joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021ee0
Capabilities:
Get file size

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
call fcn.14004fec0
call fcn.140044e60
test al, al
je 0x140021f21
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x28]
xor r9d, r9d
mov r8, rsi
call fcn.140044f00
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140044ed0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400edc60
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400230d0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r8
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [rsi + 0x28]
mov rcx, rdi
call fcn.140022f20
xor ebp, ebp
cmp rbx, 0x7fffffff
ja 0x140023118
test al, al
je 0x140023118
cmp qword [rsi + 0x58], 0
je 0x140023134
xor ebp, ebp
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400edc60
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp byte [rsi], 0
je 0x1400231c3
mov rcx, rdi
call fcn.140022f30
mov r14, rax
mov rbp, qword [0x140193210]
test rbp, rbp
jne 0x14002317b
lea rcx, [0x140155c94]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
mov qword [0x140193210], rbp
mov rax, qword [0x140155cb8]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [0x140155ca8]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor edx, edx
mov r9d, 0x18
mov rcx, r14
call rbp
test eax, eax
jne 0x140023116
movzx eax, byte [rsp + 0x3b]
test al, 1
jne 0x140023116
mov r14d, r15d
sar r14d, 0x1f
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140022f30
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
mov qword [rsi + 0x58], rbp
test rbp, rbp
jne 0x140023253
call fcn.140046430
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140022f30
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
mov qword [rsi + 0x58], rbp
test rbp, rbp
jne 0x140023253
call fcn.140046430
mov rbp, qword [rsi + 0x58]
test rbp, rbp
je 0x140023116
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14002327b
mov rax, qword [rsp + 0x48]
sub rax, rbp
add rax, qword [rsp + 0x38]
jmp 0x14002327d
xor eax, eax
mov qword [rsi + 0x50], rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140022f60
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x70], xmm0
call fcn.140045690
mov rcx, rax
mov rdx, rsi
call fcn.140045c30
mov bpl, 1
jmp 0x140023118
Function at 0x140027aa0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov r15, rcx
movzx eax, byte [rbx]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [rbx + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rbx + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rbx + 3]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rbx + 4]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rbx + 5]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [rbx + 6]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [rbx + 7]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r15 + 0x30]
mov rax, qword [r15 + 8]
mov rcx, qword [r15 + 0x18]
lea r12, [rdx + rdx]
shl rdx, 4
mov rsi, qword [rcx + rdx]
mov rdi, rax
cmp rsi, rax
je 0x140027b56
lea rdx, [r12*8]
or rdx, 8
mov rcx, qword [rcx + rdx]
mov rdi, qword [rcx]
cmp rsi, rdi
je 0x140027b73
mov rcx, qword [rbx]
nop
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x140027c49
cmp rsi, rdi
jne 0x140027b60
mov rdi, qword [rax]
mov r13, qword [rdi + 8]
mov ecx, 0x18
call fcn.1400edc90
test rdi, rdi
mov rcx, r13
cmove rcx, rax
mov rdx, rdi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov rcx, qword [rbx]
mov qword [rax + 0x10], rcx
mov rcx, qword [r15 + 0x10]
movabs rdx, 0xaaaaaaaaaaaaaa9
cmp rcx, rdx
je 0x140027c89
add rcx, 1
mov qword [r15 + 0x10], rcx
mov qword [rdi + 8], rax
mov qword [r13], rax
mov rcx, qword [r15 + 8]
mov rdi, qword [rcx]
mov rax, qword [rdi]
cmp rax, rsi
je 0x140027c0a
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rdi
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
mov qword [rsi + 8], rdx
mov rdx, qword [rdi + 8]
mov qword [rax + 8], rdx
mov qword [rdi + 8], rcx
mov rcx, qword [r15 + 8]
mov rdx, qword [r15 + 0x18]
lea rax, [rdx + r12*8]
mov rbx, qword [rdx + r12*8]
cmp rbx, rcx
je 0x140027c4d
mov rcx, rdi
cmp rbx, rsi
je 0x140027c62
or r12, 1
mov rax, qword [rdx + r12*8]
mov rax, qword [rax]
mov qword [rdx + r12*8], rax
cmp rdi, rax
je 0x140027c65
mov rcx, qword [r15 + 0x18]
lea rax, [rcx + r12*8]
mov rcx, qword [rcx + r12*8]
mov rcx, qword [rcx + 8]
jmp 0x140027c62
xor eax, eax
jmp 0x140027c6f
mov qword [rax], rdi
shl r12, 3
or r12, 8
add r12, qword [r15 + 0x18]
mov rax, r12
mov rcx, rdi
mov qword [rax], rcx
mov rcx, r15
call fcn.140027ca0
mov al, 1
mov qword [r14], rdi
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400ef190
ud2
Function at 0x140027e00
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r15, r9
mov r14, rdx
movzx eax, byte [r8]
movabs rdx, 0xcbf29ce484222325
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
movzx ebx, byte [r8 + 1]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [r8 + 2]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r8 + 3]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [r8 + 4]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r8 + 5]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [r8 + 6]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r8 + 7]
xor rbx, rdx
imul rbx, rax
and rbx, qword [rcx + 0x30]
mov r9, qword [rcx + 8]
mov rsi, qword [rcx + 0x18]
lea rax, [rbx + rbx]
shl rbx, 4
mov rdx, qword [rsi + rbx]
mov rbx, r9
cmp rdx, r9
je 0x140027eb7
lea rbx, [rax*8]
or rbx, 8
mov rbx, qword [rsi + rbx]
mov rbx, qword [rbx]
cmp rdx, rbx
je 0x140027ecf
mov rdi, qword [r8]
nop
mov rbx, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
je 0x140027f47
cmp rdx, rbx
jne 0x140027ec0
mov rbx, qword [r15]
cmp rbx, rdx
je 0x140027f0c
mov rdi, qword [r15 + 8]
mov qword [rdi], rbx
mov rdi, qword [rbx + 8]
mov qword [rdi], rdx
mov rdi, qword [rdx + 8]
mov qword [rdi], r15
mov rdi, qword [rdx + 8]
mov rsi, qword [rbx + 8]
mov qword [rdx + 8], rsi
mov rsi, qword [r15 + 8]
mov qword [rbx + 8], rsi
mov qword [r15 + 8], rdi
mov r9, qword [rcx + 8]
mov rsi, qword [rcx + 0x18]
lea rbx, [rsi + rax*8]
mov rdi, qword [rsi + rax*8]
cmp rdi, r9
je 0x140027f70
mov r8, r15
cmp rdi, rdx
je 0x140027f85
or rax, 1
mov rdx, qword [rsi + rax*8]
mov rdx, qword [rdx]
mov qword [rsi + rax*8], rdx
cmp rdx, r15
je 0x140027f88
mov rdx, qword [rcx + 0x18]
lea rbx, [rdx + rax*8]
mov rax, qword [rdx + rax*8]
mov r8, qword [rax + 8]
jmp 0x140027f85
mov rax, qword [r15]
mov rdx, qword [r15 + 8]
mov qword [rdx], rax
mov rax, qword [r15]
mov rdx, qword [r15 + 8]
mov qword [rax + 8], rdx
add qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, r15
call fcn.1400edcd0
xor eax, eax
mov r15, rbx
jmp 0x140027f8f
mov qword [rbx], r15
shl rax, 3
or rax, 8
add rax, qword [rcx + 0x18]
mov rbx, rax
mov r8, r15
mov qword [rbx], r8
call fcn.140027ca0
mov al, 1
mov qword [r14], r15
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400280d0
Capabilities:
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movzx eax, byte [r8 + 0x10]
movabs rbx, 0xcbf29ce484222325
xor rbx, rax
movabs rax, 0x100000001b3
imul rbx, rax
movzx edi, byte [r8 + 0x11]
xor rdi, rbx
imul rdi, rax
movzx ebx, byte [r8 + 0x12]
xor rbx, rdi
imul rbx, rax
movzx edi, byte [r8 + 0x13]
xor rdi, rbx
imul rdi, rax
movzx ebx, byte [r8 + 0x14]
xor rbx, rdi
imul rbx, rax
movzx edi, byte [r8 + 0x15]
xor rdi, rbx
imul rdi, rax
movzx ebx, byte [r8 + 0x16]
xor rbx, rdi
imul rbx, rax
movzx esi, byte [r8 + 0x17]
xor rsi, rbx
imul rsi, rax
and rsi, qword [rcx + 0x30]
mov r14, rdx
lea rdx, [rsi + rsi]
mov rdi, qword [rcx + 0x18]
mov rbx, rsi
shl rbx, 4
lea rax, [rdi + rbx]
cmp qword [rdi + rdx*8 + 8], r8
mov rbx, qword [rdi + rbx]
je 0x14002817c
cmp rbx, r8
jne 0x1400281b0
mov rdx, r8
jmp 0x1400281aa
cmp rbx, r8
je 0x14002818f
lea rax, [rdi + rdx*8]
add rax, 8
lea rdx, [r8 + 8]
jmp 0x1400281aa
mov rdx, qword [rcx + 8]
mov qword [rax], rdx
lea rax, [rsi + rsi]
add rax, 1
lea rdx, [rcx + 8]
shl rax, 3
add rax, qword [rcx + 0x18]
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rsi, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rax], rsi
mov rax, qword [r8]
mov rdx, qword [r8 + 8]
mov qword [rax + 8], rdx
add qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, r8
call fcn.1400edcd0
mov qword [r14], rsi
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140028620
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r13]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r13 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r13 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r13 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x1400286b3
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x1400286c2
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x1400286de
cmp dword [rdx + 0x10], ebx
jne 0x1400286b0
cmp rdx, rax
je 0x1400286de
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x140028761
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x38
call fcn.1400edc90
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
mov ecx, 0xf
movq xmm0, rcx
pslldq xmm0, 8
movdqu xmmword [rax + 0x28], xmm0
mov byte [rax + 0x18], 0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x492492492492491
cmp rcx, rdx
je 0x140028774
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.140028790
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400ef190
ud2
Function at 0x140028ae0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r13]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r13 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r13 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r13 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x140028b73
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x140028b82
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x140028b9b
cmp dword [rdx + 0x10], ebx
jne 0x140028b70
cmp rdx, rax
je 0x140028b9b
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x140028c11
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x38
call fcn.1400edc90
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x28], xmm0
movups xmmword [rax + 0x18], xmm0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x492492492492491
cmp rcx, rdx
je 0x140028c24
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.140028c40
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400ef190
ud2
Function at 0x1400296d0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov r12, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdi, [r12 + 8]
lea rax, [0x140155cd0]
movq xmm0, rax
lea rax, [0x140155cc0]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [r12], xmm1
call fcn.1400468f0
mov rcx, rax
mov rdx, r12
call fcn.140046a90
call fcn.140047e90
mov rcx, rax
mov rdx, rdi
call fcn.140048290
mov r15, qword [r12 + 0x10]
add r15, 8
mov rcx, r15
call fcn.1400387d0
cmp qword [r12 + 0x18], 0
je 0x140029791
mov rax, qword [r12 + 0x10]
mov rax, qword [rax + 0x348]
cmp dword [r12 + 0x28], eax
jne 0x140029791
mov rax, qword [r12 + 0x10]
mov rdx, qword [r12 + 0x18]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [r12 + 0x18], 0
mov qword [rsp + 0x28], rdx
mov rdx, qword [r12 + 0x20]
lea r8, [rsp + 0x28]
call rax
mov rbx, qword [r12 + 0x10]
lea r14, [rbx + 0x2e0]
call fcn.1400468f0
movzx ecx, al
movabs rdx, 0xcbf29ce484222325
xor rdx, rcx
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx esi, ah
xor rsi, rdx
imul rsi, rcx
mov edx, eax
shr edx, 0x10
movzx edx, dl
xor rdx, rsi
imul rdx, rcx
mov edi, eax
shr edi, 0x18
xor rdi, rdx
imul rdi, rcx
mov rdx, rax
shr rdx, 0x20
movzx edx, dl
xor rdx, rdi
imul rdx, rcx
mov rdi, rax
shr rdi, 0x28
movzx edi, dil
xor rdi, rdx
imul rdi, rcx
mov rdx, rax
shr rdx, 0x30
movzx edx, dl
xor rdx, rdi
imul rdx, rcx
mov rdi, rax
shr rdi, 0x38
xor rdi, rdx
imul rdi, rcx
and rdi, qword [rbx + 0x310]
mov r9, qword [rbx + 0x2e8]
mov rdx, qword [rbx + 0x2f8]
lea r8, [rdi + rdi]
add r8, 1
shl rdi, 4
mov rbx, qword [rdx + rdi]
mov rcx, rbx
jmp 0x140029863
mov rcx, qword [rcx]
mov rdi, rbx
cmp rbx, r9
je 0x140029872
mov rdi, qword [rdx + r8*8]
mov rdi, qword [rdi]
cmp rdi, rcx
je 0x1400298d0
cmp qword [rcx + 0x10], rax
jne 0x140029860
mov rsi, rcx
jmp 0x140029893
mov rsi, qword [rsi]
mov rdi, rbx
cmp rbx, r9
je 0x1400298a2
mov rdi, qword [rdx + r8*8]
mov rdi, qword [rdi]
cmp rdi, rsi
je 0x1400298ad
cmp rax, qword [rsi + 0x10]
je 0x140029890
mov r8, r9
cmp rcx, rsi
je 0x1400298d3
mov rax, rcx
nop dword [rax + rax]
mov rax, qword [rax]
cmp rsi, rax
jne 0x1400298c0
mov r9, rsi
mov r8, rcx
jmp 0x1400298d3
mov r8, r9
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.140027fb0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [r12 + 0x10]
add rcx, 0x2b8
xor edx, edx
call fcn.14003c7d0
mov rdi, qword [r12 + 0x18]
test rdi, rdi
je 0x140029916
mov rcx, rdi
call fcn.14004a140
mov rcx, rdi
call fcn.1400edcd0
mov rcx, r12
call fcn.14002bf40
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400edc60
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14002a000
Capabilities:
Create thread

Disassembly:
jmp 0x14002a000
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebp, ebp
test rbx, rbx
setne bpl
shl ebp, 0x10
mov ecx, 0x10
call fcn.1400edc90
mov rdi, rax
mov qword [rdi], rsi
test r14, r14
setne byte [rdi + 8]
mov dword [rdi + 0xc], r15d
lea rcx, [rsp + 0x38]
call fcn.140019720
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14002a250]
xor ecx, ecx
mov rdx, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.140019720
mov rax, qword [rsp + 0x50]
sub rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rcx, qword [0x140193240]
test rcx, rcx
jne 0x14002a0e2
mov qword [rsp + 0x48], 0x989680
mov qword [rsp + 0x40], 0x3e8
mov dword [rsp + 0x20], 1
lea rcx, str.Windows.CreateThreadTime
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov r9d, 0x32
call fcn.14002df10
mov rcx, rax
mov qword [0x140193240], rcx
lea rdx, [rsp + 0x58]
call fcn.140031380
test rbx, rbx
je 0x14002a0fb
test r14, r14
je 0x14002a107
mov qword [r14], rbx
jmp 0x14002a110
mov rcx, rdi
call fcn.1400edcd0
xor esi, esi
jmp 0x14002a113
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov sil, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14002e310
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm8
movapd xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov r14, r8
mov edi, ecx
cvtsi2sd xmm0, edx
call fcn.140101800
movapd xmm6, xmm0
mov rax, qword [r14]
mov dword [rax + 4], edi
mov rax, qword [r14]
mov rbx, qword [r14 + 8]
sub rbx, rax
sar rbx, 2
lea rcx, [rbx - 1]
cmp rcx, 3
jb 0x14002e3ee
add rbx, 0xfffffffffffffffd
mov esi, 8
movdqa xmm8, xmmword [0x140155a60]
movapd xmm7, xmmword [0x140155a70]
nop dword [rax]
xorps xmm0, xmm0
cvtsi2sd xmm0, edi
call fcn.140101800
movapd xmm1, xmm6
subsd xmm1, xmm0
movq xmm2, rbx
punpckldq xmm2, xmm8
subpd xmm2, xmm7
pshufd xmm3, xmm2, 0x4e
addpd xmm3, xmm2
divsd xmm1, xmm3
addsd xmm0, xmm1
call fcn.140101d30
call fcn.140102130
cvttsd2si eax, xmm0
cmp edi, eax
jl 0x14002e3ca
add edi, 1
mov eax, edi
mov rcx, qword [r14]
mov dword [rcx + rsi], eax
add rsi, 4
mov edi, eax
add rbx, 0xffffffffffffffff
jne 0x14002e380
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
sub rcx, rax
sar rcx, 2
add rcx, 0xffffffffffffffff
mov edx, dword [0x140156550]
mov dword [rax + rcx*4], edx
mov rcx, r14
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140058df0
Function at 0x140039430
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15d, edx
mov rsi, rcx
mov rax, qword [rsi + 0x10]
mov bl, 1
test rax, rax
je 0x1400395e3
cmp rax, 0x103
jbe 0x14003946f
xor ebx, ebx
jmp 0x1400395e3
lea rbp, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbp
call fcn.140013960
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x58], 7
jbe 0x140039491
mov rbp, qword [rsp + 0x40]
test rax, rax
je 0x1400394d1
jle 0x1400394d1
lea rax, [rax*2]
add rax, rbp
mov rdi, rbp
nop word cs:[rax + rax]
movzx ecx, word [rdi]
cmp ecx, 0x3f
je 0x1400395ff
movzx ecx, cx
cmp ecx, 0x2a
je 0x1400395ff
add rdi, 2
cmp rdi, rax
jb 0x1400394b0
lea rcx, [rsp + 0x40]
call fcn.1400138f0
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x1400394e8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1400395e3
test dil, 1
je 0x14003951f
mov edx, edi
and edx, 0xfffffffe
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x140039511
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140039468
test dil, 0x10
jne 0x14003953d
cmp qword [rsi + 0x18], 7
jbe 0x14003952f
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400395de
test r15b, r15b
je 0x1400395cb
movaps xmm0, xmmword [0x140155870]
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x40], 0x2a
lea rdx, [rsp + 0x40]
mov r8d, 1
mov rcx, rsi
call fcn.140039660
mov ebx, eax
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x1400395c3
add rax, 1
js 0x140039659
mov rcx, qword [rsp + 0x40]
add rax, rax
cmp rax, 0x1000
jb 0x1400395be
test cl, 0x1f
jne 0x140039659
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140039659
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x140039659
call fcn.1400edcd0
test bl, bl
je 0x140039468
cmp qword [rsi + 0x18], 7
jbe 0x1400395d5
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400edc60
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
sub rdi, rbp
lea rcx, [rsp + 0x40]
call fcn.1400138f0
cmp rdi, 0xfffffffffffffffe
je 0x1400394db
lea r14, [rsp + 0x40]
mov rcx, rsi
mov rdx, r14
call fcn.140013960
lea rdi, [rsp + 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.140013550
movzx r8d, r15b
mov rcx, rdi
mov rdx, r14
call fcn.140039660
mov ebx, eax
mov rcx, rdi
call fcn.1400138f0
mov rcx, r14
call fcn.1400138f0
jmp 0x1400395e3
call fcn.1400f4650
ud2
Function at 0x140039660
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov esi, r8d
mov r14, rdx
mov rax, rcx
mov rcx, qword [0x140191d78]
xor rcx, rsp
mov qword [rsp + 0x570], rcx
mov qword [rsp + 0x20], r14
lea rbx, [rsp + 0x2a0]
xor r8d, r8d
mov r9d, 3
mov rcx, rbx
mov rdx, rax
call fcn.14005cb20
lea rdi, [rsp + 0x280]
mov rcx, rbx
mov rdx, rdi
call fcn.14005cc90
cmp qword [rsp + 0x290], 0
je 0x1400397d7
mov r15b, 1
lea rbx, [rsp + 0x2a0]
lea rbp, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12, qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
mov rcx, rbx
mov rdx, rbp
call fcn.14005cc00
mov edx, dword [rsp + 0x30]
test dl, 1
je 0x140039735
test sil, sil
jne 0x140039719
mov rcx, rbp
call fcn.14005c9f0
test al, al
jne 0x140039735
mov edx, dword [rsp + 0x30]
and edx, 0xfffffffe
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140039732
mov rcx, qword [rsp + 0x280]
call r12
mov rcx, rbp
call fcn.14005c9f0
test al, al
je 0x140039780
test sil, sil
je 0x1400397a0
mov r8d, 1
mov rcx, rdi
mov rdx, r14
call fcn.140039660
test al, al
je 0x14003979d
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140039771
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400397a0
jmp 0x14003979d
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140039796
mov rcx, qword [rsp + 0x280]
call r13
test eax, eax
jne 0x1400397a0
xor r15d, r15d
mov rcx, rbp
call fcn.14002bf40
mov rcx, rbx
mov rdx, rbp
call fcn.14005cc90
mov rcx, rdi
mov rdx, rbp
call fcn.1400129f0
mov rcx, rbp
call fcn.1400138f0
cmp qword [rsp + 0x290], 0
jne 0x1400396f0
jmp 0x1400397da
mov r15b, 1
lea rcx, [rsp + 0x280]
call fcn.1400138f0
and r15b, 1
lea rcx, [rsp + 0x2a0]
call fcn.14005cb50
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1400edc60
mov eax, r15d
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140039820
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rdi + 0x18], 7
jbe 0x14003983d
mov rdx, qword [rdi]
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x14003984a
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov bpl, 1
test eax, eax
jne 0x1400398ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140022010
mov r14d, eax
cmp qword [rbx + 0x18], 7
jbe 0x140039871
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 7
jbe 0x14003987b
mov rdi, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400398ba
test rsi, rsi
je 0x1400398b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140022010
cmp eax, 0xfffffffc
cmovne r14d, eax
mov dword [rsi], r14d
xor ebp, ebp
mov eax, ebp
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret