joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c54a0
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x298
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, r9
mov r13, r8
mov r14, rdx
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov rdx, qword [rcx + 0x48]
test rdx, rdx
jne 0x1400c54f8
mov rdx, qword [rcx + 0x40]
add rcx, 0x40
call fcn.1400c5770
mov rdx, qword [r15 + 0x48]
mov rax, r14
shr rax, 0x21
xor rax, r14
movabs rcx, 0xff51afd7ed558ccd
imul rax, rcx
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
movabs rax, 0xc4ceb9fe1a85ec53
imul rcx, rax
mov rax, rcx
shr rax, 0x21
xor rcx, rax
mov rax, qword [r15 + 0x40]
dec rax
and rax, rcx
lea rbp, [rdx + rax*8]
mov rcx, rbp
mov rax, qword [rbp]
test rax, rax
je 0x1400c5561
nop dword [rax]
cmp r14, qword [rax + 8]
je 0x1400c5561
mov rcx, rax
mov rax, qword [rax]
test rax, rax
jne 0x1400c5550
mov rsi, qword [rcx]
test rsi, rsi
jne 0x1400c55a6
call fcn.1400ecae0
mov r9, qword [rax]
lea edx, [rsi + 0x18]
lea r8d, [rsi + 0x10]
mov rcx, rax
call qword [r9 + 8]
mov rsi, rax
mov rdx, qword [rbp]
mov qword [rax], rdx
mov qword [rax + 8], r14
mov qword [rax + 0x10], 0
mov qword [rbp], rax
inc qword [r15 + 0x50]
lea rcx, [r15 + 0x40]
call fcn.1400c56f0
mov r12, qword [rsi + 0x10]
mov rcx, qword [r15 + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
xor edi, edi
mov dword [rsp + 0x20], edi
lea r9d, [rdi + 4]
xor r8d, r8d
mov rdx, r12
call qword [rax + 0x70]
test eax, eax
jns 0x1400c5641
mov qword [rsp + 0x40], rdi
lea rax, str._TextureFactory_:_Failed_to_map_shared_texture.
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x200
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], 3
lea rax, str.BNL_Browser
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rdx, [0x140164ba1]
lea rcx, [rsp + 0x40]
call fcn.1400e9b00
nop
lea rcx, [rsp + 0x40]
call fcn.1400e9e30
nop
lea rcx, [rsp + 0x40]
call fcn.1400e8d90
nop
xor al, al
jmp 0x1400c56c0
mov ecx, dword [rsp + 0x2fc]
lea eax, [rcx - 1]
imul eax, ebx
shl eax, 2
movsxd rdi, eax
add rdi, r13
mov rsi, qword [rsp + 0x30]
test ecx, ecx
jle 0x1400c568e
lea eax, [rbx*4]
movsxd rbx, eax
mov ebp, ecx
nop dword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14012aeb0
sub rdi, rbx
mov eax, dword [rsp + 0x38]
add rsi, rax
sub rbp, 1
jne 0x1400c5670
mov rcx, qword [r15 + 0x38]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, r12
call qword [rax + 0x78]
mov rcx, qword [r15 + 0x38]
mov rax, qword [rcx]
mov r8, r12
mov rdx, r14
call qword [rax + 0x178]
mov rcx, qword [r15 + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x378]
mov al, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140128f20
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c5770
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov r8, rdx
mov rcx, qword [rcx + 0x10]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400c5793
cvtsi2ss xmm1, rcx
jmp 0x1400c57a8
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
movss xmm3, dword [rdi + 0x18]
movaps xmm0, xmm1
movss xmm2, dword [0x140166410]
xor eax, eax
divss xmm0, xmm3
comiss xmm0, xmm2
jb 0x1400c57d9
subss xmm0, xmm2
comiss xmm0, xmm2
jae 0x1400c57d9
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttss2si rdx, xmm0
xorps xmm0, xmm0
add rdx, rax
js 0x1400c57ed
cvtsi2ss xmm0, rdx
jmp 0x1400c5805
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mulss xmm0, xmm3
lea rax, [rdx + 1]
mov ebx, 8
comiss xmm1, xmm0
cmovbe rax, rdx
cmp rax, r8
cmovb rax, r8
cmp rbx, rax
jae 0x1400c582d
add rbx, rbx
cmp rbx, rax
jb 0x1400c5825
cmp rbx, qword [rdi]
jne 0x1400c583d
cmp qword [rdi + 8], 0
jne 0x1400c5948
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r14
call fcn.1400ecae0
lea rsi, [rbx*8]
mov r8d, 0x10
mov rdx, rsi
mov rcx, rax
mov r9, qword [rax]
call qword [r9 + 8]
mov r14, rax
test rbx, rbx
je 0x1400c5880
and rsi, 0xfffffffffffffff8
xor edx, edx
mov r8, rsi
mov rcx, rax
call fcn.14012b560
mov rax, qword [rdi + 8]
mov rsi, rax
test rax, rax
je 0x1400c5925
xor r9d, r9d
cmp qword [rdi], r9
jbe 0x1400c5925
mov qword [rsp + 0x30], rbp
movabs r11, 0xff51afd7ed558ccd
movabs rbp, 0xc4ceb9fe1a85ec53
nop word [rax + rax]
mov r8, qword [rax + r9*8]
mov rsi, rax
test r8, r8
je 0x1400c5918
lea r10, [rbx - 1]
mov rcx, qword [r8 + 8]
shr rcx, 0x21
xor rcx, qword [r8 + 8]
imul rcx, r11
mov rax, rcx
shr rax, 0x21
xor rax, rcx
mov rcx, qword [r8]
imul rax, rbp
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
and rdx, r10
mov rax, qword [r14 + rdx*8]
mov qword [r8], rax
mov qword [r14 + rdx*8], r8
mov r8, rcx
test rcx, rcx
jne 0x1400c58d0
mov rax, qword [rdi + 8]
mov rsi, rax
inc r9
cmp r9, qword [rdi]
jb 0x1400c58c0
mov rbp, qword [rsp + 0x30]
call fcn.1400ecae0
mov rdx, rsi
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x20]
mov rsi, qword [rsp + 0x38]
mov qword [rdi + 8], r14
mov r14, qword [rsp + 0x40]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e5f90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.1401296e0
sub rsp, rax
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rbp + 0xfc0], rax
mov rsi, rdx
mov r14, rcx
xor edi, edi
mov ebx, edi
nop dword [rax]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, 0x10000
lea rdx, [0x1401e07e0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e6003
mov eax, dword [rsp + 0x30]
add ebx, eax
test eax, eax
jne 0x1400e5fd0
jmp 0x1400e61c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov qword [rbp - 0x70], rdi
lea rax, str.failed_to_read__s_with_error__d__offset__d
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x200
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x48], 4
lea r15, str.Shmem
mov qword [rbp - 0x40], r15
xor r8d, r8d
lea rdx, [0x140164ba1]
lea rcx, [rbp - 0x70]
call fcn.1400e9b00
nop
mov rdx, r14
lea rcx, [rbp - 0x70]
call fcn.1400e8c30
mov rcx, rax
mov edx, esi
call fcn.1400e8b10
mov rcx, rax
mov edx, ebx
call fcn.1400e8b10
nop
lea rcx, [rbp - 0x70]
call fcn.1400e9e30
nop
lea rcx, [rbp - 0x70]
call fcn.1400e8d90
nop
mov qword [rbp - 0x70], rdi
lea rax, str.binderror_s_s
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x44]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x1000
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x48], 4
xor r9d, r9d
lea r8, [0x140164ba1]
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.1400e9a20
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
lea rbx, str._s_s
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
lea rcx, [rbp - 0x70]
call fcn.1400e8e20
mov rcx, qword [rbp - 0x60]
add rcx, qword [rbp - 0x50]
mov qword [rsp + 0x48], rcx
mov rax, qword [rbp - 0x58]
sub rax, qword [rbp - 0x50]
mov qword [rsp + 0x50], rax
lea rdx, str.errno
lea rcx, [rsp + 0x38]
call fcn.1400e8c30
mov rcx, rax
mov edx, esi
call fcn.1400e8b10
nop
lea rcx, [rsp + 0x38]
call fcn.1400e8d90
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
lea rcx, [rbp - 0x70]
call fcn.1400e8e20
mov rcx, qword [rbp - 0x60]
add rcx, qword [rbp - 0x50]
mov qword [rsp + 0x70], rcx
mov rax, qword [rbp - 0x58]
sub rax, qword [rbp - 0x50]
mov qword [rsp + 0x78], rax
lea rdx, str.name
lea rcx, [rsp + 0x60]
call fcn.1400e8c30
mov rcx, rax
mov rdx, r14
call fcn.1400e8c30
nop
lea rcx, [rsp + 0x60]
call fcn.1400e8d90
nop
lea rcx, [rbp - 0x70]
call fcn.1400e9d60
nop
lea rcx, [rbp - 0x70]
call fcn.1400e8d90
nop
cmp esi, 0x17
je 0x1400e61c5
cmp esi, 0x45d
je 0x1400e61c5
cmp esi, 2
jne 0x1400e61c7
mov edi, esi
mov eax, edi
mov rcx, qword [rbp + 0xfc0]
xor rcx, rsp
call fcn.140128f20
mov rbx, qword [rsp + 0x1110]
add rsp, 0x10d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e8850
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xc80
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0xc70], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x650]
mov r8d, 0x618
mov edi, 1
call fcn.14012b560
lea rax, [rsp + 0x650]
mov dword [rsp + 0x28], 0x30c
lea r9d, [rdi - 2]
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r9d, r9d
lea r8, [rsp + 0x30]
mov edx, 0x30c
lea rcx, [rsp + 0x650]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 0x30c
ja 0x1400e894a
lea edx, [rdi + 0x5b]
lea rcx, [rsp + 0x30]
call fcn.14012bee4
test rax, rax
je 0x1400e894a
xor ecx, ecx
mov word [rax + 2], cx
cmp word [rsp + 0x30], 0x5c
jne 0x1400e890b
cmp word [rsp + 0x32], 0x5c
jne 0x1400e890b
cmp word [rsp + 0x34], cx
jne 0x1400e890b
lea eax, [rdi + 1]
jmp 0x1400e894c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jb 0x1400e894a
sub eax, 2
je 0x1400e8945
sub eax, edi
je 0x1400e893e
sub eax, edi
je 0x1400e8937
sub eax, edi
je 0x1400e8945
cmp eax, edi
jne 0x1400e894a
mov edi, 5
jmp 0x1400e894a
mov edi, 2
jmp 0x1400e894a
mov edi, 3
jmp 0x1400e894a
mov edi, 4
mov eax, edi
mov rcx, qword [rsp + 0xc70]
xor rcx, rsp
call fcn.140128f20
mov rbx, qword [rsp + 0xc98]
add rsp, 0xc80
pop rdi
ret

Function at 0x1400ea2b0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8d, 0x104
lea rdx, [rsp + 0x20]
call fcn.1400eaac0
test eax, eax
jg 0x1400ea305
call fcn.140140b10
mov dword [rax], 0x26
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140128f20
add rsp, 0x248
ret
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x240], rbx
call fcn.140148130
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400ea365
call fcn.140140b10
cmp dword [rax], 2
je 0x1400ea38c
call fcn.140140b10
cmp dword [rax], 0x14
je 0x1400ea38c
call fcn.140140b10
cmp dword [rax], 0x11
je 0x1400ea38c
mov eax, 1
lock xadd qword [0x1401f0810], rax
mov ecx, 0xf4240
call fcn.1400edb80
lea rcx, [rsp + 0x20]
call fcn.140148130
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400ea38c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ea38c
bt eax, 0xd
jb 0x1400ea38c
bts eax, 0xd
lea rcx, [rsp + 0x20]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
mov rbx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140128f20
add rsp, 0x248
ret
Function at 0x1400ea3b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebp, r8d
mov esi, edx
mov r8d, 0x104
lea rdx, [rsp + 0x40]
call fcn.1400eaac0
test eax, eax
jg 0x1400ea3fb
call fcn.140140b10
mov dword [rax], 0x26
mov eax, 0xffffffff
jmp 0x1400ea4e3
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8d, 0x40
mov qword [rsp + 0x298], rbx
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.1401471d0
mov ebx, dword [rsp + 0x30]
test eax, eax
mov edi, 0xffffffff
cmovne ebx, edi
cmp ebx, edi
jne 0x1400ea4ac
call fcn.140140b10
cmp dword [rax], 2
je 0x1400ea4d9
call fcn.140140b10
cmp dword [rax], 0x14
je 0x1400ea4d9
call fcn.140140b10
cmp dword [rax], 0x11
je 0x1400ea4d9
mov eax, 1
lock xadd qword [0x1401f0810], rax
mov ecx, 0x989680
call fcn.1400edb80
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0
mov r9d, ebp
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 0x41]
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.1401471d0
mov ebx, dword [rsp + 0x30]
test eax, eax
cmovne ebx, edi
cmp ebx, edi
je 0x1400ea4d9
bt esi, 8
jae 0x1400ea4d9
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ea4d9
bt eax, 0xd
jb 0x1400ea4d9
bts eax, 0xd
lea rcx, [rsp + 0x40]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
mov rbx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140128f20
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ea930
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r8d, 0x104
lea rdx, [rsp + 0x260]
call fcn.1400eaac0
test eax, eax
jg 0x1400ea977
call fcn.140140b10
mov dword [rax], 0x26
mov eax, 0xffffffff
jmp 0x1400eaa8c
lea rcx, [rsp + 0x260]
call fcn.1401466f8
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400eaa8a
call fcn.140140b10
cmp dword [rax], 0xd
jne 0x1400eaa4f
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov edx, eax
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400ea9d3
lea rcx, [rsp + 0x260]
call fcn.1401466f8
mov ebx, eax
jmp 0x1400eaa4f
xor ecx, ecx
mov qword [rsp + 0x20], rcx
lea rax, str.Removing_READ_ONLY_attribute_failed_with_error_code:__d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x200
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], 4
lea rax, str.FileIO
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea rdx, [0x140164ba1]
lea rcx, [rsp + 0x20]
call fcn.1400e9b00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400e8a20
nop
lea rcx, [rsp + 0x20]
call fcn.1400e9e30
nop
lea rcx, [rsp + 0x20]
call fcn.1400e8d90
nop
call fcn.140140b10
cmp dword [rax], 2
je 0x1400eaa8a
call fcn.140140b10
cmp dword [rax], 0x14
je 0x1400eaa8a
mov eax, 1
lock xadd qword [0x1401f0810], rax
mov ecx, 0x989680
call fcn.1400edb80
lea rcx, [rsp + 0x260]
call fcn.1401466f8
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140128f20
add rsp, 0x480
pop rbx
ret
Function at 0x1400edbc0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r10, r8
mov r11d, r9d
shr r10, 4
mov rbx, rdx
mov r9d, r9d
mov rdi, rcx
movabs rsi, 0x87c37b91114253d5
movabs rbp, 0x4cf5ad432745937f
test r10, r10
je 0x1400edc62
mov rcx, r10
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx]
lea rdx, [rdx + 0x10]
imul rax, rsi
rol rax, 0x1f
imul rax, rbp
xor rax, r11
rol rax, 0x1b
add rax, r9
lea r11, [rax*4 + 0x52dce729]
add r11, rax
mov rax, qword [rdx - 8]
imul rax, rbp
ror rax, 0x1f
imul rax, rsi
xor rax, r9
rol rax, 0x1f
add rax, 0xb41def1
add rax, r11
lea r9, [rax + rax*4]
sub rcx, 1
jne 0x1400edc10
shl r10, 4
mov rcx, r8
add r10, rbx
and ecx, 0xf
xor eax, eax
dec rcx
cmp rcx, 0xe
ja case.default.0x1400edc8f
lea rdx, [0x140000000]
mov ecx, dword [rdx + rcx*4 + 0xedde4]
add rcx, rdx
jmp rcx
movzx eax, byte [r10 + 0xe]
shl rax, 0x30
movzx ecx, byte [r10 + 0xd]
shl rcx, 0x28
xor rax, rcx
movzx ecx, byte [r10 + 0xc]
shl rcx, 0x20
xor rax, rcx
movzx ecx, byte [r10 + 0xb]
shl rcx, 0x18
xor rax, rcx
movzx ecx, byte [r10 + 0xa]
shl rcx, 0x10
xor rax, rcx
movzx ecx, byte [r10 + 9]
shl rcx, 8
xor rax, rcx
movzx ecx, byte [r10 + 8]
xor rcx, rax
imul rcx, rbp
ror rcx, 0x1f
imul rcx, rsi
xor r9, rcx
movzx eax, byte [r10 + 7]
shl rax, 0x38
movzx ecx, byte [r10 + 6]
shl rcx, 0x30
xor rax, rcx
movzx ecx, byte [r10 + 5]
shl rcx, 0x28
xor rax, rcx
movzx ecx, byte [r10 + 4]
shl rcx, 0x20
xor rax, rcx
movzx ecx, byte [r10 + 3]
shl rcx, 0x18
xor rax, rcx
movzx ecx, byte [r10 + 2]
shl rcx, 0x10
xor rax, rcx
movzx ecx, byte [r10 + 1]
shl rcx, 8
xor rax, rcx
movzx ecx, byte [r10]
xor rcx, rax
imul rcx, rsi
rol rcx, 0x1f
imul rcx, rbp
xor r11, rcx
mov rbx, qword [rsp + 8]
xor r9, r8
mov rbp, qword [rsp + 0x10]
xor r11, r8
mov rsi, qword [rsp + 0x18]
add r11, r9
movabs r10, 0xff51afd7ed558ccd
mov rax, r11
shr rax, 0x21
movabs r8, 0xc4ceb9fe1a85ec53
xor rax, r11
imul rax, r10
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
lea rax, [r9 + r11]
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
imul rcx, r10
imul rdx, r8
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, r8
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
mov rax, rdx
shr rax, 0x21
xor rax, rdx
add rax, rcx
mov qword [rdi], rax
add rax, rcx
mov qword [rdi + 8], rax
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400efc80
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x540
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov r14, r9
mov dword [rsp + 0x80], 0x100001
mov rbp, r8
mov r15, rdx
mov ebx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, ebx
jne 0x1400efdba
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov qword [rsp + 0x538], rsi
lea rdx, [rsp + 0x20]
mov rsi, qword [rsp + 0xe8]
mov r8d, 0x30
mov rcx, rsi
mov qword [r14], rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400efd77
cmp dword [rsp + 0x40], 0x1000
jne 0x1400efd77
cmp dword [rsp + 0x48], 0x20000
jne 0x1400efd77
cmp dword [rsp + 0x44], 4
jne 0x1400efd77
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
cmp rbx, rsi
jbe 0x1400efd77
mov rsi, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400efd77
cmp dword [rsp + 0x48], 0x20000
jne 0x1400efd77
cmp qword [rsp + 0x20], rsi
jne 0x1400efd77
mov rcx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
add rcx, rsi
cmp eax, 0x1000
jne 0x1400efe0a
cmp rcx, rbx
je 0x1400efe1e
xor bl, bl
mov rsi, qword [rsp + 0x538]
test rdi, rdi
je 0x1400efd98
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.140128f20
add rsp, 0x540
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 0x4a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1400efe06
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rdi
cmp eax, 0xffffffff
je 0x1400efe00
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1400efcd2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400efd9b
cmp eax, 0x2000
jne 0x1400efd77
cmp rcx, rbx
jae 0x1400efd77
mov qword [rbp], rbx
sub rbx, qword [rsp + 0x28]
mov qword [r15], rbx
mov bl, 1
jmp 0x1400efd79

Function at 0x1400efe60
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400f08f0
Capabilities:
Enumerate threads

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1401ce8a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rdx
mov dword [rsp + 0x50], 0x1c
xor edx, edx
mov rbp, rcx
xorps xmm0, xmm0
xor r15d, r15d
mov esi, r8d
mov qword [rsp + 0x64], r15
movdqu xmmword [rsp + 0x54], xmm0
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400f09cf
mov qword [rsp + 0xc0], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov edi, eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1400f09be
cmp dword [rsp + 0x5c], edi
jne 0x1400f09ad
mov ecx, dword [rsp + 0x58]
cmp ecx, esi
je 0x1400f09ad
mov dword [rsp + 0x48], r15d
mov r9, r14
mov dword [rsp + 0x40], r15d
mov r8, rbp
mov qword [rsp + 0x38], r15
xor edx, edx
mov dword [rsp + 0x30], r15d
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.1400f11a0
lea rdx, [0x1401761d4]
mov rcx, r14
call rbp
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1400f0968
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140128f20
add rsp, 0x80
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400f2970
Capabilities:
Create thread

Disassembly:
jmp 0x1400f2970
sub rsp, 0x38
lea rcx, [0x1402180d0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140218188]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x1402181b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1402181b8], rax
xor r9d, r9d
lea r8, [0x1400f2df0]
mov edx, 0x40000
lea rax, [0x1402180c8]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402180c0], rax
call fcn.1400efe40
test al, al
sete byte [0x1402180cd]
add rsp, 0x38
ret
Function at 0x1400f2a10
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x1402180f8], 0
je 0x1400f2a25
mov al, 1
add rsp, 0x28
ret
lea rcx, str.DbgHelp.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400f2c66
lea rdx, str.EnumerateLoadedModulesW64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218100], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.StackWalk64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218108], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218110], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymGetLineFromAddrW64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218118], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218120], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymGetModuleInfoW64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218128], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymGetOptions
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218130], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymGetSymFromAddr64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218138], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymInitializeW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218140], rax
test rax, rax
je 0x1400f2c5d
lea rdx, [0x14017da20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218148], rax
test rax, rax
je 0x1400f2c5d
lea rdx, [0x14017da30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218150], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymEnumerateModulesW64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218158], rax
test rax, rax
je 0x1400f2c5d
lea rdx, [0x140164be0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218160], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymFindFileInPathW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218168], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymLoadModuleExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218170], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.SymUnloadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218178], rax
test rax, rax
je 0x1400f2c5d
lea rdx, str.MiniDumpWriteDump
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140218180], rax
mov al, 1
mov qword [0x1402180f8], rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x20]
xor al, al
add rsp, 0x28
ret