joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025170
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1a0], rbx
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [rsp + 0x40], r15d
mov eax, 2
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14009b190
mov r14, rax
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x50]
call fcn.1400b93c0
lea rcx, [rsp + 0x50]
call fcn.140026e60
nop
mov r9, r14
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400252b3
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
lea rdx, [0x1401016d4]
mov rcx, r14
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400252b3
mov rax, qword [rsp + 0x38]
movzx edx, word [rax + 0x12]
lea rcx, [rsp + 0x60]
call fcn.1400277e0
mov rcx, rax
lea rdx, [0x1400fdf74]
call fcn.140027c80
mov rax, qword [rsp + 0x38]
movzx edx, word [rax + 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400277e0
mov rcx, rax
lea rdx, [0x1400fdf74]
call fcn.140027c80
mov rax, qword [rsp + 0x38]
movzx edx, word [rax + 0x16]
lea rcx, [rsp + 0x60]
call fcn.1400277e0
mov rcx, rax
lea rdx, [0x1400fdf74]
call fcn.140027c80
mov rax, qword [rsp + 0x38]
movzx edx, word [rax + 0x14]
lea rcx, [rsp + 0x60]
call fcn.1400277e0
mov rcx, r14
call fcn.14009ab24
nop
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
mov dword [rsp + 0x20], 4
mov rcx, qword [rbp - 0x28]
test cl, 2
jne 0x1400252fe
mov rax, qword [rbp - 0x58]
mov r8, qword [rax]
test r8, r8
je 0x1400252fe
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x30]
cmovb r8, qword [rbp - 0x30]
sub r8, rdx
jmp 0x140025326
test cl, 4
jne 0x140025332
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax]
test rcx, rcx
je 0x140025332
mov rax, qword [rbp - 0x80]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x48]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
mov rcx, rsi
call fcn.14000e4f0
nop
lea rcx, [rsp + 0x50]
call fcn.140025370
mov rax, rsi
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14009ab00
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x160
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140049c20
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov eax, dword [0x14013fe74]
mov ebx, 0x80000000
cmp eax, ebx
jne 0x140049ce0
call fcn.140028770
cmp eax, 0xc
jl 0x140049cda
xor edx, edx
mov qword [rsp + 0x280], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140049cc8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140049cbf
lea rdx, str.ApplicationFrameHost.exe
lea rcx, [rsp + 0x4c]
call fcn.1400c1a28
test eax, eax
je 0x140049cbb
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140049c92
jmp 0x140049cbf
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x280]
mov eax, ebx
mov dword [0x14013fe74], ebx
jmp 0x140049ce0
mov eax, dword [0x14013fe74]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x270
pop rbx
ret

Function at 0x140049d00
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov eax, dword [0x14013fe6c]
mov ebx, 0x80000000
cmp eax, ebx
jne 0x140049da6
xor edx, edx
mov qword [rsp + 0x280], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140049d96
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140049d8d
lea rdx, str.System
lea rcx, [rsp + 0x4c]
call fcn.1400c1a28
test eax, eax
je 0x140049d89
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140049d60
jmp 0x140049d8d
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x280]
mov eax, ebx
mov dword [0x14013fe6c], ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x270
pop rbx
ret
Function at 0x140049dc0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov eax, dword [0x14013fe68]
mov ebx, 0x80000000
cmp eax, ebx
jne 0x140049e66
xor edx, edx
mov qword [rsp + 0x280], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140049e56
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140049e4d
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x4c]
call fcn.1400c1a28
test eax, eax
je 0x140049e49
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140049e20
jmp 0x140049e4d
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x280]
mov eax, ebx
mov dword [0x14013fe68], ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x270
pop rbx
ret

Function at 0x14004a4b0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x14004a270]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0xffffffffffffffff
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14004a50c
call fcn.14004a3d0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x48
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x48
ret
Function at 0x1400510d0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x8f0], rbx
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov esi, r15d
mov qword [rsp + 0x48], r15
mov r14d, send
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x38], sil
lea rdx, [rsp + 0x58]
test r8b, r8b
jne 0x140051142
add rcx, 0x1b0
call fcn.14007c100
mov rdi, rax
lea rax, [rsp + 0x38]
cmp rax, rdi
je 0x140051188
lea rcx, [rsp + 0x38]
call fcn.140007080
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], send
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov byte [rdi], 0
lea rcx, [rsp + 0x58]
call fcn.140007080
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x60]
call fcn.1400b93c0
lea rdx, [rbp - 0x60]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x7fe
ja 0x140051243
movdqa xmm0, xmmword [0x14010a4e0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400511e0
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.140007260
nop
lea rdx, [rsp + 0x38]
cmp r14, 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, rsi
lea rcx, [rsp + 0x58]
call fcn.1400073c0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbx + 0x10], xmm1
movdqa xmm0, xmmword [0x14010a4e0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
lea rcx, [rsp + 0x58]
jmp 0x140051324
lea rcx, [rsp + 0x78]
call fcn.140078430
nop
cmp qword [rbp - 0x78], 0
jne 0x140051277
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], send
mov byte [rsp + 0x38], 0
jmp 0x140051318
movdqa xmm0, xmmword [0x14010a4e0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov dword [rsp + 0x20], 2
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x58]
call fcn.140018630
mov r8d, 1
lea rdx, [0x1401000d8]
lea rcx, [rsp + 0x58]
call fcn.1400073c0
lea rdx, [rsp + 0x38]
cmp r14, 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, rsi
lea rcx, [rsp + 0x58]
call fcn.1400073c0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.1400073c0
nop
lea rcx, [rsp + 0x58]
call fcn.140007080
movups xmm0, xmmword [rsp + 0x78]
movups xmm1, xmmword [rbp - 0x78]
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], send
mov byte [rsp + 0x78], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
lea rcx, [rsp + 0x78]
call fcn.140007080
nop
lea rcx, [rsp + 0x38]
call fcn.140007080
mov rax, rbx
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.14009ab00
mov rbx, qword [rsp + 0x8f0]
add rsp, 0x8b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140052e40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov qword [rsp + 0x48], rdx
mov rsi, rcx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
movabs rdx, 0x100000001b3
movzx r8d, dil
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov rax, rdi
imul r8, rdx
shr rax, 8
movzx ecx, al
mov rax, rdi
xor r8, rcx
shr rax, 0x10
imul r8, rdx
movzx ecx, al
mov rax, rdi
xor r8, rcx
shr rax, 0x18
imul r8, rdx
movzx ecx, al
mov rax, rdi
xor r8, rcx
shr rax, 0x20
imul r8, rdx
movzx ecx, al
mov rax, rdi
xor r8, rcx
shr rax, 0x28
imul r8, rdx
movzx ecx, al
mov rax, rdi
xor r8, rcx
shr rax, 0x30
imul r8, rdx
movzx ecx, al
mov rax, rdi
xor r8, rcx
shr rax, 0x38
mov rcx, qword [rsi + 8]
imul r8, rdx
xor r8, rax
mov rax, qword [rsi + 0x30]
imul r8, rdx
mov rdx, qword [rsi + 0x18]
and rax, r8
mov rbx, rax
add rbx, rbx
add rax, rax
mov rbx, qword [rdx + rbx*8]
mov r8, qword [rdx + rax*8]
lea r9, [rdx + rax*8]
nop
cmp r8, rcx
jne 0x140052f3a
mov rax, rcx
jmp 0x140052f41
mov rax, qword [r9 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140052fe1
cmp qword [rbx + 0x10], rdi
je 0x140052f55
mov rbx, qword [rbx]
jmp 0x140052f30
cmp rbx, rcx
je 0x140052fe1
call fcn.1400973f0
mov rdi, rax
call fcn.1400973d4
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul r8, rcx, 0x3b9aca00
cqo
idiv rdi
add r8, rax
movabs rax, 0x431bde82d7b634db
imul r8
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbx + 0x28], rdx
mov eax, dword [rsp + 0x58]
cmp dword [rbx + 0x18], eax
jne 0x140052fd3
mov eax, dword [rsp + 0x5c]
cmp dword [rbx + 0x1c], eax
jne 0x140052fd3
mov eax, dword [rsp + 0x60]
cmp dword [rbx + 0x20], eax
jne 0x140052fd3
mov eax, dword [rsp + 0x64]
cmp dword [rbx + 0x24], eax
jne 0x140052fd3
xor al, al
jmp 0x14005309d
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx + 0x18], xmm0
jmp 0x14005309b
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400973f0
mov rbx, rax
call fcn.1400973d4
cqo
lea r9, [rsp + 0x48]
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul r8, rcx, 0x3b9aca00
cqo
idiv rbx
add r8, rax
movabs rax, 0x431bde82d7b634db
imul r8
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x40], rdx
mov rbx, qword [rax]
lea rax, [rsp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.140053bb0
mov rdx, rax
movabs rcx, 0x555555555555554
mov rax, qword [rsi + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400530bc
inc rax
mov rcx, rsi
mov qword [rsi + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
lea rdx, [rsp + 0x48]
mov r9, qword [rsi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140053810
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14009ab00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.140097de8
int3
Function at 0x140053bf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r9, rcx
movzx edx, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r8 + 0x11]
mov r10, qword [r9 + 0x30]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x13]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x14]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x15]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x16]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x17]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r9 + 0x18]
and r10, rdx
shl r10, 4
add rcx, r10
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140053cb4
cmp rax, r8
jne 0x140053caa
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [r10 + rcx + 8], rax
jmp 0x140053cbf
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x140053cbf
cmp rax, r8
jne 0x140053cbf
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rcx], rbx
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov edx, 0x30
dec qword [r9 + 0x10]
mov rcx, r8
call fcn.14009ab24
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140071930
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rdi, rdx
mov r9, rcx
movzx edx, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r8 + 0x11]
mov r10, qword [r9 + 0x30]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x13]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x14]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x15]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x16]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x17]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r9 + 0x18]
and r10, rdx
shl r10, 4
add rcx, r10
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140071a03
cmp rax, r8
jne 0x1400719f9
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [r10 + rcx + 8], rax
jmp 0x140071a0e
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x140071a0e
cmp rax, r8
jne 0x140071a0e
