joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078650
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r11, rdx
mov rbx, qword [rcx + 0x90]
test rbx, rbx
je 0x14007868b
lock inc dword [rbx + 8]
mov rbx, qword [rcx + 0x90]
mov rdi, qword [rcx + 0x88]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
test rdi, rdi
je 0x140078776
mov rsi, qword [rdi + 0x40]
mov rax, rsi
shr rax, 8
movzx edx, al
movzx eax, sil
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r8, 0x100000001b3
imul rax, r8
xor rdx, rax
imul rdx, r8
mov rax, rsi
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x38
xor rdx, rax
imul rdx, r8
mov rcx, qword [r11 + 0x30]
and rcx, rdx
shl rcx, 4
mov r9, qword [r11 + 0x18]
mov rax, qword [rcx + r9]
mov r8, rax
lea r10, [rcx + 8]
mov rdx, qword [r11 + 8]
cmp r8, rdx
je 0x1400787b4
mov rcx, qword [r10 + r9]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14007877a
cmp qword [rax + 0x10], rsi
je 0x14007877d
mov rax, qword [rax]
jmp 0x14007875a
mov rdx, qword [rdx + 8]
mov rax, rdx
cmp rax, rdx
je 0x1400787b9
test rbx, rbx
je 0x14007878f
mov rcx, rbx
call fcn.14007e8c0
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140123570
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, rdx
jmp 0x140078766
lea rdx, [0x14012c2e0]
call fcn.1400a6424
mov rsi, qword [rax + 8]
cmp dword [rsi], 3
jbe 0x14007882b
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140079070
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, str.Projection_is_pointing_to_a_missing_property
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [0x1403e8c57]
mov rcx, rsi
call fcn.140005770
lea rcx, [rsp + 0x50]
call fcn.14007a7c0
nop
test rbx, rbx
je 0x140078838
mov rcx, rbx
call fcn.14007e8c0
mov eax, 0x80070057
jmp 0x140078791
Function at 0x140078848
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r12, r8
mov rsi, rdx
mov r13, rcx
and dword [rbp + 0x48], 0
lea rcx, [rbp - 0x10]
call fcn.140078a60
nop
mov r15, qword [rax]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
lea r14, [r15 + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov qword [rbp - 0x58], r14
mov r8, r12
lea rdx, [rbp - 0x30]
mov rcx, r15
call fcn.14007e5d0
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
and qword [rax], 0
and qword [rax + 8], 0
mov qword [rbp - 0x50], rbx
mov qword [rbp + 0x58], rdi
mov qword [rbp - 0x48], rdi
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400788d5
call fcn.14007e8c0
nop
test r14, r14
je 0x1400788e9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
test rbx, rbx
jne 0x140078989
mov r8, r12
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.14007e980
mov ebx, 2
mov r14, qword [rax]
mov r15, qword [rax + 8]
and qword [rax], 0
and qword [rax + 8], 0
or ebx, 4
test bl, 2
jne 0x140078a25
test bl, 1
je 0x140078936
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140078936
call fcn.14007e8c0
nop
test rdi, rdi
je 0x140078943
mov rcx, rdi
call fcn.14007e8c0
test r14, r14
jne 0x1400789b0
mov rax, qword [r13 + 8]
mov qword [rsi], rax
test r15, r15
je 0x14007895d
mov rcx, r15
call fcn.14007e8c0
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x140078a1b
mov rax, rsi
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
je 0x14007899a
lock inc dword [rdi + 8]
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp + 0x58]
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
lea rax, [rbp - 0x40]
mov ebx, 1
jmp 0x140078906
mov r9, qword [r14 + 0x40]
mov qword [rbp - 0x60], r9
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rbp + rdx - 0x60]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x1400789c4
mov rdx, qword [r13 + 0x30]
and rdx, rcx
add rdx, rdx
mov r10, qword [r13 + 0x18]
mov rax, qword [r10 + rdx*8]
mov r8, qword [r13 + 8]
cmp qword [r10 + rdx*8], r8
je 0x140078a3f
mov rcx, qword [r10 + rdx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140078a44
cmp qword [rax + 0x10], r9
je 0x14007894c
mov rax, qword [rax]
jmp 0x1400789f9
call fcn.14007e8c0
jmp 0x14007896a
and ebx, 0xfffffffd
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140078922
call fcn.14007e8c0
jmp 0x140078922
mov rcx, r8
jmp 0x140078a07
mov qword [rsi], r8
jmp 0x14007894f
Function at 0x140080df4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rdx
mov r13, r8
lea rdx, [rcx + 0x28]
mov rsi, rcx
lea rcx, [rsp + 0x28]
mov r8b, 1
call fcn.140080ad0
mov r15, qword [rsp + 0x40]
lea r8, [rsp + 0x28]
mov r10, qword [rsp + 0x38]
cmp r15, 8
movabs rdx, 0xcbf29ce484222325
cmovae r8, qword [rsp + 0x28]
xor ecx, ecx
lea r9, [r10 + r10]
test r9, r9
je 0x140080e81
movzx eax, byte [r8 + rcx]
movabs r11, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, r11
cmp rcx, r9
jb 0x140080e63
and rdx, qword [0x1404791f0]
mov r14, qword [0x1404791d8]
add rdx, rdx
mov r9, qword [0x1404791c8]
mov rax, qword [r14 + rdx*8]
cmp qword [r14 + rdx*8], r9
je 0x140080fd5
mov rcx, qword [r14 + rdx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140080f17
lea r8, [rax + 0x10]
cmp r15, 8
mov rbp, qword [r8 + 0x18]
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
mov rdi, qword [r8 + 0x10]
cmp rbp, 8
jb 0x140080ed8
mov r8, qword [r8]
cmp rdi, r10
jne 0x14008106a
mov r11, rdi
test rdi, rdi
je 0x14008100a
sub r8, rcx
movzx ebx, word [rcx]
cmp word [rcx + r8], bx
jb 0x14008106a
ja 0x14008106a
cmp r11, 1
je 0x14008100a
dec r11
add rcx, 2
jmp 0x140080ef0
mov rax, r9
cmp rax, r9
je 0x140081072
mov edi, dword [rax + 0x30]
mov bl, 1
cmp r15, 8
jb 0x140080f40
mov rcx, qword [rsp + 0x28]
lea rdx, [r15*2 + 2]
call fcn.14007ebd0
test bl, bl
je 0x140081063
mov rax, qword [rsp + 0x20]
mov r8, r13
xor edx, edx
mov rcx, rsi
mov rax, qword [rax + 0x40]
mov ebx, dword [rax]
call fcn.140076e08
mov r11d, eax
mov r10d, edi
test edi, edi
jne 0x140080f96
cmp ebx, eax
sete al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140123570
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
sub r10d, 1
je 0x140080fba
sub r10d, 4
je 0x140080fcb
cmp r10d, 1
je 0x140080fc3
mov r9, r13
mov r8d, edi
mov edx, ebx
mov rcx, rsi
call fcn.14011b294
jmp 0x140080f6f
cmp ebx, r11d
jne 0x140080fdd
mov al, 1
jmp 0x140080f6f
test ebx, r11d
setne al
jmp 0x140080f6f
mov eax, ebx
cdq
idiv r11d
test edx, edx
jmp 0x140080f6c
mov rcx, r9
jmp 0x140080eaf
mov edi, 1
mov rax, qword [rsi + 0x50]
sub rax, qword [rsi + 0x48]
sar rax, 5
cmp rdi, rax
jae 0x140081063
mov r8, r13
mov rdx, rdi
mov rcx, rsi
call fcn.140076e08
cmp ebx, eax
je 0x140080fbf
inc rdi
jmp 0x140080fe2
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x140081017
mov rcx, qword [rcx]
cmp r15, 8
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
cmp r10, rdi
jne 0x140080f17
test r10, r10
je 0x140080f1a
sub rdx, rcx
movzx r8d, word [rcx]
cmp word [rcx + rdx], r8w
jb 0x140080f17
ja 0x140080f17
cmp r10, 1
je 0x140080f1a
dec r10
add rcx, 2
jmp 0x14008103b
xor al, al
jmp 0x140080f6f
mov rax, qword [rax]
jmp 0x140080e9d
mov edi, dword [rsp + 0x20]
xor bl, bl
jmp 0x140080f28
Function at 0x14008c164
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
lea rbx, [rcx + 0x18]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + rsi]
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
inc r10
cmp r10, 8
jb 0x14008c1a6
mov r8, qword [rdi + 0x88]
and r8, r9
add r8, r8
mov r9, qword [rdi + 0x70]
mov rcx, qword [r9 + r8*8]
mov rdx, qword [rdi + 0x60]
cmp qword [r9 + r8*8], rdx
jne 0x14008c23c
mov rax, rdx
cmp rcx, rax
je 0x14008c246
mov rax, qword [rsi]
cmp qword [rcx + 0x10], rax
jne 0x14008c24b
cmp rcx, rdx
jne 0x14008c250
mov r9, rbp
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14008c270
nop
test rbx, rbx
je 0x14008c222
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov al, byte [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rax, qword [r9 + r8*8 + 8]
mov rax, qword [rax]
jmp 0x14008c1e7
mov rcx, rdx
jmp 0x14008c1f5
mov rcx, qword [rcx]
jmp 0x14008c1de
test rbx, rbx
je 0x14008c264
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor al, al
jmp 0x14008c226
Function at 0x14008d058
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov r14, r8
mov rsi, qword [rcx]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14008d081
mov rdx, qword [rdx]
movabs rbx, 0xcbf29ce484222325
mov rdi, rbx
xor ecx, ecx
movabs r15, 0x100000001b3
add r8, r8
je 0x14008d0b2
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r15
inc rcx
cmp rcx, r8
jb 0x14008d09f
mov qword [rsp + 0x88], rdi
lea rbp, [rsi + 0x18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x88]
xor rbx, rax
imul rbx, r15
inc rcx
cmp rcx, 8
jb 0x14008d0d0
mov rdx, qword [rsi + 0x88]
and rdx, rbx
add rdx, rdx
mov r8, qword [rsi + 0x70]
mov rbx, qword [r8 + rdx*8]
mov rcx, qword [rsi + 0x60]
cmp qword [r8 + rdx*8], rcx
jne 0x14008d11a
mov rax, rcx
cmp rbx, rax
je 0x14008d124
cmp qword [rbx + 0x10], rdi
je 0x14008d127
mov rbx, qword [rbx]
jmp 0x14008d101
mov rax, qword [r8 + rdx*8 + 8]
mov rax, qword [rax]
jmp 0x14008d10a
mov rbx, rcx
cmp rbx, rcx
je 0x14008d244
mov rdi, qword [rbx + 0x28]
cmp qword [rsi + 0x40], 0
jne 0x14008d26b
mov rax, qword [rsi + 0x98]
cmp rdi, rax
je 0x14008d157
mov rcx, qword [rdi]
cmp rax, rcx
jne 0x14008d212
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x40]
movups xmm6, xmmword [rbx + 0x18]
mov byte [rsp + 0x30], 1
movsd xmm0, qword [rsp + 0x30]
movsd qword [rsp + 0x30], xmm0
test rbp, rbp
je 0x14008d189
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov bl, byte [rsp + 0x30]
test bl, bl
je 0x14008d280
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov r8, qword [rsp + 0x80]
shr r8, 0x20
shl r8, 0x20
mov eax, dword [rsp + 0x80]
add r8, rax
mov edx, dword [reloc.Cabinet.dll_CreateCompressor]
movabs rcx, 0xc92a69c000
imul rdx, rcx
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rcx, xmm0
sub r8, rcx
cmp r8, rdx
ja 0x14008d280
movdqu xmmword [r14], xmm6
mov al, 1
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rdi + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rdi
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov qword [rdi + 8], r8
jmp 0x14008d157
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x48]
xorps xmm6, xmm6
xor bl, bl
test rbp, rbp
je 0x14008d280
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
jmp 0x14008d18d
lea rcx, [rdi + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x14008d13f
xor al, al
jmp 0x14008d1f8
Function at 0x140094440
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r13, qword [rbp + 0x50]
xor r15d, r15d
mov rax, qword [rbp + 0x70]
mov r14, r9
mov r12, qword [rbp + 0x58]
mov rsi, r8
mov qword [r11 - 0x68], rax
mov rdi, rcx
lea rax, [rbp + 0x60]
mov byte [r13], 1
mov qword [r11 - 0x70], rax
lea r9d, [r15 + 2]
lea rax, [rbp + 0x78]
mov dword [r12], r15d
mov qword [r11 - 0x78], rax
lea rcx, [rbp + 0x50]
mov eax, dword [rbp + 0x68]
mov r8, r14
mov dword [rsp + 0x28], eax
mov rbx, rdx
mov byte [rsp + 0x20], r15b
mov qword [rbp + 0x50], r15
mov dword [rbp + 0x78], r15d
mov dword [rbp + 0x60], r15d
call fcn.1400946d8
mov dword [r12], eax
test eax, eax
je 0x1400944e3
mov rdx, rsi
mov rcx, rdi
call fcn.140079070
lea rcx, [rbp + 0x50]
call fcn.1401080e0
jmp 0x140094632
mov r15d, dword [rbp + 0x60]
lea rcx, [rbp - 0x18]
mov edx, r15d
call fcn.140094660
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x140094500
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x78]
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9d, [rdx + 2]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [r12], eax
test eax, eax
je 0x1400945d8
call fcn.1400a4e1c
cmp dword [rax], 4
jbe 0x1400945bf
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x140094551
mov rcx, qword [rsi]
cmp qword [r14 + 0x18], 8
mov qword [rbp + 0x58], rcx
mov ecx, dword [r12]
mov dword [rbp + 0x60], ecx
jb 0x140094566
mov r14, qword [r14]
cmp qword [rbx + 0x18], 8
mov qword [rbp - 0x30], r14
jb 0x140094574
mov rbx, qword [rbx]
lea rcx, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rcx
lea rdx, [0x1403f00c2]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000240c
mov rdx, rsi
mov rcx, rdi
call fcn.140079070
lea rcx, [rbp - 0x18]
call fcn.140106354
jmp 0x1400944d5
mov rax, qword [rbp - 0x18]
lea ecx, [r15 - 1]
xor ebx, ebx
mov byte [r13], bl
mov word [rax + rcx*2], bx
mov rcx, rdi
mov rdx, qword [rbp - 0x18]
call fcn.1400aeef0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14009461d
mov rdx, qword [rbp - 8]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
call fcn.14007ebd0
xorps xmm0, xmm0
mov qword [rbp - 8], rbx
movdqu xmmword [rbp - 0x18], xmm0
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140094632
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14009638c
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
xor edi, edi
mov rbx, rcx
cmp byte [rcx + 0x38], dil
je 0x1400964bf
call fcn.1400a4e1c
cmp dword [rax], 4
jbe 0x1400963ee
lea rcx, [rbx + 0x18]
cmp qword [rcx + 0x18], 8
jb 0x1400963be
mov rcx, qword [rcx]
mov qword [rbp + 0x20], rcx
lea rdx, [0x1403f438f]
lea rcx, str.Disable_privilege
mov qword [rbp + 0x28], rcx
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140005770
xor edx, edx
mov dword [rbx + 0x14], edi
mov rcx, qword [rbx]
lea r8, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
nop dword [rax + rax]
test eax, eax
jne 0x140096456
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call fcn.1400a4e1c
cmp dword [rax], 2
jbe 0x1400964bf
lea rcx, [rbx + 0x18]
cmp qword [rcx + 0x18], 8
jb 0x140096442
mov rcx, qword [rcx]
mov qword [rbp + 0x28], rcx
lea rdx, [0x1403f4355]
lea rcx, str.Failed_to_adjust_token_privileges
jmp 0x140096495
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, 0x514
cmp eax, edi
jne 0x1400964bf
call fcn.1400a4e1c
cmp dword [rax], 2
jbe 0x1400964bf
lea rcx, [rbx + 0x18]
cmp qword [rcx + 0x18], 8
jb 0x140096483
mov rcx, qword [rcx]
mov qword [rbp + 0x28], rcx
lea rdx, [0x1403f4355]
lea rcx, str.Failed_to_disable_token_privileges
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov dword [rbp + 0x20], edi
call fcn.14000343c
lea rcx, [rbx + 0x18]
call fcn.14007a7c0
mov rcx, rbx
add rsp, 0x40
pop rdi
pop rbx
pop rbp
jmp fcn.1400fffac

Function at 0x140096600
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0x20]
mov rdi, rcx
mov rcx, rbx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov al, byte [rdi + 0x18]
test al, al
je 0x140096667
mov rdx, qword [rdi + 0x28]
mov eax, 1
lock xadd qword [rdx + 0x38], rax
mov ecx, 0x323
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test rbx, rbx
je 0x140096663
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
xor al, al
jmp 0x140096696
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
setne dil
test rbx, rbx
je 0x140096693
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
mov al, dil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400968fc
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
and dword [rax - 0x18], 0
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140096927
mov rcx, qword [rdx]
xor edx, edx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
sete dl
mov rcx, qword [rsp + 0x48]
lea rax, str.Could_not_read_file_version_info
mov qword [rsp + 0x20], rax
movzx r9d, dl
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x7a
call fcn.1400969d4
mov ecx, esi
call fcn.140129918
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x14009697e
mov rbx, qword [rbx]
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rdx, str.Could_not_retrieve_file_version_info
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x83
call fcn.140096a0c
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140096e34
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140096f04
test r8, r8
je 0x140096f04
movzx ebp, r14w
lea r15d, [r14 + 1]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rcx
movzx r10d, bp
sar rax, 4
cmp r10, rax
jae 0x140096f20
mov eax, r10d
add rax, rax
mov edx, dword [rcx + rax*8]
test edx, edx
je 0x140096f9e
cmp edx, r15d
je 0x140096f86
cmp edx, 2
je 0x140096f67
jle 0x140096f04
cmp edx, 5
jle 0x140096ed6
cmp edx, 6
je 0x140096f30
cmp edx, 7
jne 0x140096f04
mov rcx, qword [rbx + 0x18]
mov r9, rdi
mov r8, rsi
mov rcx, qword [rcx + r10*8]
call fcn.140096fc0
jmp 0x140096efb
mov rax, qword [rbx + 0x18]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, qword [rax + r10*8]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jne 0x140096f04
add bp, r15w
jmp 0x140096e72
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
add qword [rbx + 0x38], rdi
mov al, r15b
mov byte [rbx + 0x9c0], r15b
jmp 0x140096f06
mov rax, qword [rbx + 0x18]
mov r9, qword [rbx + 0x30]
mov r8, qword [rbx + 0x38]
mov rcx, qword [rax + r10*8]
mov rdx, qword [rcx]
lea rcx, [rdx + 4]
lea rax, [rdx + 8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], rdx
mov rdx, rdi
call fcn.1400df780
jmp 0x140096efb
mov rdx, qword [rbx + 0x18]
lea rcx, [0x140353830]
mov r9, rdi
mov r8, rsi
mov rdx, qword [rdx + r10*8]
call fcn.1402f7724
jmp 0x140096efb
mov rcx, qword [rbx + 0x18]
mov r8, rdi
mov rdx, rsi
mov rcx, qword [rcx + r10*8]
call fcn.1402f3f50
jmp 0x140096efb
mov rcx, qword [rbx + 0x18]
mov r8, rdi
mov rdx, rsi
mov rcx, qword [rcx + r10*8]
call fcn.1402f58d0
jmp 0x140096efb
Function at 0x140096fc0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x18
mov r14, rcx
xor eax, eax
mov rcx, qword [rcx + 0x800]
mov rsi, r9
mov qword [rsp + 0x40], rcx
mov rbp, r8
mov edx, dword [r14 + 0x808]
movzx edi, byte [r14 + 0x80c]
mov dword [rsp + 0x48], edx
test r9, r9
je 0x14009714b
mov qword [r11 - 0x28], r12
lea r10, [0x140360c00]
movzx r12d, byte [r11 + 0x12]
mov qword [r11 - 0x30], r13
movzx r13d, byte [r11 + 0x11]
mov qword [rsp], r15
movzx r15d, byte [r11 + 0x13]
mov qword [r11 + 0x18], rbx
nop dword [rax]
movzx edx, byte [rax + rbp]
cmp dl, dil
je 0x14009716b
lea r8, [r10 + rdx*4]
movzx ecx, r13b
mov byte [rsp + 0x48], cl
movzx r13d, r12b
movzx r12d, r15b
mov ebx, dword [r10 + rcx*4]
movzx r15d, dil
movzx edi, dl
mov r9d, dword [r10 + r13*4]
mov r11d, dword [r10 + r12*4]
mov ecx, r11d
mov r10d, dword [r10 + r15*4]
shr ecx, 8
movzx edx, cl
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
xor rdx, rcx
movzx ecx, byte [r8]
mov r8d, dword [r8]
xor rdx, rcx
mov ecx, r10d
shr ecx, 8
inc qword [r14 + rdx*8]
movzx edx, cl
mov ecx, r9d
shr ecx, 0x10
movzx ecx, cl
xor rdx, rcx
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
mov ecx, r11d
shr ecx, 0x10
inc qword [r14 + rdx*8]
movzx edx, cl
mov ecx, r8d
shr ecx, 8
movzx ecx, cl
xor rdx, rcx
shr r8d, 0x10
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov ecx, r10d
shr ecx, 0x10
inc qword [r14 + rdx*8]
movzx edx, cl
movzx ecx, bl
xor rdx, rcx
movzx ecx, r11b
xor rdx, rcx
movzx ecx, r8b
inc qword [r14 + rdx*8]
movzx edx, r9b
xor rdx, rcx
movzx ecx, r10b
xor rdx, rcx
lea r10, [0x140360c00]
mov rcx, qword [rsp + 0x40]
inc qword [r14 + rdx*8]
add rcx, 5
mov qword [rsp + 0x40], rcx
inc rax
cmp rax, rsi
jb 0x140097030
mov rbx, qword [rsp + 0x50]
mov byte [rsp + 0x4b], r15b
mov r15, qword [rsp]
mov byte [rsp + 0x4a], r12b
mov r12, qword [rsp + 0x10]
mov byte [rsp + 0x49], r13b
mov edx, dword [rsp + 0x48]
mov r13, qword [rsp + 8]
mov dword [r14 + 0x808], edx
mov byte [r14 + 0x80c], dil
mov qword [r14 + 0x800], rcx
add rsp, 0x18
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp dl, r12b
jne 0x14009703d
cmp dl, r15b
jne 0x14009703d
cmp dl, r13b
je 0x140097119
jmp 0x14009703d