joyce8/EMBER2024-capa huggingface dataset:
Function at 0x164ec3bb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 8
mov rax, qword [rsp + 0x18]
movabs r8, 0xcbf29ce484222325
mov r9, qword [rax]
mov rax, qword [rax + 8]
lea r10, [r9 + rax*2]
cmp r9, r10
je 0x164ec3c1f
mov qword [rsp], rbx
mov r11, 0xffffffffffffffff
movabs rbx, 0x100000001b3
movzx ecx, word [r9]
mov rdx, 0xffffffffffffffdf
lea eax, [rcx - 0x61]
cmp ax, 0x19
cmova rdx, r11
add r9, 2
and rdx, rcx
xor r8, rdx
imul r8, rbx
cmp r9, r10
jne 0x164ec3bf2
mov rbx, qword [rsp]
mov rax, r8
add rsp, 8
ret

Function at 0x164ecb340
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, qword [rbp + 0x67]
mov qword [rbp - 1], rbx
mov rdi, qword [rbp + 0x6f]
xor esi, esi
mov dword [rbp - 0x29], esi
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov dword [rbp - 0x29], 1
mov qword [rbp + 0xf], rsi
lea rdx, [rbp + 0xf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x164ecb46d
cmp dword [rbp + 0x13], esi
jne 0x164ecb447
mov edx, dword [rbp + 0xf]
mov rcx, rbx
call fcn.164e71c50
mov dword [rbp + 7], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0xf]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x164ecb41e
mov edx, dword [rbp + 7]
mov rcx, rbx
call fcn.164e71c50
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.165001080
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.get_file_content:_ReadFile
lea rcx, [rbp - 0x21]
call fcn.164e9bd80
lea rdx, [0x165147178]
lea rcx, [rbp - 0x21]
call fcn.165003be0
int3
lea r8, str.get_file_content
mov edx, 0xdf
lea rcx, [rbp - 0x21]
call fcn.164e9bd80
lea rdx, [0x165147178]
lea rcx, [rbp - 0x21]
call fcn.165003be0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.get_file_content:_GetFileSizeEx
lea rcx, [rbp - 0x21]
call fcn.164e9bd80
lea rdx, [0x165147178]
lea rcx, [rbp - 0x21]
call fcn.165003be0
int3
Function at 0x164efa040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x10]
lea r8, [rbp - 0x50]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x18]
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x60], 0x6e657665
mov dword [rbp - 0x5c], 0x5f725f74
mov dword [rbp - 0x58], 0x637072
mov dword [rbp - 0x50], 0x32423239
mov dword [rbp - 0x4c], 0x46463333
mov dword [rbp - 0x48], 0xbe
call fcn.164e474d0
lea r8, str.:_RPC_call_failed_with_code_
mov qword [rbp - 0x48], 0x20
mov qword [rbp - 0x50], r8
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.164ef9d30
mov ecx, dword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, dword [rbp - 0x18]
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp - 0x20]
call fcn.164ef9f40
lea rdx, [0x165147b68]
lea rcx, [rbp - 0x40]
call fcn.165003be0
int3

Function at 0x164efc620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x30], 0x42413441
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x43323237
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x40], 0x6e657665
mov dword [rsp + 0x44], 0x5f725f74
mov dword [rsp + 0x48], 0x637072
mov dword [rsp + 0x54], 0x1c
call fcn.164e47a70
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
mov r8d, 7
mov rdx, rax
call fcn.164e47510
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x164efe160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0xf8]
mov dword [rbp + 0xb0], 0x42413441
mov dword [rbp + 0xb4], 0x43323237
mov dword [rsp + 0x28], 0x6e657665
mov dword [rsp + 0x2c], 0x5f725f74
mov dword [rsp + 0x30], 0x637072
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 0x22
lea rcx, [rbp + 0xb0]
call fcn.164e47a70
lea r9, [rsp + 0x28]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.164e47510
nop
lea rdx, str.asw::event_routing::rpc::impl::RpcEndpoint::AddAcceptedEventMask
lea rcx, [rsp + 0x50]
call fcn.164ea21e0
lea rdx, str._this
mov rcx, rax
call fcn.164ea21e0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [rbx + 0xc0]
mov rcx, rax
call fcn.164ea2220
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x2c
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov rdx, rdi
mov rcx, rax
call fcn.164e7e090
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [0x1650afd70]
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0x50]
call fcn.164e47630
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
lea rsi, [rbx + 0x198]
mov qword [rbp + 0xb0], rsi
mov rcx, rsi
call fcn.164ef1c50
mov byte [rbp + 0xb8], 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.164f0e600
nop
mov rdx, rax
lea rcx, [rbx + 0x1f0]
call fcn.164f0ee00
nop
lea rcx, [rsp + 0x28]
call fcn.164e48400
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [rsi + 0x44]
cmp dword [rsi + 0x44], 0
jg 0x164efe333
mov dword [rsi + 0x40], 0xffffffff
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.165001080
mov rbx, qword [rsp + 0x200]
add rsp, 0x1d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x164efe360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0xf8]
mov dword [rbp + 0xb0], 0x42413441
mov dword [rbp + 0xb4], 0x43323237
mov dword [rsp + 0x28], 0x6e657665
mov dword [rsp + 0x2c], 0x5f725f74
mov dword [rsp + 0x30], 0x637072
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 0x22
lea rcx, [rbp + 0xb0]
call fcn.164e47a70
lea r9, [rsp + 0x28]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.164e47510
nop
lea rdx, str.asw::event_routing::rpc::impl::RpcEndpoint::AddAcceptedRequestOrSnoowballMask
lea rcx, [rsp + 0x50]
call fcn.164ea21e0
lea rdx, str._this
mov rcx, rax
call fcn.164ea21e0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [rbx + 0xc0]
mov rcx, rax
call fcn.164ea2220
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x2c
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov rdx, rdi
mov rcx, rax
call fcn.164e7e090
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [0x1650afd70]
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0x50]
call fcn.164e47630
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
lea rsi, [rbx + 0x198]
mov qword [rbp + 0xb0], rsi
mov rcx, rsi
call fcn.164ef1c50
mov byte [rbp + 0xb8], 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.164f0e600
nop
mov rdx, rax
lea rcx, [rbx + 0x208]
call fcn.164f0ee00
nop
lea rcx, [rsp + 0x28]
call fcn.164e48400
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [rsi + 0x44]
cmp dword [rsi + 0x44], 0
jg 0x164efe533
mov dword [rsi + 0x40], 0xffffffff
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.165001080
mov rbx, qword [rsp + 0x200]
add rsp, 0x1d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x164efe560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rsi, qword [rbp + 0xe0]
mov dword [rsp + 0x30], 0x42413441
mov dword [rsp + 0x34], 0x43323237
mov dword [rsp + 0x40], 0x6e657665
mov dword [rsp + 0x44], 0x5f725f74
mov dword [rsp + 0x48], 0x637072
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], 0x22
lea rcx, [rsp + 0x30]
call fcn.164e47a70
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.164e47510
nop
lea rcx, [rsp + 0x60]
call fcn.164f0fce0
lea rdx, str._this
mov rcx, rax
call fcn.164ea21e0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [rsi + 0xc0]
mov rcx, rax
call fcn.164ea2220
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [0x1650afd70]
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0x60]
call fcn.164e47630
lea rdi, [rsi + 0x198]
mov rcx, rdi
call fcn.164ef1c50
mov byte [rsi + 0x220], 1
mov rbx, qword [rsi + 0x228]
mov r14, qword [rsi + 0x230]
cmp rbx, r14
je 0x164efe691
mov rcx, rbx
call fcn.164e48400
add rbx, 0x28
cmp rbx, r14
jne 0x164efe672
mov rax, qword [rsi + 0x228]
mov qword [rsi + 0x230], rax
mov rbx, qword [rsi + 0x240]
mov r14, qword [rsi + 0x248]
cmp rbx, r14
je 0x164efe6c3
mov rcx, rbx
call fcn.164e48400
add rbx, 0x28
cmp rbx, r14
jne 0x164efe6a4
mov rax, qword [rsi + 0x240]
mov qword [rsi + 0x248], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [rdi + 0x44]
cmp dword [rdi + 0x44], 0
jg case.default.0x164efe710
mov dword [rdi + 0x40], 0xffffffff
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x164efe720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0xf8]
mov dword [rbp + 0xb0], 0x42413441
mov dword [rbp + 0xb4], 0x43323237
mov dword [rsp + 0x28], 0x6e657665
mov dword [rsp + 0x2c], 0x5f725f74
mov dword [rsp + 0x30], 0x637072
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 0x22
lea rcx, [rbp + 0xb0]
call fcn.164e47a70
lea r9, [rsp + 0x28]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.164e47510
nop
lea rdx, str.asw::event_routing::rpc::impl::RpcEndpoint::AddAllowedEventResendingMask
lea rcx, [rsp + 0x50]
call fcn.164ea21e0
lea rdx, str._this
mov rcx, rax
call fcn.164ea21e0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [rbx + 0xc0]
mov rcx, rax
call fcn.164ea2220
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x2c
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov rdx, rdi
mov rcx, rax
call fcn.164e7e090
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [0x1650afd70]
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0x50]
call fcn.164e47630
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
lea rsi, [rbx + 0x198]
mov qword [rbp + 0xb0], rsi
mov rcx, rsi
call fcn.164ef1c50
mov byte [rbp + 0xb8], 1
mov byte [rbx + 0x220], 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.164f0e600
nop
mov rdx, rax
lea rcx, [rbx + 0x228]
call fcn.164f0ee00
nop
lea rcx, [rsp + 0x28]
call fcn.164e48400
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [rsi + 0x44]
cmp dword [rsi + 0x44], 0
jg 0x164efe8fa
mov dword [rsi + 0x40], 0xffffffff
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.165001080
mov rbx, qword [rsp + 0x200]
add rsp, 0x1d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x164efe930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0xf8]
mov dword [rbp + 0xb0], 0x42413441
mov dword [rbp + 0xb4], 0x43323237
mov dword [rsp + 0x28], 0x6e657665
mov dword [rsp + 0x2c], 0x5f725f74
mov dword [rsp + 0x30], 0x637072
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 0x22
lea rcx, [rbp + 0xb0]
call fcn.164e47a70
lea r9, [rsp + 0x28]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.164e47510
nop
lea rcx, [rsp + 0x50]
call fcn.164f0fd30
lea rdx, str._this
mov rcx, rax
call fcn.164ea21e0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [rbx + 0xc0]
mov rcx, rax
call fcn.164ea2220
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x2c
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
mov rdx, rdi
mov rcx, rax
call fcn.164e7e090
mov byte [rsp + 0x20], 0x22
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.164f0fab0
lea rdx, [0x1650afd70]
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0x50]
call fcn.164e47630
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
lea rsi, [rbx + 0x198]
mov qword [rbp + 0xb0], rsi
mov rcx, rsi
call fcn.164ef1c50
mov byte [rbp + 0xb8], 1
mov byte [rbx + 0x220], 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.164f0e600
nop
mov rdx, rax
lea rcx, [rbx + 0x240]
call fcn.164f0ee00
nop
lea rcx, [rsp + 0x28]
call fcn.164e48400
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [rsi + 0x44]
cmp dword [rsi + 0x44], 0
jg 0x164efeb03
mov dword [rsi + 0x40], 0xffffffff
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.165001080
mov rbx, qword [rsp + 0x200]
add rsp, 0x1d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x164f01b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0xe8], rax
mov edi, dword [rbp + 0x128]
mov rbx, qword [rbp + 0x120]
mov dword [rbp + 0xe0], edi
xor r12d, r12d
mov dword [rbp + 0xc0], r12d
lea rdx, [rbp + 0xc0]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
mov dword [rbp + 0xd0], 0x42413441
mov dword [rbp + 0xd4], 0x43323237
mov dword [rsp + 0x20], 0x6e657665
mov dword [rsp + 0x24], 0x5f725f74
mov dword [rsp + 0x28], 0x637072
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x2c], rax
mov dword [rsp + 0x34], 0x22
lea rcx, [rbp + 0xd0]
call fcn.164e47a70
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.164e47510
nop
lea rdx, str.asw::event_routing::rpc::impl::RpcEndpoint::ConfirmSecureContextImpl_
lea rcx, [rsp + 0x60]
call fcn.164ea21e0
lea rdx, [rbp + 0xe0]
mov rcx, rax
call fcn.164f232a0
lea rdx, str.___pid
mov rcx, rax
call fcn.164ea21e0
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.164f232a0
nop
lea rcx, [rsp + 0x60]
call fcn.164e47630
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
lea r14, [rbx + 0x318]
mov qword [rbp + 0xd0], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp + 0xd8], 1
add rbx, 0x348
mov r15d, dword [rbp + 0xc0]
mov rsi, qword [rbx]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], r12d
mov rcx, rsi
cmp byte [rax + 0x19], r12b
jne 0x164f01d1b
mov qword [rsp + 0x40], rax
cmp dword [rax + 0x1c], edi
jae 0x164f01d07
mov dword [rsp + 0x48], r12d
mov rax, qword [rax + 0x10]
jmp 0x164f01d15
mov dword [rsp + 0x48], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x164f01cf2
cmp byte [rcx + 0x19], 0
jne 0x164f01d26
cmp edi, dword [rcx + 0x1c]
jae 0x164f01d7e
movabs rax, 0x666666666666666
cmp qword [rbx + 8], rax
je 0x164f01db2
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r12
mov ecx, 0x28
call fcn.165001480
nop
mov dword [rax + 0x1c], edi
mov dword [rax + 0x20], r15d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x20], xmm0
mov r8, rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.164f14f70
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0xe8]
xor rcx, rsp
call fcn.165001080
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.164e9df90
nop
int3
Function at 0x164f0e100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd8]
sub rsp, 0x1d8
mov rdi, qword [rbp + 0x118]
mov rax, qword [rdi]
test rax, rax
je 0x164f0e2fb
mov rcx, qword [rax]
test rcx, rcx
je 0x164f0e2fb
mov rbx, qword [rbp + 0x110]
mov eax, dword [rbx + 0x18]
lea r8, [rbx + 0x80]
cmp qword [rbx + 0x98], 7
jbe 0x164f0e16c
mov r8, qword [rbx + 0x80]
mov rsi, qword [rbp + 0x128]
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x164f0e180
mov rdx, qword [rsi]
mov dword [rsp + 0x20], eax
call fcn.164f28ef0
mov r15d, eax
mov dword [rsp + 0x30], eax
test eax, eax
je 0x164f0e2a8
mov dword [rsp + 0x40], 0x42413441
mov dword [rsp + 0x44], 0x43323237
mov dword [rsp + 0x50], 0x6e657665
mov dword [rsp + 0x54], 0x5f725f74
mov dword [rsp + 0x58], 0x637072
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x5c], rax
mov dword [rsp + 0x64], 0x1c
lea rcx, [rsp + 0x40]
call fcn.164e47a70
lea r9, [rsp + 0x50]
mov r8d, 7
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.164e47510
nop
lea rdx, str.asw::event_routing::rpc::impl::RpcEndpoint::AskForResending:_Asking_of_
lea rcx, [rsp + 0x70]
call fcn.164ea21e0
mov rdx, qword [rbp + 0x120]
mov rcx, rax
call fcn.164ea2220
mov rcx, rax
call fcn.164f14b50
mov rdx, rsi
mov rcx, rax
call fcn.164e7e090
lea rdx, str._events_requests_snowballs_failed_with_error
mov rcx, rax
call fcn.164ea21e0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.164f232a0
lea rdx, str.__0x
mov rcx, rax
call fcn.164ea21e0
mov rcx, rax
call fcn.164f1c660
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.164f232a0
nop
lea rcx, [rsp + 0x70]
call fcn.164e47630
mov r9d, r15d
mov r8, rsi
mov rdx, qword [rbp + 0x120]
lea rcx, [rbx + 0x80]
call fcn.164f1e020
nop
mov rcx, rdi
call fcn.164e51d90
mov eax, r15d
add rsp, 0x1d8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
test dword [rbx + 0x388], 1
je 0x164f0e2c6
mov r8, qword [rbp + 0x120]
mov rdx, rdi
mov rcx, rbx
call fcn.164f0c0b0
mov r9d, r15d
mov r8, rsi
mov rdx, qword [rbp + 0x120]
lea rcx, [rbx + 0x80]
call fcn.164f1c410
nop
mov rcx, rdi
call fcn.164e51d90
mov eax, r15d
add rsp, 0x1d8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x110]
sub rcx, 0xffffffffffffff80
mov r9d, 0x6ba
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x120]
call fcn.164f1e020
nop
mov rcx, rdi
call fcn.164e51d90
mov eax, 0x6ba
add rsp, 0x1d8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x164f53e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r15, qword [rbp + 0x100]
mov rsi, qword [rbp + 0x108]
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov rax, qword [rsi]
test rax, rax
je 0x164f53f24
cmp dword [rax], 0xe06d7363
jne 0x164f53f24
cmp dword [rax + 0x18], 4
jne 0x164f53f24
cmp dword [rax + 0x20], 0x19930520
jne 0x164f53f24
mov rdi, qword [rax + 0x30]
mov r14, qword [rax + 0x28]
movdqu xmmword [rbp + 0xb0], xmm0
lea rcx, [rbp + 0xb0]
call fcn.164ffd7dc
test rdi, rdi
je 0x164f53f39
mov r8, rdi
mov rdx, r14
lea rcx, [rbp + 0xb0]
call fcn.164ffd7b0
jmp 0x164f53f39
movdqu xmmword [rbp + 0xb0], xmm0
lea rcx, [rbp + 0xb0]
call fcn.164ffd7dc
nop
lea rcx, [rbp + 0xb0]
call fcn.164ffd9f4
test al, al
je 0x164f54038
mov rdx, qword [r15]
lea r8, [rdx + 0x40]
mov rcx, rsi
call fcn.164f506e0
mov dword [rsp + 0x20], 0x41384435
mov dword [rsp + 0x24], 0x44393942
mov dword [rsp + 0x30], 0x6e657665
mov dword [rsp + 0x34], 0x6f725f74
mov dword [rsp + 0x38], 0x7475
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0xc3
lea rcx, [rsp + 0x20]
call fcn.164e47a70
lea r9, [rsp + 0x30]
mov r8d, 7
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.164e47510
nop
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.164f4fe30
lea rdx, str.Synchronous_part_of_handler_for
mov rcx, rax
call fcn.164ea21e0
mov rdx, qword [r15]
mov rcx, rax
call fcn.164e7e090
lea rdx, str.__level
mov rcx, rax
call fcn.164ea21e0
mov rdx, qword [r15]
add rdx, 0x70
mov rcx, rax
call fcn.164f0fdd0
mov rcx, rax
call fcn.164f559c0
mov rdx, qword [r15]
add rdx, 0x40
mov rcx, rax
call fcn.164e7e090
lea rdx, str._throws_exception_
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0x50]
call fcn.164e47630
mov ebx, 1
lea rcx, [rbp + 0xb0]
call fcn.164ffd868
mov eax, ebx
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.165001080
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret