joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140321c20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
call fcn.140321cd0
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
jne 0x140321c5b
mov rcx, rsi
call fcn.140320810
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call fcn.140320830
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rsi
mov ebx, eax
call fcn.140320810
mov rcx, rdi
test ebx, ebx
jne 0x140321ca2
call fcn.140320810
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
call fcn.140321cd0
mov rcx, rdi
mov rbx, rax
call fcn.140320810
mov rdi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1403263d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea r14, vtable.grpc_core::ExecCtx.0
mov qword [rax - 0x58], r14
xor ebp, ebp
mov qword [rax - 0x50], rbp
xorps xmm0, xmm0
movdqa xmmword [rax - 0x48], xmm0
mov qword [rax - 0x38], rbp
mov qword [rax - 0x30], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
nop
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bpl
mov qword [rsp + 0x68], rbp
mov edx, dword [0x140696aa8]
mov rax, qword gs:[0x58]
mov ecx, 0x68
mov rsi, qword [rax + rdx*8]
add rsi, rcx
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
call fcn.14033c520
nop
lea rax, [rsp + 0x30]
mov qword [rsi], rax
mov rbx, qword [rdi]
cmp rbx, qword [rdi + 8]
je 0x14032648b
nop word [rax + rax]
cmp dword [rbx], 2
jne 0x140326481
mov rax, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jne 0x140326470
mov qword [rsp + 0x30], r14
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.1403437c0
nop
mov rax, qword [rsp + 0x70]
mov qword [rsi], rax
test byte [rsp + 0x58], 4
jne 0x1403264b6
call fcn.14033c3b0
nop
lea rcx, [rdi + 0x18]
call fcn.14011e1b0
nop
mov rcx, qword [rdi + 0x18]
call fcn.1402f2860
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14032654c
mov rax, qword [rdi + 0x10]
sub rax, rcx
sar rax, 5
movabs rdx, 0x7ffffffffffffff
cmp rax, rdx
jbe 0x1403264f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
shl rax, 5
cmp rax, 0x1000
jb 0x14032653b
test cl, 0x1f
je 0x14032650b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14032651b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub rcx, rax
cmp rcx, 8
jae 0x14032652b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rcx, 0x27
jbe 0x140326538
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rax
call fcn.1402f2860
nop
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14032abf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov r8d, dword [rcx + 0x10]
mov r14, rdx
mov rsi, qword [rsp + 0x70]
xor edx, edx
mov rax, rsi
mov rdi, r9
div r8
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r12d, edx
mov r8, qword [rax + r12*8]
test r8, r8
je 0x14032ac66
mov r9, qword [r9]
cmp byte [r9], 0
mov rcx, r9
mov rax, qword [r8]
je 0x14032ac52
movzx edx, byte [r9]
cmp dl, byte [rax]
jne 0x14032ac52
movzx edx, byte [rcx + 1]
inc rcx
inc rax
test dl, dl
jne 0x14032ac40
movzx eax, byte [rax]
cmp byte [rcx], al
je 0x14032adf7
mov r8, qword [r8 + 0x10]
test r8, r8
jne 0x14032ac30
mov r9d, dword [rbx + 0x18]
lea rcx, [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x20], 1
call fcn.1400b5ee0
mov rax, qword [rbx + 0x30]
xor r8d, r8d
mov r9d, dword [rbx + 0x38]
mov rcx, rax
mov rdx, qword [rax]
mov r10, qword [rdx + 0x10]
lea edx, [r8 + 0x18]
call r10
mov rcx, qword [rdi]
mov r15, rax
xor edi, edi
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
cmp byte [rsp + 0x70], dil
je 0x14032adaf
mov r8d, dword [rsp + 0x74]
xor edx, edx
mov rax, rsi
mov qword [rsp + 0x50], rbp
div r8
mov rcx, rbx
mov ebp, r8d
mov r12d, edx
mov edx, r8d
call fcn.1400a3310
mov rsi, rax
cmp qword [rbx + 0x10], rdi
jbe 0x14032ad7e
mov rcx, qword [rbx + 8]
mov r9, qword [rcx + rdi*8]
test r9, r9
je 0x14032ad71
mov r10, rbp
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r9]
mov eax, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test edx, edx
je 0x14032ad44
nop dword [rax]
nop word [rax + rax]
imul eax, eax, 0x1000193
lea rcx, [rcx + 1]
xor eax, edx
movzx edx, byte [rcx - 1]
test edx, edx
jne 0x14032ad30
mov rcx, qword [rbx + 8]
xor edx, edx
div r10
mov rax, qword [r9 + 0x10]
mov qword [rcx + rdi*8], rax
mov r8d, edx
mov rax, qword [rsi + r8*8]
mov qword [r9 + 0x10], rax
mov qword [rsi + r8*8], r9
mov rax, qword [rbx + 8]
mov r9, qword [rax + rdi*8]
test r9, r9
jne 0x14032ad10
inc rdi
cmp rdi, qword [rbx + 0x10]
jb 0x14032acf3
mov r8, qword [rbx + 0x10]
cmp r8, 1
jbe 0x14032ada2
mov rax, qword [rbx + 0x30]
lea r8, [r8*8 + 8]
mov rdx, qword [rbx + 8]
mov rcx, rax
mov r9, qword [rax]
call qword [r9 + 0x18]
mov qword [rbx + 0x10], rbp
mov rbp, qword [rsp + 0x50]
mov qword [rbx + 8], rsi
mov rax, qword [rbx + 8]
mov rcx, qword [rax + r12*8]
mov qword [r15 + 0x10], rcx
mov rax, qword [rbx + 8]
mov qword [rax + r12*8], r15
mov rax, qword [rbx + 8]
inc qword [rbx + 0x18]
mov qword [r14], r15
mov r15, qword [rsp + 0x58]
lea rcx, [rax + r12*8]
mov qword [r14 + 8], rcx
mov byte [r14 + 0x10], 1
mov rbx, qword [rsp + 0x60]
mov rax, r14
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
mov rax, qword [rbx + 8]
mov qword [r14], r8
mov byte [r14 + 0x10], 0
lea rcx, [rax + r12*8]
mov qword [r14 + 8], rcx
jmp 0x14032ade0
Function at 0x14032b020
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [rcx + 0x160]
mov rbx, rcx
sub rax, qword [rcx + 0x150]
sar rax, 3
cmp rax, 0x10
jae 0x14032b0f5
mov rax, qword [rcx + 0x168]
xor r8d, r8d
mov r9d, dword [rcx + 0x170]
mov rcx, qword [rcx + 0x168]
mov rdx, qword [rax]
mov rax, qword [rdx + 0x10]
mov edx, 0x80
call rax
mov rsi, qword [rbx + 0x158]
mov rdi, rax
mov rbp, qword [rbx + 0x150]
cmp rbp, rsi
jne 0x14032b092
mov rsi, rax
jmp 0x14032b0ae
mov r8, rsi
mov rdx, rbp
sub r8, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sub rsi, rbp
sar rsi, 3
lea rsi, [rax + rsi*8]
mov rdx, qword [rbx + 0x150]
test rdx, rdx
je 0x14032b0d9
mov rax, qword [rbx + 0x168]
mov r8, qword [rbx + 0x160]
mov rcx, rax
sub r8, rdx
and r8, 0xfffffffffffffff8
mov r9, qword [rax]
call qword [r9 + 0x18]
lea rax, [rdi + 0x80]
mov qword [rbx + 0x150], rdi
mov qword [rbx + 0x160], rax
mov qword [rbx + 0x158], rsi
lea rax, [0x140558080]
mov ebp, 5
mov qword [rbx + 0x48], rax
lea r14, [rbx + 0x98]
lea rax, [0x1404a114c]
mov qword [rbx + 0x50], rax
lea rdi, [rbx + 0x48]
lea rax, str.apos
mov qword [rbx + 0x58], rax
lea rax, [0x140475cb4]
mov qword [rbx + 0x60], rax
lea rax, str.quot
mov qword [rbx + 0x68], rax
lea rax, [0x140483b34]
mov qword [rbx + 0x70], rax
lea rax, [0x1404c0dc0]
mov qword [rbx + 0x78], rax
lea rax, [0x14048772c]
mov qword [rbx + 0x80], rax
lea rax, [0x1404c0dc4]
mov qword [rbx + 0x88], rax
lea rax, [0x140487728]
mov qword [rbx + 0x90], rax
movzx ebx, byte [rsp + 0x70]
mov rcx, qword [rdi]
mov eax, 0x811c9dc5
mov rsi, qword [rdi + 8]
movzx edx, byte [rcx]
inc rcx
test edx, edx
je 0x14032b1b4
nop word [rax + rax]
imul eax, eax, 0x1000193
lea rcx, [rcx + 1]
xor eax, edx
movzx edx, byte [rcx - 1]
test edx, edx
jne 0x14032b1a0
mov ecx, eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov rcx, r14
movzx r8d, bl
call fcn.14032abf0
mov rax, qword [rsp + 0x30]
add rdi, 0x10
mov qword [rax + 8], rsi
sub rbp, 1
jne 0x14032b181
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14033c850
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov rsi, qword [rsp + 0x68]
mov r15, rcx
mov rdi, r9
mov byte [rsp + 0x68], 0
mov rbx, r8
movzx eax, word [rsi]
mov word [rcx + 0x10], ax
mov ecx, 0x50
call fcn.140320830
mov r14, rax
lea rax, vtable.ThreadInternalsWindows.0
lea rcx, [r14 + 8]
mov qword [r14], rax
mov byte [r14 + 0x40], 0
call fcn.14033c790
lea rcx, [r14 + 0x38]
call sub.KERNEL32.dll_InitializeConditionVariable
mov ecx, 0x28
call fcn.140320830
mov qword [r14 + 0x48], rax
mov qword [rax], r14
mov rax, qword [r14 + 0x48]
mov qword [rax + 8], rbx
xor ebx, ebx
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x10], rdi
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x18], rbx
mov rcx, qword [r14 + 0x48]
movzx eax, byte [rsi]
mov byte [rcx + 0x20], al
mov r9, qword [r14 + 0x48]
cmp byte [r9 + 0x20], bl
je 0x14033c921
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [r14 + 0x48]
mov qword [rcx + 0x18], rax
mov r9, qword [r14 + 0x48]
cmp qword [r9 + 0x18], rbx
jne 0x14033c921
mov rcx, r9
call fcn.140320810
xor al, al
xor cl, cl
jmp 0x14033c97e
mov qword [rsp + 0x28], rbx
lea r8, [0x14033cc10]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14033c970
mov rcx, qword [r14 + 0x48]
mov rax, rcx
test rcx, rcx
je 0x14033c962
cmp byte [rcx + 0x20], bl
je 0x14033c962
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14 + 0x48]
mov rcx, rax
call fcn.140320810
xor al, al
xor cl, cl
jmp 0x14033c97e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
movzx ecx, al
mov byte [rsp + 0x68], al
mov qword [r15 + 8], r14
test cl, cl
je 0x14033c993
mov dword [r15], 1
jmp 0x14033c9ba
mov dword [r15], 4
test r14, r14
je 0x14033c9b6
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
mov rcx, r14
call fcn.140320810
movzx eax, byte [rsp + 0x68]
mov qword [r15 + 8], rbx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14033c9c6
mov byte [rcx], al
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x14033d180
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
lea rbp, vtable.grpc_core::ExecCtx.0
mov qword [rax - 0x58], rbp
xor ebx, ebx
mov qword [rax - 0x50], rbx
xorps xmm0, xmm0
movdqa xmmword [rax - 0x48], xmm0
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bl
mov qword [rsp + 0x68], rbx
mov ecx, dword [0x140696aa8]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
test byte [rsp + 0x58], 4
jne 0x14033d201
call fcn.14033c520
lea rax, [rsp + 0x30]
mov qword [rsi], rax
call fcn.140356c90
xor ecx, ecx
call fcn.1403574e0
call fcn.14034fb00
movsxd rdi, dword [0x140698938]
test edi, edi
js 0x14033d249
mov rbx, rdi
shl rbx, 4
lea rax, [0x140698948]
add rbx, rax
mov rax, qword [rbx]
test rax, rax
je 0x14033d240
call rax
sub rbx, 0x10
sub edi, 1
jns 0x14033d236
call fcn.1403568f0
call fcn.1400c6de0
call fcn.1400c6de0
call fcn.140353ea0
call fcn.1403570d0
call fcn.140354a60
call fcn.140355a70
call fcn.140357300
call fcn.14033c4a0
nop
mov qword [rsp + 0x30], rbp
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.1403437c0
mov rax, qword [rsp + 0x70]
mov qword [rsi], rax
test byte [rsp + 0x58], 4
jne 0x14033d2a1
call fcn.14033c3b0
nop
mov byte [0x14069892c], 0
mov rcx, qword [0x140698930]
call sub.KERNEL32.dll_WakeAllConditionVariable
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140347770
Capabilities:
Get number of processors

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov r12, r9
mov r15d, r8d
mov r14, rdx
mov rbp, rcx
mov r13, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x138], 0
je 0x1403477f5
lea rax, str._reserved
mov qword [rsp + 0x20], rax
lea r9, str.assertion_failed:__s
mov edx, 0x169
mov r8d, 2
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.1403206e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rax, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x50], rax
xor edi, edi
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x80], eax
mov byte [rsp + 0x84], dil
mov qword [rsp + 0x88], rdi
mov ecx, dword [0x140696aa8]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rax, qword [rsi]
mov qword [rsp + 0x90], rax
call fcn.14033c520
lea rax, [rsp + 0x50]
mov qword [rsi], rax
test rbx, rbx
je 0x140347888
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x14055dfd0]
call fcn.140354070
mov rdi, rax
xor r8d, r8d
mov rdx, r13
lea rcx, [0x14055df70]
call fcn.140354070
mov rbx, rax
mov rax, qword [rsp + 0x40]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140343a60
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8d, r15d
mov rdx, r14
mov rcx, rbp
call fcn.140347160
mov rbx, rax
lea rax, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x50], rax
or qword [rsp + 0x78], 1
lea rcx, [rsp + 0x50]
call fcn.1403437c0
mov rcx, qword [rsp + 0x90]
mov qword [rsi], rcx
test byte [rsp + 0x78], 4
jne 0x140347914
call fcn.14033c3b0
nop
mov rax, rbx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140347ba0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14065ef68]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rdi, rcx
xor ecx, ecx
call fcn.14035b0c0
mov rsi, rax
lea r14, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x30], r14
xor ebp, ebp
mov qword [rsp + 0x38], rbp
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bpl
mov qword [rsp + 0x68], rbp
mov ecx, dword [0x140696aa8]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
call fcn.14033c520
lea rax, [rsp + 0x30]
mov qword [rbx], rax
cmp byte [0x140699358], bpl
je 0x140347c74
mov qword [rsp + 0x20], rdi
lea r9, str.grpc_channel_destroy_channel_p_
mov edx, 0x1dd
lea r8d, [rbp + 1]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.1403206e0
lea rdx, str.Channel_Destroyed
lea rcx, [rsp + 0x88]
call fcn.140345460
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb8], xmm1
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov edx, 0x1df
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.14034e1d0
mov qword [rsi + 0x18], rax
xor edx, edx
lea rcx, [rdi + 0x70]
call fcn.14035b900
mov r8, qword [rax]
mov rdx, rsi
mov rcx, rax
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
or rax, 0xffffffffffffffff
lock xadd qword [rdi + 0x70], rax
cmp rax, 1
jne 0x140347cf6
lea rcx, [rdi + 0x70]
call fcn.14035b170
nop
mov qword [rsp + 0x30], r14
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.1403437c0
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
test byte [rsp + 0x58], 4
jne 0x140347d20
call fcn.14033c3b0
nop
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1402f2210
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14034bd90
Capabilities:
Hash data using murmur3

Disassembly:
mov r8d, dword [rcx + 8]
test r8d, r8d
je 0x14034bde1
mov rax, qword [rdx]
cmp r8d, 1
je 0x14034bddd
test rax, rax
je 0x14034bdad
mov r9, qword [rdx + 8]
jmp 0x14034bdb2
movzx r9d, byte [rdx + 8]
test rax, rax
je 0x14034bdca
mov rcx, qword [rdx + 0x10]
mov rdx, r9
mov r8d, dword [0x14069b25c]
jmp fcn.14041ff70
mov r8d, dword [0x14069b25c]
lea rcx, [rdx + 9]
mov rdx, r9
jmp fcn.14041ff70
mov eax, dword [rax + 0x60]
ret
mov rcx, qword [rdx]
lea rax, [0x1406620a0]
sub rcx, rax
movabs rax, 0x6666666666666667
imul rcx
lea rax, [0x14069b0b0]
sar rdx, 4
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov eax, dword [rax + rdx*4]
ret
Function at 0x140351280
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push r15
sub rsp, 0xe0
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea r15, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rax - 0x80], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x70], eax
mov byte [rsp + 0x74], 0
mov qword [rsp + 0x78], 0
mov ecx, dword [0x140696aa8]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov r14, qword [rax + rcx*8]
add r14, rdx
mov rax, qword [r14]
mov qword [rsp + 0x80], rax
call fcn.14033c520
lea rax, [rsp + 0x40]
mov qword [r14], rax
cmp byte [0x140699358], 0
je 0x14035135a
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, str.grpc_insecure_channel_create_target_s__args_p__reserved_p_
mov edx, 0x5e
lea r8d, [rdx - 0x5d]
lea rcx, str.D:p4grpc1.22.1_src_srccoreext_transportchttp2clientinsecurechannel_create.cc
call fcn.1403206e0
test rbx, rbx
je 0x14035138e
lea rax, str.reserved__nullptr
mov qword [rsp + 0x20], rax
lea r9, str.assertion_failed:__s
mov edx, 0x5f
lea r8d, [rdx - 0x5d]
lea rcx, str.D:p4grpc1.22.1_src_srccoreext_transportchttp2clientinsecurechannel_create.cc
call fcn.1403206e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rdx, [0x140351240]
lea rcx, [0x140699340]
call fcn.14033c820
mov rdx, qword [0x140699338]
lea rcx, [rsp + 0xb8]
call fcn.14036fef0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa8], xmm1
mov r8d, 1
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.140367ac0
mov rbx, rax
mov rcx, qword [0x140699338]
mov r9, qword [rcx]
mov r8, rax
mov rdx, rsi
call qword [r9 + reloc.WS2_32.dll_recv]
mov rdi, rax
mov rcx, rbx
call fcn.140367e10
test rdi, rdi
jne 0x14035141e
lea r8, str.Failed_to_create_client_channel
lea edx, [rdi + 0xd]
mov rcx, rsi
call fcn.14034a4f0
mov rdi, rax
mov qword [rsp + 0x40], r15
or qword [rsp + 0x68], 1
lea rcx, [rsp + 0x40]
call fcn.1403437c0
mov rcx, qword [rsp + 0x80]
mov qword [r14], rcx
test byte [rsp + 0x68], 4
jne 0x14035144b
call fcn.14033c3b0
nop
mov rax, rdi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1403516c0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov qword [rax - 0x168], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14065ef68]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rdx
mov rdi, rcx
lea rbp, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x30], rbp
xor esi, esi
mov qword [rsp + 0x38], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], sil
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x140696aa8]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov r14, qword [rax + rcx*8]
add r14, rdx
mov rax, qword [r14]
mov qword [rsp + 0x70], rax
call fcn.14033c520
lea rax, [rsp + 0x30]
mov qword [r14], rax
mov qword [rdi], rbx
cmp dword [rbx + 8], esi
jne 0x140351812
lea rcx, [rsp + 0x90]
call fcn.1403525b0
mov rax, qword [rdi]
cmp dword [rax + 8], esi
jne 0x140351792
cmp dword [rax + 0x10], esi
jne 0x140351792
mov qword [rdi + 8], rax
jmp 0x14035180f
lea rbx, [rax + 0x18]
mov ecx, dword [rax + 0x10]
call fcn.140353000
mov ecx, eax
lea r8, [rsp + 0x90]
mov rdx, rbx
call fcn.140372ab0
test eax, eax
jne 0x1403517e9
mov rax, qword [rdi]
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r9, str.Unexpected_error_decompressing_data_for_algorithm_with_enum_value__d.
mov edx, 0x3d
lea r8d, [rdx - 0x3b]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surface_byte_buffer_reader.cc
call fcn.1403206e0
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
jmp 0x140351817
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
call fcn.1403515f0
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x90]
call fcn.140351be0
mov dword [rdi + 0x10], esi
mov esi, 1
mov qword [rsp + 0x30], rbp
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.1403437c0
mov rcx, qword [rsp + 0x70]
mov qword [r14], rcx
test byte [rsp + 0x58], 4
jne 0x140351841
call fcn.14033c3b0
nop
mov eax, esi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1402f2210
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret