joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402eb590
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea r15, [rcx + 0x1d0]
mov rsi, rcx
mov rcx, r15
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
movdqa xmm0, xmmword [0x140420310]
lea rdx, [0x1403cb630]
xor r12d, r12d
lea rcx, [rbp - 0x49]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x49], r12w
call fcn.140055574
lea rdx, [rsi + 8]
lea r9d, [r12 + 3]
lea r8, [rbp - 0x49]
call fcn.1402eb94c
lea rcx, [rbp - 0x49]
mov dil, al
call fcn.140055f70
movdqa xmm0, xmmword [0x140420310]
lea rdx, [0x1403cb630]
lea rcx, [rbp - 0x49]
mov word [rbp - 0x49], r12w
movdqu xmmword [rbp - 0x39], xmm0
call fcn.140055574
lea rdx, [rsi + 0x28]
lea r9d, [r12 + 2]
lea r8, [rbp - 0x49]
call fcn.1402eb94c
lea rcx, [rbp - 0x49]
mov bl, al
call fcn.140055f70
mov rcx, rsi
call fcn.1402eb814
mov r14b, al
mov rcx, rsi
and r14b, bl
and r14b, dil
call fcn.1402ebbfc
mov rcx, rsi
and r14b, al
call fcn.1402ebf10
movdqa xmm0, xmmword [0x140420310]
lea rdx, str.SoftwareMicrosoftSqmClient
lea rcx, [rbp - 0x29]
mov word [rbp - 0x29], r12w
movdqu xmmword [rbp - 0x19], xmm0
lea rbx, [rsi + 0x118]
call fcn.140055574
movdqa xmm0, xmmword [0x140420310]
lea rcx, [rbp + 7]
mov rdx, qword [rsi + 0x1e0]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r12w
call fcn.140055574
movups xmm0, xmmword [0x1403c5200]
lea r9, [rbp - 0x29]
lea r8, [rbp - 0x59]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x49]
movdqu xmmword [rbp - 0x59], xmm0
call fcn.1402060e8
lea rcx, [rbp + 7]
movups xmm0, xmmword [rax]
movdqu xmmword [rbx], xmm0
call fcn.140055f70
lea rcx, [rbp - 0x29]
call fcn.140055f70
mov rax, qword [0x1403c5200]
cmp rax, qword [rbx]
jne 0x1402eb72b
mov rax, qword [0x1403c5208]
cmp rax, qword [rbx + 8]
jne 0x1402eb72b
lea rdx, [rbp - 0x69]
mov dword [rbp - 0x69], r12d
call fcn.1402eccd4
mov dil, r12b
jmp 0x1402eb779
mov rdx, rbx
lea rcx, [rbp - 0x29]
mov dil, 1
call fcn.1400cc2d0
lea rbx, [rsi + 0x128]
mov rdx, rax
mov rcx, rbx
call fcn.140085570
lea rcx, [rbp - 0x29]
call fcn.140055f70
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14008cc40
lea rcx, [rsi + 0x148]
mov rdx, rax
call fcn.140096848
lea rcx, [rbp - 0x29]
call fcn.14007269c
mov rcx, rsi
call fcn.1402ec168
and al, dil
mov rcx, rsi
and r14b, al
call fcn.1402ec3fc
mov rcx, rsi
and r14b, al
call fcn.1402ec664
mov rcx, rsi
and r14b, al
call fcn.1402ec8b8
mov bl, al
mov dword [rsi + 0x1c0], 1
lea rcx, [rbp - 0x29]
and bl, r14b
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
movzx edx, word [rbp - 0x29]
mov word [rsi + 0x1c4], dx
test r15, r15
je 0x1402eb7e3
mov rcx, r15
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
mov al, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 8]
jmp 0x1402eb590
Function at 0x1402ec3fc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x118
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x1402ec57d
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x48]
movzx r9d, word [rbp + 0x56]
movzx r8d, word [rbp + 0x54]
and dword [rsp + 0x3c], 0
mov dword [rbx + 0x1a8], eax
mov al, byte [rbp + 0x5a]
mov byte [rbx + 0x1b4], al
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x1ac], ecx
mov dword [rbx + 0x1b0], edx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
nop dword [rax + rax]
test eax, eax
je 0x1402ec4ba
mov eax, dword [rsp + 0x3c]
mov qword [rbx + 0x1b8], rax
mov al, 1
jmp 0x1402ec63d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
call fcn.1400550c0
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1402ec56e
mov ecx, dword [rsp + 0x30]
movzx eax, cx
or eax, 0x80070000
mov dword [rbp + 0x98], 0x3e
test ecx, ecx
cmovle eax, ecx
and dword [rbp + 0x8c], 0
and dword [rbp + 0x9c], 0
lea rcx, str.Failed_getting_OS_product_info
and dword [rbp + 0xac], 0
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x38]
mov qword [rbp + 0x80], rax
mov eax, 4
mov qword [rbp + 0x90], rcx
lea rcx, [rsp + 0x30]
mov dword [rbp + 0x88], eax
mov dword [rbp + 0xa8], eax
mov qword [rbp + 0xa0], rcx
lea rax, [rbp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14048b4af]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001208
lea rdx, [rsp + 0x30]
call fcn.1402ece5c
jmp 0x1402ec63b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x34], eax
call fcn.1400550c0
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1402ec631
mov ecx, dword [rsp + 0x34]
movzx eax, cx
or eax, 0x80070000
mov dword [rbp + 0x98], 0x3e
test ecx, ecx
cmovle eax, ecx
and dword [rbp + 0x8c], 0
and dword [rbp + 0x9c], 0
lea rcx, str.Failed_getting_OS_version_info
and dword [rbp + 0xac], 0
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x38]
mov qword [rbp + 0x80], rax
mov eax, 4
mov qword [rbp + 0x90], rcx
lea rcx, [rsp + 0x34]
mov dword [rbp + 0x88], eax
mov dword [rbp + 0xa8], eax
mov qword [rbp + 0xa0], rcx
lea rax, [rbp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14048b4af]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001208
lea rdx, [rsp + 0x34]
call fcn.1402ecf20
xor al, al
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140356560
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1c0
pop rbp
ret
Function at 0x1402ec664
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x48]
sub rsp, 0x140
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x30], rax
movdqa xmm0, xmmword [0x140420310]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rbx, rcx
xor esi, esi
lea rcx, [rbp - 0x60]
mov word [rbp - 0x60], si
movdqu xmmword [rbp - 0x50], xmm0
call fcn.140055574
movdqa xmm0, xmmword [0x140420310]
lea rdi, str.UNKNOWN
mov rdx, rdi
mov word [rbp - 0x80], si
lea rcx, [rbp - 0x80]
movdqu xmmword [rbp - 0x70], xmm0
call fcn.140055574
movdqa xmm0, xmmword [0x140420310]
lea rdx, str.ReleaseId
lea rcx, [rsp + 0x60]
mov word [rsp + 0x60], si
movdqu xmmword [rsp + 0x70], xmm0
call fcn.140055574
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], 0xffffffff80000002
mov dword [rsp + 0x30], 0x4000000
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.14020500c
add rbx, 0x188
mov rdx, rax
mov rcx, rbx
call fcn.140085570
lea rcx, [rbp - 0x40]
call fcn.140055f70
lea rcx, [rsp + 0x60]
call fcn.140055f70
lea rcx, [rbp - 0x80]
call fcn.140055f70
lea rcx, [rbp - 0x60]
call fcn.140055f70
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x1402ec770
mov rdx, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov r10d, 7
cmp rcx, r10
mov eax, esi
cmova rcx, r10
test rcx, rcx
je 0x1402ec7c6
movzx r8d, word [rdx]
movzx r9d, word [str.UNKNOWN]
cmp r8w, r9w
jb 0x1402ec7c3
sub rdx, rdi
cmp r8w, r9w
ja 0x1402ec87f
cmp rcx, 1
je 0x1402ec7c6
add rdi, 2
dec rcx
movzx r8d, word [rdx + rdi]
movzx r9d, word [rdi]
cmp r8w, r9w
jae 0x1402ec7a1
or eax, 0xffffffff
test eax, eax
jne 0x1402ec889
cmp qword [rbx + 0x10], r10
jne 0x1402ec889
mov eax, esi
test eax, eax
jne 0x1402ec889
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x54], eax
call fcn.1400550c0
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1402ec871
mov ecx, dword [rsp + 0x54]
movzx eax, cx
or eax, 0x80070000
mov qword [rbp + 8], 4
test ecx, ecx
mov qword [rbp + 0x18], 0x3a
mov qword [rbp + 0x28], 4
cmovle eax, ecx
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov qword [rbp], rax
lea rax, str.Failed_getting_OS_release_ID
mov qword [rbp + 0x10], rax
lea rax, [rsp + 0x54]
mov qword [rbp + 0x20], rax
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14048b4af]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001208
lea rdx, [rsp + 0x54]
call fcn.1402ecfe4
xor al, al
jmp 0x1402ec88b
mov eax, 1
jmp 0x1402ec7c6
mov al, 1
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402f41f4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x390
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov r15, rdx
mov r14, rcx
mov rax, qword [rcx + 0x10]
mov esi, dword [rax + 0x10]
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.1401b70f8
nop
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp + 0x40], xmm0
xor r12d, r12d
mov word [rbp + 0x30], r12w
mov edx, 0x104
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.14019d698
lea rdx, [0x1403ce9d8]
mov rcx, rax
call fcn.14019d698
lea rdx, str.Driversmssecflt.sys
mov rcx, rax
call fcn.14019d698
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.14019c844
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140085570
lea rcx, [rbp + 0x50]
call fcn.140055f70
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x50]
mov rcx, r14
call fcn.1402f5960
lea rcx, [r15 + 0x50]
mov rdx, rax
call fcn.140096848
lea rcx, [rbp + 0x50]
call fcn.14007269c
nop
lea rcx, [rbp + 0x30]
call fcn.140055f70
nop
lea rcx, [rbp - 0x38]
call fcn.1401b7070
lea rcx, [rbp - 0x38]
call qword [sym.imp.msvcp_win.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop dword [rax + rax]
mov dword [rsp + 0x20], r12d
mov rdi, qword [r14]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x58]
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r12w
lea rdx, [0x1403c6910]
lea rcx, [rbp + 0x30]
call fcn.140055574
nop
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x30]
mov rcx, rdi
mov rax, rbx
call qword [str.p76_]
test al, al
sete bl
lea rcx, [rbp + 0x30]
call fcn.140055f70
mov eax, dword [rsp + 0x20]
lea ecx, [r12 + 1]
test bl, bl
cmovne eax, ecx
mov dword [rsp + 0x20], eax
mov dword [r15 + 0xd4], eax
mov rcx, qword [r14]
mov rax, qword [rcx]
lea rdx, [rbp + 0x50]
mov rax, qword [rax + 0x80]
call qword [str.p76_]
lea rcx, [r15 + 0x10]
mov rdx, rax
call fcn.140085570
lea rcx, [rbp + 0x50]
call fcn.140055f70
mov dword [rsp + 0x24], r12d
mov rdi, qword [r14]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x58]
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r12w
lea rdx, [0x1403c68e0]
lea rcx, [rbp + 0x30]
call fcn.140055574
nop
lea r8, [rsp + 0x24]
lea rdx, [rbp + 0x30]
mov rcx, rdi
mov rax, rbx
call qword [str.p76_]
nop
lea rcx, [rbp + 0x30]
call fcn.140055f70
mov eax, dword [rsp + 0x24]
mov dword [r15 + 0xd8], eax
mov r8d, esi
mov rdx, r15
mov rcx, r14
call fcn.1402f4ddc
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1402f91ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov rdx, qword [rsi + 0x10]
jb 0x1402f921f
mov r9, qword [rsi]
add rdx, rdx
xor r11d, r11d
movabs rax, 0xcbf29ce484222325
mov r10, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, r11
test rdx, rdx
je 0x1402f9265
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x1402f9242
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1402f929d
cmp qword [rcx + rdx*8], rdi
jne 0x1402f9292
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1402f9296
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1402f92aa
cmp qword [rcx + rdx*8], rdi
jne 0x1402f92aa
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140063f3c
mov rcx, rsi
call fcn.140055f70
mov edx, 0x48
mov rcx, rdi
call fcn.140356b5c
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x1402f9f30
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
movzx eax, word [0x140552c0e]
mov rbx, rcx
test ax, ax
jne 0x1402f9f7a
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
movzx edx, word [rbp - 0x18]
xor eax, eax
lock cmpxchg word [0x140552c0e], dx
movzx edx, word [0x140552c0e]
test dx, dx
jne 0x1402f9f7a
call fcn.140329e68
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
lea r9, [rbp + 0x30]
lea rax, [rbp + 0x38]
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
nop dword [rax + rax]
test eax, eax
jne 0x1402f9fc8
call fcn.140329e68
jmp 0x1402fa09a
mov ecx, dword [rbp + 0x2c]
mov eax, dword [rbp + 0x28]
mov rdx, qword [rbx + 8]
shl rcx, 0x20
add rcx, rax
test rdx, rdx
jne 0x1402fa009
mov eax, dword [rbp + 0x30]
mov qword [rbx + 8], rcx
mov ecx, dword [rbp + 0x34]
shl rcx, 0x20
add rcx, rax
mov eax, dword [rbp + 0x38]
mov qword [rbx + 0x10], rcx
mov ecx, dword [rbp + 0x3c]
shl rcx, 0x20
add rcx, rax
mov qword [rbx + 0x18], rcx
jmp 0x1402fa09a
cmp rcx, rdx
jbe 0x1402fa09a
mov eax, dword [rbp + 0x30]
xorps xmm1, xmm1
mov r8d, dword [rbp + 0x34]
mov r9d, dword [rbp + 0x3c]
movsd xmm2, qword [0x1404202f0]
shl r8, 0x20
add r8, rax
shl r9, 0x20
mov eax, dword [rbp + 0x38]
add r9, rax
mov rax, r9
sub rax, qword [rbx + 0x10]
sub rax, qword [rbx + 0x18]
add rax, r8
cvtsi2sd xmm1, rax
jns 0x1402fa052
addsd xmm1, xmm2
mov rax, rcx
xorps xmm0, xmm0
sub rax, rdx
cvtsi2sd xmm0, rax
jns 0x1402fa066
addsd xmm0, xmm2
movzx eax, word [0x140552c0e]
divsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov qword [rbx + 8], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rbx + 0x18], r9
mov qword [rbx + 0x10], r8
divsd xmm1, xmm0
mulsd xmm1, qword [0x1404202d8]
call fcn.1402fa7d0
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x1402fc3c0
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, r8
mov rbx, rcx
mov rcx, qword [rdx]
test rcx, rcx
je 0x1402fc3f7
mov rcx, qword [rcx]
mov edx, dword [rbx + 0x6c]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1402fc507
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1402fc46f
mov dword [rbp - 0x25], 0x80004005
lea rax, [rbp - 0x25]
mov qword [rbp + 0x17], rax
mov edx, 4
mov dword [rbp + 0x1f], edx
and dword [rbp + 0x23], 0
lea rax, str.Failed_to_wait_for_SenseCncProxy_to_become_ready
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x2f], 0x62
and dword [rbp + 0x33], 0
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14048bd31]
call fcn.140001208
and dword [rbp - 0x29], 0
or edx, 0xffffffff
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
lea rdx, [rbp - 0x29]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
lea rcx, [rbp - 0x21]
call fcn.1402fa868
nop
mov eax, dword [rbp - 0x29]
lea rdx, [rbx + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 2]
lea rcx, [rbp - 0x21]
call fcn.1402fac14
nop
mov rbx, qword [rbp - 0x19]
test rbx, rbx
je 0x1402fc500
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x1402fc500
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.p76_]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x1402fc500
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [str.p76_]
mov eax, 0x800705b4
jmp 0x1402fc509
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1402fc90c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x1d8]
sub rsp, 0x2d0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov ebx, 0x104
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
jne 0x1402fca05
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
call fcn.1400550c0
mov rdi, qword [rax + 8]
cmp dword [rdi], 2
jbe 0x1402fca71
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], SafeArrayGetDim
mov qword [rbp - 0x80], rax
lea rax, str.GetModuleFileName_failed
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x78], 4
mov qword [rbp - 0x68], CreateCompressor
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 4
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14048bd64]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, rdi
call fcn.140001208
jmp 0x1402fca71
mov edx, 0x5c
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
lea r8, str.SenseCncProxy.exe
mov rdx, rbx
lea rcx, [rbp - 0x50]
mov word [rax], r14w
call fcn.14004c970
mov ebx, eax
test eax, eax
js 0x1402fca71
movdqa xmm0, xmmword [0x140420310]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x38]
mov word [rsp + 0x38], r14w
movdqu xmmword [rsp + 0x48], xmm0
call fcn.140055574
lea rcx, [rdi + 0x48]
lea rdx, [rsp + 0x38]
call fcn.140085570
lea rcx, [rsp + 0x38]
call fcn.140055f70
mov eax, ebx
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140300b68
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r9, rdx
mov r15, qword [rdx + 0x10]
mov r11, rcx
mov r8, rdx
jb 0x140300b98
mov r8, qword [rdx]
xor ebx, ebx
lea rdx, [r15 + r15]
lea rcx, [r8 + rdx]
movabs rax, 0xcbf29ce484222325
cmp r8, rcx
mov r10, r8
cmova rdx, rbx
test rdx, rdx
je 0x140300bde
movzx ecx, byte [r10]
movabs rdi, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r8
imul rax, rdi
cmp rcx, rdx
jne 0x140300bbb
mov r14, qword [r11 + 0x30]
mov r12, qword [r11 + 0x18]
and r14, rax
mov rdi, qword [r11 + 8]
add r14, r14
mov rax, qword [r12 + r14*8]
cmp qword [r12 + r14*8], rdi
jne 0x140300bff
mov rcx, rdi
jmp 0x140300c07
mov rcx, qword [r12 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140300cf5
cmp qword [r9 + 0x18], 8
lea rdx, [rax + 0x10]
mov rcx, r9
jb 0x140300c21
mov rcx, qword [r9]
cmp qword [rdx + 0x18], 8
mov r10, rdx
jb 0x140300c2e
mov r10, qword [rdx]
mov r8, qword [rdx + 0x10]
cmp r8, r15
jne 0x140300c6f
test r8, r8
je 0x140300c74
movzx edx, word [r10]
movzx r11d, word [rcx]
cmp dx, r11w
jb 0x140300c6f
sub r10, rcx
cmp dx, r11w
ja 0x140300c6f
cmp r8, 1
je 0x140300c74
add rcx, 2
dec r8
movzx edx, word [rcx + r10]
movzx r11d, word [rcx]
cmp dx, r11w
jae 0x140300c51
mov rax, qword [rax]
jmp 0x140300bf4
mov r8, rax
mov rcx, rax
cmp qword [r12 + r14*8], rdi
jne 0x140300c85
mov rdx, rdi
jmp 0x140300c8d
mov rdx, qword [r12 + r14*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x140300cf0
lea rdx, [rax + 0x10]
cmp qword [rdx + 0x18], 8
mov r10, rdx
jb 0x140300ca3
mov r10, qword [rdx]
cmp qword [r9 + 0x18], 8
mov rsi, r9
jb 0x140300cb0
mov rsi, qword [r9]
cmp r15, qword [rdx + 0x10]
jne 0x140300cf0
mov rbp, r15
test r15, r15
je 0x140300cfd
movzx edx, word [rsi]
movzx r11d, word [r10]
cmp dx, r11w
jb 0x140300cf0
sub rsi, r10
cmp dx, r11w
ja 0x140300cf0
cmp rbp, 1
je 0x140300cfd
add r10, 2
dec rbp
movzx edx, word [r10 + rsi]
movzx r11d, word [r10]
cmp dx, r11w
jae 0x140300cce
cmp r8, rax
jne 0x140300d0b
mov rcx, rdi
mov rax, rdi
jmp 0x140300d0b
mov rax, qword [rax]
jmp 0x140300c7a
mov rcx, qword [rcx]
inc rbx
cmp rcx, rax
jne 0x140300d05
mov rbp, qword [rsp + 0x28]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret