joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140319730
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov r12, rdx
mov r13, rcx
mov r15, qword [r8 + 0x10]
mov r9, qword [r8 + 0x18]
cmp r9, 0x10
jb 0x14031976f
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r15, r15
je 0x1403197a4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r15
jb 0x140319790
mov r8, qword [r13 + 0x30]
and r8, rdx
mov rbx, qword [r13 + 8]
shl r8, 4
mov qword [rsp + 0x80], r8
mov rax, qword [r13 + 0x18]
mov rsi, qword [rax + r8]
cmp rbx, rsi
je 0x140319841
mov rbx, qword [rax + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rsi
je 0x140319841
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0x10
jb 0x1403197e8
mov rdx, qword [rbx + 0x10]
mov rcx, r14
cmp r9, 0x10
jb 0x1403197f4
mov rcx, qword [r14]
cmp r15, qword [rbx + 0x20]
jne 0x1403197d0
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov r9, qword [r14 + 0x18]
jne 0x1403197d0
lea rcx, [r13 + 8]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rcx + 8]
mov rdx, rdi
call fcn.1400ad3f0
mov qword [r12], rbx
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x1403198de
mov rax, qword [rdi]
cmp rbx, rax
je 0x140319876
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r13 + 0x18]
mov r8, qword [rsp + 0x80]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r13 + 8]
jne 0x14031989c
mov qword [rdx], rdi
mov rax, qword [r13 + 0x18]
mov qword [rax + r8 + 8], rdi
jmp 0x1403198c8
cmp rax, rbx
jne 0x1403198a6
mov qword [rdx], rdi
jmp 0x1403198c8
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1403198c8
mov rdx, qword [r13 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r13
call fcn.14031ccd0
nop
mov qword [r12], rdi
mov byte [r12 + 8], 1
mov rax, r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1403198f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rsi
mov rsi, r8
mov r15, rdx
mov r13, rcx
mov r14, qword [r8 + 0x10]
mov r9, qword [r8 + 0x18]
cmp r9, 0x10
jb 0x14031992f
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
test r14, r14
je 0x140319964
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r14
jb 0x140319950
mov r12, qword [r13 + 0x30]
and r12, rcx
mov rbx, qword [r13 + 8]
shl r12, 4
mov rax, qword [r13 + 0x18]
mov rdi, qword [rax + r12]
cmp rbx, rdi
je 0x1403199d2
mov rbx, qword [rax + r12 + 8]
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x1403199d2
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0x10
jb 0x1403199a0
mov rdx, qword [rbx + 0x10]
mov rcx, rsi
cmp r9, 0x10
jb 0x1403199ac
mov rcx, qword [rsi]
cmp r14, qword [rbx + 0x20]
jne 0x140319988
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov r9, qword [rsi + 0x18]
jne 0x140319988
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x140319ac7
mov rax, qword [r13 + 8]
mov rdi, qword [rax]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x70], rax
mov r9, rsi
mov r8, rax
mov rdx, rdi
lea rcx, [r13 + 8]
call fcn.1403193e0
mov rdx, rax
mov rax, qword [r13 + 0x10]
movabs rcx, 0x492492492492491
sub rcx, rax
cmp rcx, 1
jb 0x140319adf
inc rax
mov qword [r13 + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rsp + 0x70]
mov qword [rax], rdx
mov rcx, qword [r13 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140319a6a
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r13 + 8]
mov rdx, qword [r13 + 0x18]
add rdx, r12
mov rax, qword [rdx]
cmp rax, rcx
jne 0x140319a87
mov qword [rdx], rdi
mov rax, qword [r13 + 0x18]
mov qword [rax + r12 + 8], rdi
jmp 0x140319ab3
cmp rax, rbx
jne 0x140319a91
mov qword [rdx], rdi
jmp 0x140319ab3
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140319ab3
mov rdx, qword [r13 + 0x18]
mov rax, qword [rdx + r12 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12 + 8], rcx
mov rcx, r13
call fcn.14031ccd0
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14043ccf0]
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14034ac20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov rsi, qword [rsp + 0x68]
mov r15, rcx
mov rdi, r9
mov byte [rsp + 0x68], 0
mov rbx, r8
movzx eax, word [rsi]
mov word [rcx + 0x10], ax
mov ecx, 0x50
call fcn.140309750
mov r14, rax
lea rax, vtable.ThreadInternalsWindows.0
lea rcx, [r14 + 8]
mov qword [r14], rax
mov byte [r14 + 0x40], 0
call fcn.14034ab60
lea rcx, [r14 + 0x38]
call sub.KERNEL32.dll_InitializeConditionVariable
mov ecx, 0x28
call fcn.140309750
mov qword [r14 + 0x48], rax
mov qword [rax], r14
mov rax, qword [r14 + 0x48]
mov qword [rax + 8], rbx
xor ebx, ebx
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x10], rdi
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x18], rbx
mov rcx, qword [r14 + 0x48]
movzx eax, byte [rsi]
mov byte [rcx + 0x20], al
mov r9, qword [r14 + 0x48]
cmp byte [r9 + 0x20], bl
je 0x14034acf1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [r14 + 0x48]
mov qword [rcx + 0x18], rax
mov r9, qword [r14 + 0x48]
cmp qword [r9 + 0x18], rbx
jne 0x14034acf1
mov rcx, r9
call fcn.140309730
xor al, al
xor cl, cl
jmp 0x14034ad4e
mov qword [rsp + 0x28], rbx
lea r8, [0x14034afe0]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14034ad40
mov rcx, qword [r14 + 0x48]
mov rax, rcx
test rcx, rcx
je 0x14034ad32
cmp byte [rcx + 0x20], bl
je 0x14034ad32
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14 + 0x48]
mov rcx, rax
call fcn.140309730
xor al, al
xor cl, cl
jmp 0x14034ad4e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
movzx ecx, al
mov byte [rsp + 0x68], al
mov qword [r15 + 8], r14
test cl, cl
je 0x14034ad63
mov dword [r15], 1
jmp 0x14034ad8a
mov dword [r15], 4
test r14, r14
je 0x14034ad86
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
mov rcx, r14
call fcn.140309730
movzx eax, byte [rsp + 0x68]
mov qword [r15 + 8], rbx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14034ad96
mov byte [rcx], al
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x14034b550
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
lea rbp, vtable.grpc_core::ExecCtx.0
mov qword [rax - 0x58], rbp
xor ebx, ebx
mov qword [rax - 0x50], rbx
xorps xmm0, xmm0
movdqa xmmword [rax - 0x48], xmm0
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bl
mov qword [rsp + 0x68], rbx
mov ecx, dword [0x14062d9a0]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
test byte [rsp + 0x58], 4
jne 0x14034b5d1
call fcn.14034a8f0
lea rax, [rsp + 0x30]
mov qword [rsi], rax
call fcn.140365060
xor ecx, ecx
call fcn.1403658b0
call fcn.14035ded0
movsxd rdi, dword [0x140630b38]
test edi, edi
js 0x14034b619
mov rbx, rdi
shl rbx, 4
lea rax, [0x140630b48]
add rbx, rax
mov rax, qword [rbx]
test rax, rax
je 0x14034b610
call rax
sub rbx, 0x10
sub edi, 1
jns 0x14034b606
call fcn.140364cc0
call fcn.140056060
call fcn.140056060
call fcn.140362270
call fcn.1403654a0
call fcn.140362e30
call fcn.140363e40
call fcn.1403656d0
call fcn.14034a870
nop
mov qword [rsp + 0x30], rbp
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.140351b90
mov rax, qword [rsp + 0x70]
mov qword [rsi], rax
test byte [rsp + 0x58], 4
jne 0x14034b671
call fcn.14034a780
nop
mov byte [0x140630b2c], 0
mov rcx, qword [0x140630b30]
call sub.KERNEL32.dll_WakeAllConditionVariable
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140355b40
Capabilities:
Get number of processors

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov r12, r9
mov r15d, r8d
mov r14, rdx
mov rbp, rcx
mov r13, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x138], 0
je 0x140355bc5
lea rax, str._reserved
mov qword [rsp + 0x20], rax
lea r9, str.assertion_failed:__s
mov edx, 0x169
mov r8d, 2
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.140309600
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rax, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x50], rax
xor edi, edi
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x80], eax
mov byte [rsp + 0x84], dil
mov qword [rsp + 0x88], rdi
mov ecx, dword [0x14062d9a0]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rax, qword [rsi]
mov qword [rsp + 0x90], rax
call fcn.14034a8f0
lea rax, [rsp + 0x50]
mov qword [rsi], rax
test rbx, rbx
je 0x140355c58
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x140533ca0]
call fcn.140362440
mov rdi, rax
xor r8d, r8d
mov rdx, r13
lea rcx, [0x140533c40]
call fcn.140362440
mov rbx, rax
mov rax, qword [rsp + 0x40]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140351e30
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8d, r15d
mov rdx, r14
mov rcx, rbp
call fcn.140355530
mov rbx, rax
lea rax, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x50], rax
or qword [rsp + 0x78], 1
lea rcx, [rsp + 0x50]
call fcn.140351b90
mov rcx, qword [rsp + 0x90]
mov qword [rsi], rcx
test byte [rsp + 0x78], 4
jne 0x140355ce4
call fcn.14034a780
nop
mov rax, rbx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140355f70
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rdi, rcx
xor ecx, ecx
call fcn.140369490
mov rsi, rax
lea r14, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x30], r14
xor ebp, ebp
mov qword [rsp + 0x38], rbp
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bpl
mov qword [rsp + 0x68], rbp
mov ecx, dword [0x14062d9a0]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
call fcn.14034a8f0
lea rax, [rsp + 0x30]
mov qword [rbx], rax
cmp byte [0x140631558], bpl
je 0x140356044
mov qword [rsp + 0x20], rdi
lea r9, str.grpc_channel_destroy_channel_p_
mov edx, 0x1dd
lea r8d, [rbp + 1]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.140309600
lea rdx, str.Channel_Destroyed
lea rcx, [rsp + 0x88]
call fcn.140353830
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb8], xmm1
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov edx, 0x1df
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.14035c5a0
mov qword [rsi + 0x18], rax
xor edx, edx
lea rcx, [rdi + 0x70]
call fcn.140369cd0
mov r8, qword [rax]
mov rdx, rsi
mov rcx, rax
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
or rax, 0xffffffffffffffff
lock xadd qword [rdi + 0x70], rax
cmp rax, 1
jne 0x1403560c6
lea rcx, [rdi + 0x70]
call fcn.140369540
nop
mov qword [rsp + 0x30], r14
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.140351b90
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
test byte [rsp + 0x58], 4
jne 0x1403560f0
call fcn.14034a780
nop
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140284180
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14035a160
Capabilities:
Hash data using murmur3

Disassembly:
mov r8d, dword [rcx + 8]
test r8d, r8d
je 0x14035a1b1
mov rax, qword [rdx]
cmp r8d, 1
je 0x14035a1ad
test rax, rax
je 0x14035a17d
mov r9, qword [rdx + 8]
jmp 0x14035a182
movzx r9d, byte [rdx + 8]
test rax, rax
je 0x14035a19a
mov rcx, qword [rdx + 0x10]
mov rdx, r9
mov r8d, dword [0x14063345c]
jmp fcn.1403f90b0
mov r8d, dword [0x14063345c]
lea rcx, [rdx + 9]
mov rdx, r9
jmp fcn.1403f90b0
mov eax, dword [rax + 0x60]
ret
mov rcx, qword [rdx]
lea rax, [0x14060a3c0]
sub rcx, rax
movabs rax, 0x6666666666666667
imul rcx
lea rax, [0x1406332b0]
sar rdx, 4
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov eax, dword [rax + rdx*4]
ret
Function at 0x14035f650
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push r15
sub rsp, 0xe0
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea r15, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rax - 0x80], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x70], eax
mov byte [rsp + 0x74], 0
mov qword [rsp + 0x78], 0
mov ecx, dword [0x14062d9a0]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov r14, qword [rax + rcx*8]
add r14, rdx
mov rax, qword [r14]
mov qword [rsp + 0x80], rax
call fcn.14034a8f0
lea rax, [rsp + 0x40]
mov qword [r14], rax
cmp byte [0x140631558], 0
je 0x14035f72a
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, str.grpc_insecure_channel_create_target_s__args_p__reserved_p_
mov edx, 0x5e
lea r8d, [rdx - 0x5d]
lea rcx, str.D:p4grpc1.22.1_src_srccoreext_transportchttp2clientinsecurechannel_create.cc
call fcn.140309600
test rbx, rbx
je 0x14035f75e
lea rax, str.reserved__nullptr
mov qword [rsp + 0x20], rax
lea r9, str.assertion_failed:__s
mov edx, 0x5f
lea r8d, [rdx - 0x5d]
lea rcx, str.D:p4grpc1.22.1_src_srccoreext_transportchttp2clientinsecurechannel_create.cc
call fcn.140309600
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rdx, [0x14035f610]
lea rcx, [0x140631540]
call fcn.14034abf0
mov rdx, qword [0x140631538]
lea rcx, [rsp + 0xb8]
call fcn.14037e2c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa8], xmm1
mov r8d, 1
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.140375e90
mov rbx, rax
mov rcx, qword [0x140631538]
mov r9, qword [rcx]
mov r8, rax
mov rdx, rsi
call qword [r9 + reloc.WS2_32.dll_recv]
mov rdi, rax
mov rcx, rbx
call fcn.1403761e0
test rdi, rdi
jne 0x14035f7ee
lea r8, str.Failed_to_create_client_channel
lea edx, [rdi + 0xd]
mov rcx, rsi
call fcn.1403588c0
mov rdi, rax
mov qword [rsp + 0x40], r15
or qword [rsp + 0x68], 1
lea rcx, [rsp + 0x40]
call fcn.140351b90
mov rcx, qword [rsp + 0x80]
mov qword [r14], rcx
test byte [rsp + 0x68], 4
jne 0x14035f81b
call fcn.14034a780
nop
mov rax, rdi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14035fa90
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov qword [rax - 0x168], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rdx
mov rdi, rcx
lea rbp, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x30], rbp
xor esi, esi
mov qword [rsp + 0x38], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], sil
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x14062d9a0]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov r14, qword [rax + rcx*8]
add r14, rdx
mov rax, qword [r14]
mov qword [rsp + 0x70], rax
call fcn.14034a8f0
lea rax, [rsp + 0x30]
mov qword [r14], rax
mov qword [rdi], rbx
cmp dword [rbx + 8], esi
jne 0x14035fbe2
lea rcx, [rsp + 0x90]
call fcn.140360980
mov rax, qword [rdi]
cmp dword [rax + 8], esi
jne 0x14035fb62
cmp dword [rax + 0x10], esi
jne 0x14035fb62
mov qword [rdi + 8], rax
jmp 0x14035fbdf
lea rbx, [rax + 0x18]
mov ecx, dword [rax + 0x10]
call fcn.1403613d0
mov ecx, eax
lea r8, [rsp + 0x90]
mov rdx, rbx
call fcn.140380e80
test eax, eax
jne 0x14035fbb9
mov rax, qword [rdi]
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r9, str.Unexpected_error_decompressing_data_for_algorithm_with_enum_value__d.
mov edx, 0x3d
lea r8d, [rdx - 0x3b]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surface_byte_buffer_reader.cc
call fcn.140309600
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
jmp 0x14035fbe7
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
call fcn.14035f9c0
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x90]
call fcn.14035ffb0
mov dword [rdi + 0x10], esi
mov esi, 1
mov qword [rsp + 0x30], rbp
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.140351b90
mov rcx, qword [rsp + 0x70]
mov qword [r14], rcx
test byte [rsp + 0x58], 4
jne 0x14035fc11
call fcn.14034a780
nop
mov eax, esi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140284180
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140378180
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor edi, edi
mov dword [rsp + 0x68], 0x18
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x68]
mov dword [rsp + 0x28], 0x80
lea rcx, str.windows_bios.data
mov edx, 0x40000000
mov qword [rsp + 0x70], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14037821a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.CreateFile_failed___d_.
mov dword [rsp + 0x20], eax
lea edx, [rdi + 0x48]
lea r8d, [rdi + 2]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_securitycredentials_altscheck_gcp_environment_windows.cc
call fcn.140309600
xor al, al
jmp 0x14037833c
xor eax, eax
lea rcx, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call sub.VCRUNTIME140.dll_memset
or dword [rsp + 0xbc], 0x100
lea rax, str._Get_WmiObject__Class_Win32_BIOS_.Manufacturer
lea r9, str.powershell.exe
mov qword [rsp + 0x20], rax
lea r8, str._s__s
mov dword [rsp + 0x80], WSASetLastError
mov edx, 0x100
mov qword [rsp + 0xd0], rdi
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xd8], rbx
call fcn.140050b00
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xf0]
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14037830d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x5b
lea r9, str.CreateProcess_failed___d_._n
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_securitycredentials_altscheck_gcp_environment_windows.cc
mov dword [rsp + 0x20], eax
lea r8d, [rdx - 0x59]
call fcn.140309600
xor al, al
jmp 0x14037833c
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140284180
mov rbx, qword [rsp + 0x210]
add rsp, 0x200
pop rdi
ret
Function at 0x14037b740
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x18]
mov rdi, rcx
mov edx, dword [0x14062d9a0]
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, 0x68
mov rax, qword [rax + rdx*8]
mov rcx, qword [rcx + rax]
call fcn.140351c80
mov rbx, rax
lea rcx, [rdi + 0xd0]
add rbx, qword [rdi + 0x108]
call fcn.14039d470
cmp rax, rbx
mov qword [rdi + 0x100], rax
mov rcx, rax
mov edx, 1
mov rax, qword [rdi + 0x10]
cmovl rcx, rbx
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov qword [rsp + 0x30], rax
call fcn.14037db20
mov rcx, qword [rdi + 0x58]
lea r9, [rdi + 0x78]
lea r8, [rdi + 0x60]
lea rdx, [rsp + 0x20]
call fcn.14037a150
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret