joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cc7e0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x1400cc887
mov rbx, qword [rsi + 8]
cmp rdi, rbx
ja 0x1400cc975
jae 0x1400cc96d
cmp rbx, 3
jb 0x1400cc8a8
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov rdx, rax
and rdx, rcx
shr rax, 2
and rax, rcx
add rax, rdx
mov rcx, rax
shr rcx, 4
add rcx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rcx
movabs rcx, 0x101010101010101
imul rcx, rax
shr rcx, 0x38
cmp ecx, 1
ja 0x1400cc8a8
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x1400cc8b8
cvtsi2ss xmm0, rax
jmp 0x1400cc8cd
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400cc898
mov rdi, rdx
jmp 0x1400cc7f9
mov rcx, rdx
call fcn.140053720
mov rdi, rax
jmp 0x1400cc7f9
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x1400cc918
cvtsi2ss xmm0, rax
jmp 0x1400cc92d
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.1400a4e60
cvttss2si rcx, xmm0
movss xmm1, dword [0x1400f07c8]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rax, 2
jb 0x1400cc961
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400cc961
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.1400a4e60
cvttss2si rax, xmm0
movss xmm1, dword [0x1400f07c8]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rcx, xmm2
btc rcx, 0x3f
ucomiss xmm0, xmm1
cmovb rcx, rax
call fcn.140053720
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jb 0x1400cc975
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400ab6b0
Function at 0x1400d2380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x38]
mov rbp, qword [rcx + 0x40]
mov r15d, 1
cmp rdi, rbp
je 0x1400d2418
mov r14, r8
mov rsi, rcx
lea rbx, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.1400d1980
test al, al
jne 0x1400d23dc
add rdi, 0x70
cmp rbp, rdi
jne 0x1400d23c1
mov rdi, rbp
cmp rdi, qword [rsi + 0x40]
je 0x1400d2418
cmp byte [rdi + 0x27], 0
jns 0x1400d23ee
mov rcx, qword [rdi + 0x10]
jmp 0x1400d23f2
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov r15d, 1
cmovne r15d, ecx
test r15d, r15d
jne 0x1400d2418
mov qword [r14], rdi
xor r15d, r15d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400797f0
mov eax, r15d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400d9030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d905a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d9098
mov edi, eax
bt eax, 0xa
jae 0x1400d9150
test bl, bl
jne 0x1400d9150
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400797f0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140064750
test al, al
je 0x1400d9079
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x81
mov r9d, 2
call fcn.1400cb600
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140051090
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14005d050
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400d9125
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140051090
cmp byte [rsp + 0x4f], 0
jns 0x1400d9141
mov rcx, qword [rsp + 0x38]
call fcn.140078974
lea rcx, [rsp + 0x50]
call fcn.1400cb6f0
jmp 0x1400d9079
and edi, 0x10
shr edi, 4
jmp 0x1400d907b
Function at 0x1400d9160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d9188
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d91b8
test eax, 0x410
sete bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400797f0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140064750
test al, al
je 0x1400d926f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x74
mov r9d, 2
call fcn.1400cb600
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140051090
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14005d050
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400d9249
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140051090
cmp byte [rsp + 0x4f], 0
jns 0x1400d9265
mov rcx, qword [rsp + 0x38]
call fcn.140078974
lea rcx, [rsp + 0x50]
call fcn.1400cb6f0
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400797f0
xor eax, eax
jmp 0x1400d91ad

Function at 0x1400d9290
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d92b7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d92d2
and eax, 0x410
cmp eax, 0x410
je 0x1400d93c5
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400d92de
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x1400d9307
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400797f0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140064750
test al, al
je 0x1400d93be
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x94
mov r9d, 2
call fcn.1400cb600
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140051090
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005d050
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400d9398
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140051090
cmp byte [rsp + 0x57], 0
jns 0x1400d93b4
mov rcx, qword [rsp + 0x40]
call fcn.140078974
lea rcx, [rsp + 0x58]
call fcn.1400cb6f0
xor edi, edi
jmp 0x1400d92eb
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400797f0
mov rcx, rsi
add rsp, 0x1a8
pop rdi
pop rsi
jmp fcn.1400d93f0
Function at 0x1400d93f0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d9418
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x1400d9446
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400797f0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140064750
test al, al
je 0x1400d9424
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x2f
mov r9d, 2
call fcn.1400cb600
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140051090
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.14005d050
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x1400d94d3
mov r8, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
mov rdx, rdi
call fcn.140051090
cmp byte [rsp + 0x4f], 0
jns 0x1400d94ef
mov rcx, qword [rsp + 0x38]
call fcn.140078974
lea rcx, [rsp + 0x50]
call fcn.1400cb6f0
jmp 0x1400d9424
Function at 0x140199000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1401990d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140199037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14019902d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1401990cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1401990cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1401990ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140199081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140199072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140199021
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ca14
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ca14
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f340
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a348
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d6f0
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a348
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b0dc
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ca14
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018804
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ca14
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140f5b74c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f5b756
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f5b77f
pop rbp
sub rbp, 0x33
sub rbp, 0xf5b74c
sub rsp, 0x20
jmp 0x140f5b79e
mov rax, 0xf5b74c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffccaa0de6
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f5b7bd
jmp 0x140f5b7d4
scasb al, byte [rdi]
outsd dx, dword [rsi]
invalid
Function at 0x1400068f0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x470], rbx
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], rdi
mov rax, qword [0x140068028]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [0x140068058]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006970
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400069ea
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000699b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140052ad0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1400069ea
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x1400069ed
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x1400069fa
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140006a12
inc rbx
test eax, eax
jne 0x140006a00
test ecx, ecx
mov rcx, rsi
je 0x140006a72
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006960
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140006a6e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140006a69
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006af5
mov rcx, r8
call fcn.140051ec0
xor eax, eax
jmp 0x140006ab5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140006ab2
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140006aad
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006af5
mov rcx, r8
call fcn.140051ec0
mov rax, rbx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.140051a60
mov rbx, qword [rbp + 0x470]
mov rsi, qword [rbp + 0x480]
mov rdi, qword [rbp + 0x488]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140006cb0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rdi
mov rax, qword [0x140068028]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
nop word [rax + rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006d30
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140006daa
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140006d5b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140052ad0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140006daa
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x2c]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x140006dad
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x140006dba
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140006dd2
inc rbx
test eax, eax
jne 0x140006dc0
test ecx, ecx
mov rcx, rsi
je 0x140006e32
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006d20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140006e2e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140006e29
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006eb3
mov rcx, r8
call fcn.140051ec0
xor eax, eax
jmp 0x140006e73
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rbp + 8]
cmp rdx, 0x10
jb 0x140006e71
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140006e6c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006eb3
mov rcx, r8
call fcn.140051ec0
mov eax, ebx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.140051a60
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
mov rdi, qword [rbp + 0x288]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400096e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000973d
lea rbx, [0x140058c40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140009724
cmp r10, 2
jb 0x140009724
cmp byte [r9], r8b
jne 0x140009724
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140009700
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000977f
lea rbx, [0x140058c40]
cmp r8b, 0x23
jne 0x140009763
cmp byte [r9], r8b
jne 0x140009763
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140009750
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400098c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1400098da
mov qword [r8], 0
lea rdx, [0x1400587a0]
call fcn.140009790
mov rbx, rax
test rax, rax
jne 0x1400098fa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400099d1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400099d1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400099d1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400099d1
cmp rdi, 0xffffffffffffffff
je 0x1400099d1
mov rax, qword [0x140068ed0]
test rax, rax
je 0x14000996e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400099d1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400099be
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140068ed0]
test rax, rax
je 0x1400099b3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400099da
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400099cc
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400099dc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000d180
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x140058c40]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x14000d216
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.140021560
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000d220
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x140058c40]
vmovss xmm3, dword [rcx + 0x110]
vmovss xmm4, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
vmovss xmm0, dword [rdx]
vmovss xmm2, dword [rdx + 4]
vsubss xmm1, xmm0, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
vmovss dword [rsp], xmm1
movzx eax, byte [rsp]
xor rcx, rax
movzx eax, byte [rsp + 1]
vmovss xmm1, dword [rdx + 8]
vsubss xmm0, xmm2, xmm4
vmovss dword [rsp + 4], xmm0
xor r8d, dword [r9 + rcx*4]
vmovss xmm0, dword [rdx + 0xc]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 8], xmm2
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
vsubss xmm1, xmm0, xmm4
vmovss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret