax + 0x1d], 1
mov rax, qword [0x00646a80]
mov qword [rax + 8], rax
mov rax, qword [0x00646a80]
mov qword [rax], rax
mov rax, qword [0x00646a80]
mov qword [rax + 0x10], rax
mov qword [0x00646a88], 0
lea rcx, [0x005a8dd0]
call fcn.0056a510
nop
mov rdi, qword [0x00646a80]
mov rax, qword [rdi + 8]
mov rcx, rdi
cmp byte [rax + 0x1d], 0
jne 0x492e9e
cmp dword [rax + 0x18], ebx
jge 0x492e92
mov rax, qword [rax + 0x10]
jmp 0x492e98
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x1d], 0
je 0x492e87
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rsi
cmp rcx, rdi
je 0x492eb9
cmp ebx, dword [rcx + 0x18]
jl 0x492eb9
lea rcx, [rsp + 0x28]
jmp 0x492ec8
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x492eea
cmp rax, rsi
je 0x492eef
call fcn.0056a700
cmp qword [rsp + 0x50], rdi
je 0x492efd
xor al, al
jmp 0x492fd5
mov eax, dword [0x00646a70]
test al, 1
jne 0x492f28
or eax, 1
mov dword [0x00646a70], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00646a6c], eax
lea rcx, [0x005a8d80]
call fcn.0056a510
mov ecx, dword [0x00646a6c]
cmp ecx, 0xffffffff
je 0x492fd3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r11, rax
test rax, rax
je 0x492fd3
mov rdi, qword [rax + 8]
mov rdx, rdi
mov rcx, qword [rdi + 8]
cmp byte [rcx + 0x1d], 0
jne 0x492f77
nop
nop
cmp dword [rcx + 0x18], ebx
jge 0x492f6b
mov rcx, qword [rcx + 0x10]
jmp 0x492f71
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x1d], 0
je 0x492f60
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rax
cmp rdx, rdi
je 0x492f92
cmp ebx, dword [rdx + 0x18]
jl 0x492f92
lea rcx, [rsp + 0x48]
jmp 0x492fa1
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x492fc3
cmp rax, r11
je 0x492fc8
call fcn.0056a700
cmp qword [rsp + 0x30], rdi
je 0x492fd3
xor al, al
jmp 0x492fd5
mov al, 1
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret
Function at 0x4a03e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x78
cmp qword [0x00646c48], 0
mov qword [rsp + 0x70], r12
mov r12, rcx
jne 0x4a04ff
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4a0581
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
xor esi, esi
xor ebp, ebp
xor edi, edi
xor ebx, ebx
mov qword [rsp + 0x68], r13
nop
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.004a0020
mov r13, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x38]
sub r11, qword [rsp + 0x40]
test ebx, ebx
je 0x4a0493
cmp r11, rdi
jge 0x4a049e
mov rsi, qword [rsp + 0x28]
mov rdi, r11
mov rbp, r13
add ebx, 1
cmp ebx, 5
jb 0x4a0440
lea rcx, [rsp + 0x48]
mov qword [0x00646c40], rsi
mov qword [0x00646c48], rbp
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x98]
cvtsi2sd xmm5, qword [rsp + 0x48]
movsd xmm0, qword [0x005c0568]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
divsd xmm0, xmm5
movsd qword [0x00641810], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x20]
xor ecx, ecx
movsd xmm1, qword [0x005c0570]
sub r11, qword [0x00646c40]
cvtsi2sd xmm0, r11
mulsd xmm0, qword [0x00641810]
comisd xmm0, xmm1
jbe 0x4a0561
subsd xmm0, xmm1
movabs rax, 0x7fffffffffffffff
mov rcx, rax
comisd xmm0, xmm1
jbe 0x4a0561
subsd xmm0, xmm1
add rcx, rax
cvttsd2si rax, xmm0
add rax, rcx
add rax, qword [0x00646c48]
mov qword [r12], rax
mov rax, r12
mov r12, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.004a0020
mov rax, r12
mov r12, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x4a12e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x50
test edx, edx
mov eax, edx
mov rbx, rcx
jne 0x4a136e
cmp dword [0x00646c8c], edx
jne 0x4a1305
call fcn.0056fe40
or eax, 1
mov dword [0x00646c8c], eax
lea rcx, [rsp + 0x60]
call fcn.0056fdf0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.0056fa70
mov r11d, dword [0x00646c8c]
mov ecx, dword [rsp + 0x24]
mov edx, r11d
mov eax, ecx
add r11d, 2
add edx, dword [rsp + 0x20]
mov dword [0x00646c8c], r11d
imul ecx, ecx, 0xe10
imul eax, eax, 0x3c
add edx, eax
mov eax, dword [rsp + 0x2c]
add edx, ecx
imul eax, eax, 0x15180
add edx, eax
mov eax, dword [rsp + 0x30]
imul eax, eax, 0x278d00
add edx, eax
mov eax, dword [rsp + 0x34]
imul eax, eax, 0x1e13380
add eax, edx
mov rcx, qword [rbx + 8]
mov edx, eax
add rcx, 8
add rsp, 0x50
pop rbx
jmp fcn.004fa240
Function at 0x4a42a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov rsi, rcx
lea rax, [0x005c8bf8]
mov qword [rcx], rax
xor edi, edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov dword [rcx + 0x30], edi
mov dword [rcx + 0x34], edi
mov dword [rcx + 0x38], edi
mov byte [rcx + 0x3c], dil
cmp byte [0x00646ce0], dil
jne 0x4a437e
mov byte [0x00646ce0], 1
mov r13, rdi
mov r12, rdi
mov ebp, edi
nop
nop
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov r14, rax
lea rcx, [rsp + 0x28]
call fcn.004a03e0
mov rcx, qword [rax]
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rbx
test ebp, ebp
je 0x4a435a
cmp rax, r12
jge 0x4a4363
mov r12, rax
mov rdi, r14
mov r13, rcx
add ebp, 1
cmp ebp, 5
jb 0x4a4320
mov qword [0x00646cf0], rdi
mov qword [0x00646ce8], r13
mov rax, rsi
jmp 0x4a4381
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
add rsp, 0x58
ret