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rcx], rbx
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov edx, 0x18
dec qword [r9 + 0x10]
mov rcx, r8
call fcn.14009ab24
mov rax, rdi
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14009ab00
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140071b40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r14
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r9
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rcx
movzx ecx, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [r8 + 1]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 2]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 3]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 4]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 5]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 6]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 7]
xor rcx, rax
imul rcx, rdx
mov r9, qword [r14 + 0x30]
and r9, rcx
mov rbx, qword [r14 + 8]
mov rdx, r9
add rdx, rdx
mov rax, qword [r14 + 0x18]
mov rcx, qword [rax + rdx*8]
cmp rbx, rcx
je 0x140071c54
mov rbx, qword [rax + rdx*8 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rcx
je 0x140071c54
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x140071c10
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rdx], rcx
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rdx + 8], rcx
dec qword [r14 + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.14009ab24
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140071cab
mov rax, qword [rdi]
cmp rbx, rax
je 0x140071c89
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov r8, qword [rbx + 8]
mov rdx, qword [rax + 8]
mov qword [rbx + 8], rdx
mov rdx, qword [rdi + 8]
mov qword [rax + 8], rdx
mov qword [rdi + 8], r8
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call fcn.140071d90
nop
mov rcx, r14
call fcn.140071cd0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400788f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x58]
sub rsp, 0x150
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
cmp qword [rcx + 0x18], 8
jb 0x140078933
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140078a93
test al, 0x10
jne 0x140078a93
mov rdx, rbx
call fcn.140083d20
test al, al
jne 0x140078ab6
call fcn.140084bd0
cmp eax, 1
jl 0x140078a93
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x50]
call fcn.1400b93c0
lea rax, [0x1400fdef8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 1
lea rdi, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x2c], 0x78
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x28]
call fcn.1400075d0
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x50], rbx
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x4c], edx
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.140009f10
nop
lea rdx, str._screen_
lea rcx, [rsp + 0x50]
call fcn.14000ae60
mov rcx, rax
lea rdx, str.ScreenShareClient::verifyShareHost__failed__invalid_signature
call fcn.14000ae60
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140009e60
nop
lea rdx, [rsp + 0x30]
mov ecx, 1
call fcn.140084ea0
nop
lea rcx, [rsp + 0x30]
call fcn.140007080
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x50], rbx
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x58]
call fcn.140008ea0
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x50], rdi
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x4c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.140097eb0
nop
xor al, al
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14009ab00
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov al, 1
jmp 0x140078a95
Function at 0x140084be0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov ebx, ecx
mov dword [rsp + 0x20], 0
mov r8d, 1
cmp ecx, 5
jle 0x140084c2a
lea ebx, [r8 + 4]
jmp 0x140084c31
cmp ebx, r8d
cmovl ebx, r8d
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.14006abc0
nop
movsxd rdx, ebx
lea rax, section..data
mov rdx, qword [rax + rdx*8]
lea rcx, [rsp + 0x40]
call fcn.14000ae60
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
lea rdx, [0x1400e8e90]
lea rcx, [rsp + 0x40]
call fcn.14000ae60
mov rcx, rax
mov edx, ebx
call fcn.14000e310
mov rcx, rax
lea rdx, [0x140101354]
call fcn.14000ae60
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x140084c99
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.14000e8c0
mov rcx, rax
mov dl, 0xa
call fcn.14001d0e0
nop
movdqa xmm0, xmmword [0x14010a4e0]
movdqu xmmword [rsp + 0x140], xmm0
mov byte [rsp + 0x130], 0
mov dword [rsp + 0x20], 2
mov rcx, qword [rsp + 0xb8]
test cl, 2
jne 0x140084d0b
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
test r8, r8
je 0x140084d0b
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xb0]
cmovb r8, qword [rsp + 0xb0]
sub r8, rdx
jmp 0x140084d39
test cl, 4
jne 0x140084d47
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
test rcx, rcx
je 0x140084d47
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x98]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
lea rcx, [rsp + 0x130]
call fcn.140007260
nop
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 0x10
cmovae rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x148]
cmp rdx, 0x10
jb 0x140084da7
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084da1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140084dd2
call fcn.14009ab24
nop
lea rcx, [rsp + 0x30]
call fcn.140064490
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14009ab00
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
call fcn.1400bcf00
nop
int3
sub rsp, 0x28
mov eax, ecx
mov rcx, qword [0x14014a508]
test rcx, rcx
je 0x140084ec9
mov dword [rsp + 0x40], eax
mov r8, rdx
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
add rsp, 0x28
ret
mov ecx, eax
add rsp, 0x28
jmp 0x140084be0