joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e4318
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r10, rdx
mov rbp, rcx
mov r15, qword [rdx + 0x10]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401e4353
mov r9, qword [rdx]
xor esi, esi
movabs r8, 0xcbf29ce484222325
mov ecx, esi
lea rdx, [r15 + r15]
test rdx, rdx
je 0x1401e4388
movzx eax, byte [rcx + r9]
xor r8, rax
movabs r11, 0x100000001b3
imul r8, r11
inc rcx
cmp rcx, rdx
jb 0x1401e436a
mov rax, qword [rbp + 0x30]
and rax, r8
mov r12, qword [rbp + 0x18]
mov rbx, rax
add rbx, rbx
mov rbx, qword [r12 + rbx*8]
lea r13, [rax + rax]
lea r14, [rbp + 8]
mov r11, qword [r12 + r13*8]
cmp r11, qword [r14]
jne 0x1401e43b3
mov rax, qword [r14]
jmp 0x1401e43bb
mov rax, qword [r12 + r13*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1401e44a2
lea rcx, [rbx + 0x10]
mov rax, r10
cmp qword [r10 + 0x18], 8
jb 0x1401e43d5
mov rax, qword [r10]
mov r8, rcx
cmp qword [rcx + 0x18], 8
jb 0x1401e43e2
mov r8, qword [rcx]
mov rdx, qword [rcx + 0x10]
cmp rdx, r15
jne 0x1401e4412
test rdx, rdx
je 0x1401e440c
sub r8, rax
movzx ecx, word [r8 + rax]
movzx r9d, word [rax]
cmp cx, r9w
jne 0x1401e4417
add rax, 2
sub rdx, 1
jne 0x1401e43f3
mov eax, esi
test eax, eax
je 0x1401e4420
mov rbx, qword [rbx]
jmp 0x1401e43a9
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x1401e440e
mov rax, rbx
mov rdi, rbx
cmp r11, qword [r14]
jne 0x1401e4430
mov rcx, qword [r14]
jmp 0x1401e4438
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx]
cmp rbx, rcx
je 0x1401e449d
lea rcx, [rbx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x1401e444e
mov rdx, qword [rcx]
mov r8, r10
cmp qword [r10 + 0x18], 8
jb 0x1401e445b
mov r8, qword [r10]
cmp r15, qword [rcx + 0x10]
jne 0x1401e449d
mov r11, r15
test r15, r15
je 0x1401e4485
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r9d, word [rdx]
cmp cx, r9w
jne 0x1401e4494
add rdx, 2
sub r11, 1
jne 0x1401e446c
mov ecx, esi
test ecx, ecx
jne 0x1401e449d
mov rbx, qword [rbx]
mov r11, qword [r12 + r13*8]
jmp 0x1401e4426
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401e4487
cmp rax, rbx
jne 0x1401e44a8
mov rdi, qword [r14]
mov rbx, rdi
mov rax, rdi
cmp rdi, rbx
je 0x1401e44bb
inc rsi
mov rax, qword [rax]
cmp rax, rbx
jne 0x1401e44b0
mov rax, qword [r14]
cmp rdi, qword [rax]
jne 0x1401e44f3
cmp rbx, rax
jne 0x1401e44f3
mov rcx, r14
call fcn.1401d97a8
mov edx, 8
mov rcx, rbp
call fcn.1400591e0
nop
jmp 0x1401e44f8
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.1401dc714
cmp rdi, rbx
jne 0x1401e44e0
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401e6368
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov r15, rcx
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp - 0x38], xmm0
xor r12d, r12d
mov word [rbp - 0x48], r12w
lea rdx, str.OrgId
lea rcx, [rbp - 0x48]
call fcn.14004d5c4
nop
lea rdi, [r15 + 0x30]
lea rdx, [rbp - 0x48]
mov rcx, rdi
call fcn.1401e77b0
mov rcx, rax
mov rdx, rbx
call fcn.140064f70
nop
lea rcx, [rbp - 0x48]
call fcn.14004e0f0
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
lea rdx, str.CyberEndpoint
lea rcx, [rbp - 0x48]
call fcn.14004d5c4
nop
lea rdx, [rbp - 0x48]
mov rcx, rdi
call fcn.1401e77b0
mov rcx, rax
mov rdx, rsi
call fcn.140064f70
nop
lea rcx, [rbp - 0x48]
call fcn.14004e0f0
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
lea rdx, str.VortexGeoLocation
lea rcx, [rbp - 0x48]
call fcn.14004d5c4
nop
lea rdx, [rbp - 0x48]
mov rcx, rdi
call fcn.1401e77b0
mov rcx, rax
mov rdx, r14
call fcn.140064f70
nop
lea rcx, [rbp - 0x48]
call fcn.14004e0f0
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r12w
lea rdx, str.ReadOnlyCnC
lea rcx, [rbp - 0x28]
call fcn.14004d5c4
nop
lea rcx, [r15 + 0x70]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x48]
call fcn.1401e7868
mov rcx, qword [rbp - 0x48]
mov eax, dword [rbp + 0x60]
mov dword [rcx + 0x30], eax
lea rcx, [rbp - 0x28]
call fcn.14004e0f0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401e6590
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x38], r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdx
mov r10, qword [rdx + 0x10]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401e65df
mov r9, qword [rdx]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r8, [r10 + r10]
test r8, r8
je 0x1401e6612
movzx eax, byte [rcx + r9]
xor rdx, rax
movabs r11, 0x100000001b3
imul rdx, r11
inc rcx
cmp rcx, r8
jb 0x1401e65f4
mov rcx, qword [rsi + 0xa0]
and rcx, rdx
mov r15, qword [rsi + 0x88]
mov rax, rcx
add rax, rax
mov rax, qword [r15 + rax*8]
lea r12, [rcx + rcx]
mov r13, qword [r15 + r12*8]
cmp r13, qword [rsi + 0x78]
jne 0x1401e6641
mov rcx, qword [rsi + 0x78]
jmp 0x1401e6649
mov rcx, qword [r15 + r12*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401e66fa
lea rcx, [rax + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401e6663
mov rdx, qword [rbx]
mov r8, rcx
mov r14, qword [rcx + 0x18]
cmp r14, 8
jb 0x1401e6673
mov r8, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, r10
jne 0x1401e66a6
mov r11, rdi
test rdi, rdi
je 0x1401e66a0
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r9d, word [rdx]
cmp cx, r9w
jne 0x1401e66ab
add rdx, 2
sub r11, 1
jne 0x1401e6687
xor ecx, ecx
test ecx, ecx
je 0x1401e66b4
mov rax, qword [rax]
jmp 0x1401e6635
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401e66a2
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1401e66c1
mov rcx, qword [rcx]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401e66ce
mov rdx, qword [rbx]
cmp r10, rdi
jne 0x1401e66fa
test r10, r10
je 0x1401e66f4
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1401e6715
add rcx, 2
sub r10, 1
jne 0x1401e66db
xor ecx, ecx
test ecx, ecx
je 0x1401e66fe
mov rax, qword [rsi + 0x78]
cmp rax, qword [rsi + 0x78]
je 0x1401e671e
mov ecx, dword [rax + 0x30]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], ecx
mov al, 1
jmp 0x1401e67a7
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401e66f6
lea rcx, [rsp + 0x30]
call fcn.140178f68
nop
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.1401e64e0
test al, al
je 0x1401e6786
lea rcx, [rsp + 0x30]
call fcn.14017937c
test al, al
je 0x1401e6786
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x80]
call qword [case.0x140245398.0]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], eax
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0xc0]
call qword [case.0x140245398.0]
mov al, 1
jmp 0x1401e67a7
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401e67a5
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [case.0x140245398.0]
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401e67d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x38], r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov r10, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401e681f
mov r8, qword [rdx]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r9, [r10 + r10]
test r9, r9
je 0x1401e6852
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r11, 0x100000001b3
imul rdx, r11
inc rcx
cmp rcx, r9
jb 0x1401e6834
mov rax, qword [r14 + 0x60]
and rax, rdx
mov r15, qword [r14 + 0x48]
mov rdx, rax
add rdx, rdx
mov rdx, qword [r15 + rdx*8]
lea r12, [rax + rax]
mov r13, qword [r15 + r12*8]
cmp r13, qword [r14 + 0x38]
jne 0x1401e687b
mov rax, qword [r14 + 0x38]
jmp 0x1401e6883
mov rax, qword [r15 + r12*8 + 8]
mov rax, qword [rax]
cmp rdx, rax
je 0x1401e6934
lea rax, [rdx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401e689d
mov rcx, qword [rbx]
mov r8, rax
mov rsi, qword [rax + 0x18]
cmp rsi, 8
jb 0x1401e68ad
mov r8, qword [rax]
mov rdi, qword [rax + 0x10]
cmp rdi, r10
jne 0x1401e68e0
mov r11, rdi
test rdi, rdi
je 0x1401e68da
sub r8, rcx
movzx eax, word [rcx + r8]
movzx r9d, word [rcx]
cmp ax, r9w
jne 0x1401e68e5
add rcx, 2
sub r11, 1
jne 0x1401e68c1
xor eax, eax
test eax, eax
je 0x1401e68ee
mov rdx, qword [rdx]
jmp 0x1401e686f
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x1401e68dc
lea rax, [rdx + 0x10]
cmp rsi, 8
jb 0x1401e68fb
mov rax, qword [rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401e6908
mov rcx, qword [rbx]
cmp r10, rdi
jne 0x1401e6934
test r10, r10
je 0x1401e692e
sub rcx, rax
movzx r8d, word [rax + rcx]
movzx r9d, word [rax]
cmp r8w, r9w
jne 0x1401e6953
add rax, 2
sub r10, 1
jne 0x1401e6915
xor eax, eax
test eax, eax
je 0x1401e6938
mov rdx, qword [r14 + 0x38]
cmp rdx, qword [r14 + 0x38]
je 0x1401e695c
add rdx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.140064f70
mov al, 1
jmp 0x1401e6a07
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x1401e6930
lea rcx, [rsp + 0x30]
call fcn.140178f68
nop
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, r14
call fcn.1401e64e0
test al, al
je 0x1401e69e3
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x58]
call qword [case.0x140245398.0]
cmp eax, 2
jne 0x1401e69d2
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb0]
call qword [case.0x140245398.0]
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.140064f70
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0xc0]
call qword [case.0x140245398.0]
mov al, 1
jmp 0x1401e6a07
jmp 0x1401e69e8
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1401e6a05
mov rax, qword [rbx]
mov rcx, rbx
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [case.0x140245398.0]
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401e71d0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
movdqa xmm0, xmmword [0x14038ac40]
lea rcx, [rbp - 0x51]
mov rdi, rdx
xor esi, esi
lea rdx, str.SOFTWAREMicrosoftWindows_Advanced_Threat_Protection
mov word [rbp - 0x51], si
movdqu xmmword [rbp - 0x41], xmm0
call fcn.14004d5c4
movdqa xmm0, xmmword [0x14038ac40]
lea rdx, [0x1403406b0]
lea rcx, [rbp - 0x71]
mov word [rbp - 0x71], si
movdqu xmmword [rbp - 0x61], xmm0
call fcn.14004d5c4
mov rdx, qword [rdi]
lea r8, [rbp - 0x51]
add rdx, 0xe0
mov byte [rsp + 0x20], 1
mov r9b, 1
lea rcx, [rbp - 0x71]
call fcn.1401d6420
lea rcx, [rbp - 0x71]
mov ebx, eax
call fcn.14004e0f0
lea rcx, [rbp - 0x51]
call fcn.14004e0f0
or r14, 0xffffffffffffffff
test ebx, ebx
jns 0x1401e735f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x79], eax
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1401e735f
mov r9, qword [rdi]
lea rax, [rbp - 0x79]
mov qword [rbp - 9], rax
lea rax, str.Failed_to_persist_the_successfully_applied_configuration_command
mov qword [rbp + 7], rax
mov qword [rbp - 1], 4
lea rax, [r9 + 0xa0]
mov qword [rbp + 0xf], 0x82
cmp qword [rax + 0x18], 8
jb 0x1401e72d1
mov rax, qword [rax]
lea rdx, [0x140344690]
mov rcx, rsi
mov r8, rdx
test rax, rax
je 0x1401e72f2
mov r8, rax
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], si
jne 0x1401e72e9
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x17], r8
mov dword [rbp + 0x1f], eax
lea rax, [r9 + 0x10]
mov dword [rbp + 0x23], esi
cmp qword [rax + 0x18], 8
jb 0x1401e7311
mov rax, qword [rax]
mov rcx, rsi
test rax, rax
je 0x1401e7328
mov rdx, rax
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], si
jne 0x1401e731f
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x27], rdx
mov dword [rbp + 0x2f], eax
mov dword [rbp + 0x33], esi
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403df5df]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001158
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1401e73a1
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1401e73a1
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140245398.0]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1401e73a1
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x140245398.0]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1401e7868
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov r9, r8
mov r11, qword [r8 + 0x10]
mov rsi, rdx
mov r15, rcx
mov r10, r8
jb 0x1401e789e
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x1401e78d1
movzx eax, byte [rcx + r10]
movabs rbx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rbx
cmp rcx, rdx
jb 0x1401e78b3
mov rcx, qword [r15 + 0x30]
mov r12, qword [r15 + 0x18]
and rcx, r8
mov rbx, qword [r15 + 8]
mov rax, rcx
add rax, rax
lea r13, [rcx + rcx]
mov rax, qword [r12 + rax*8]
cmp qword [r12 + r13*8], rbx
jne 0x1401e78f9
mov rcx, rbx
jmp 0x1401e7901
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401e79c3
cmp qword [r9 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r9
jb 0x1401e791b
mov rdx, qword [r9]
mov r14, qword [rcx + 0x18]
mov r8, rcx
cmp r14, 8
jb 0x1401e792b
mov r8, qword [rcx]
mov rbp, qword [rcx + 0x10]
cmp rbp, r11
jne 0x1401e795e
mov rdi, rbp
test rbp, rbp
je 0x1401e7958
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jne 0x1401e7963
add rdx, 2
sub rdi, 1
jne 0x1401e793f
xor ecx, ecx
test ecx, ecx
je 0x1401e796c
mov rax, qword [rax]
jmp 0x1401e78ee
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401e795a
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1401e7979
mov rcx, qword [rcx]
cmp qword [r9 + 0x18], 8
mov rdx, r9
jb 0x1401e7986
mov rdx, qword [r9]
cmp r11, rbp
jne 0x1401e79b2
test r11, r11
je 0x1401e79ac
sub rdx, rcx
movzx r8d, word [rdx + rcx]
movzx r10d, word [rcx]
cmp r8w, r10w
jne 0x1401e79ba
add rcx, 2
sub r11, 1
jne 0x1401e7993
xor ecx, ecx
test ecx, ecx
je 0x1401e79b5
mov rax, rbx
mov rcx, rax
jmp 0x1401e79c9
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401e79ae
mov rax, rbx
mov rcx, rbx
cmp rcx, rbx
jne 0x1401e7a3d
mov rbx, qword [rbx]
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.1401e7b48
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1401e7a17
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1401e4984
jmp 0x1401e7a44
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401e97c0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov rdi, rcx
and dword [rax - 0x18], 0
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401e97f3
mov rcx, qword [rdx]
xor edx, edx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
sete dl
mov rcx, qword [rsp + 0x48]
lea rax, str.Could_not_read_file_version_info
mov qword [rsp + 0x20], rax
movzx r9d, dl
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x7a
call fcn.1401e95b8
mov ecx, esi
call fcn.1402e5bb8
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x1401e9844
mov rbx, qword [rbx]
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
mov rcx, qword [rsp + 0x48]
lea rdx, str.Could_not_retrieve_file_version_info
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x83
call fcn.14004d29c
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401efc68
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x29], edx
mov edi, r8d
xor edx, edx
mov dword [rbp - 0x39], ecx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1401efd30
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401efd1e
and dword [rbp + 0x13], 0
lea rax, str.Failed_to_get_process_handle._TerminateProcess_failed.
and dword [rbp + 0x23], 0
mov edx, 4
and dword [rbp + 0x33], 0
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x31]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0xf], 0x37
mov dword [rbp + 0x1f], edx
mov dword [rbp - 0x31], ebx
mov dword [rbp + 0x2f], edx
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dfa3c]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1401efe3f
mov edx, edi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test eax, eax
jne 0x1401efdb9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401efd1e
and dword [rbp + 0x13], 0
lea rax, [0x1403676e8]
and dword [rbp + 0x23], 0
mov edx, 4
and dword [rbp + 0x33], 0
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x31]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0xf], Compress
mov dword [rbp + 0x1f], edx
mov dword [rbp - 0x31], ebx
mov dword [rbp + 0x2f], edx
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dfa3c]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
jmp 0x1401efd1e
mov edx, dword [rbp - 0x29]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1401efe3d
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401efe36
and dword [rbp + 0x13], 0
lea rax, str.Process_did_not_end_after_termination
and dword [rbp + 0x23], 0
mov edx, 4
and dword [rbp + 0x33], 0
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0xf], 0x26
mov dword [rbp + 0x1f], edx
mov dword [rbp + 0x2f], edx
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dfa78]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
mov eax, 0x800705b4
jmp 0x1401efe3f
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0xb0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401f1b30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x1401f1b52
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r9, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r9*8], rdx
jne 0x1401f1b99
mov rcx, rdx
jmp 0x1401f1ba1
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401f1bb9
mov rcx, qword [r10]
cmp qword [rax + 0x10], rcx
je 0x1401f1bb4
mov rax, qword [rax]
jmp 0x1401f1b8e
mov rcx, rax
jmp 0x1401f1bbf
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x1401f1c38
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.1401a6a94
mov rdx, rax
movabs rcx, 0x555555555555554
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1401f1c0d
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1401f2730
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret