joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f27d8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
mov rbx, r8
mov r8, qword [rdx]
test r8, r8
je 0x1400f27f2
mov r8, qword [r8]
lea r9, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
test eax, eax
js 0x1400f2829
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.14007d630
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400f2838
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 2
jb 0x1400f2845
mov rax, rcx
ret

Function at 0x1400f65b0
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 8
jmp fcn.140214c50

Function at 0x1400f68f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [0x1403a9cf0]
lea rdx, [rbp - 0x39]
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov word [rbp - 0x11], di
movdqu xmmword [rbp - 1], xmm0
mov dword [rbp - 0x39], edi
call qword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
nop dword [rax + rax]
mov edx, dword [rbp - 0x39]
lea rcx, [rbp - 0x29]
call fcn.1400ab794
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 0x39]
call qword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1400f69b1
mov r8d, dword [rbp - 0x39]
lea rcx, [rbp + 0x2f]
mov rdx, qword [rbp - 0x29]
dec r8d
call fcn.140076ad8
mov rdx, rax
lea r8, [0x1403a9ce8]
lea rcx, [rbp + 0xf]
call fcn.140076bd4
lea r8, str.MicrosoftWindows_Defender_Advanced_Threat_Protection_
mov rdx, rax
mov rcx, rbx
call fcn.140076bd4
lea rcx, [rbp + 0xf]
call fcn.14007a7c0
lea rcx, [rbp + 0x2f]
call fcn.14007a7c0
jmp 0x1400f6a07
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x1400f69f8
lea rcx, str.GetAllUsersProfileDirectory_failed
mov dword [rbp - 0x35], edi
mov qword [rbp - 0x31], rcx
lea rdx, [0x14044e747]
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x35]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000b51c
lea rdx, str.MicrosoftWindows_Defender_Advanced_Threat_Protection_
mov rcx, rbx
call fcn.14008c350
lea rcx, [rbp - 0x29]
call fcn.1400f6764
lea rcx, [rbp - 0x11]
call fcn.14007a7c0
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400f7514
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, r9
mov rsi, rdx
mov r9, rcx
movzx edx, byte [r8]
mov eax, edx
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov r8, qword [r9 + 0x30]
and r8, rax
mov r10, r8
add r10, r10
mov rax, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
mov rcx, qword [rax + r10*8]
cmp rdi, rcx
je 0x1400f75a4
mov rdi, qword [rax + r10*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rcx
je 0x1400f75a4
mov rdi, qword [rdi + 8]
cmp dl, byte [rdi + 0x10]
jne 0x1400f757c
mov rdx, rbx
mov rcx, r9
call fcn.1400f765c
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400f7642
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400f75d9
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rax, qword [r9 + 0x18]
mov rdx, qword [rax + r10*8]
mov rcx, r8
add rcx, rcx
cmp rdx, qword [r9 + 8]
jne 0x1400f75fc
mov qword [rax + rcx*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r10*8 + 8], rbx
jmp 0x1400f762f
shl r8, 4
add r8, rax
cmp rdx, rdi
jne 0x1400f760d
mov qword [r8], rbx
jmp 0x1400f762f
mov rax, qword [r8 + 8]
mov rcx, qword [rax]
mov qword [r8 + 8], rcx
cmp rcx, rbx
je 0x1400f762f
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.140100854
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400fb8a8
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movzx esi, byte [r8]
mov r14, rcx
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
mov eax, esi
xor rax, rcx
movabs rcx, 0x100000001b3
mov r15, qword [r14 + 0x30]
mov r11, qword [r14 + 8]
imul rax, rcx
mov rcx, qword [r14 + 0x18]
and r15, rax
mov rdx, r15
add rdx, rdx
mov r10, qword [rcx + rdx*8]
mov rbp, r10
cmp qword [rcx + rdx*8], r11
jne 0x1400fb90e
mov rax, r11
jmp 0x1400fb916
mov rax, qword [rcx + rdx*8 + 8]
mov rax, qword [rax]
cmp r10, rax
je 0x1400fb957
cmp byte [r10 + 0x10], sil
je 0x1400fb926
mov r10, qword [r10]
jmp 0x1400fb900
mov rbx, r10
mov r8, r15
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400b81f4
cmp r10, qword [rax]
je 0x1400fb949
cmp sil, byte [r10 + 0x10]
jne 0x1400fb949
mov r10, qword [r10]
jmp 0x1400fb929
cmp rbp, r10
je 0x1400fb957
mov qword [rdi], rbx
mov qword [rdi + 8], r10
jmp 0x1400fb95e
mov qword [rdi], r11
mov qword [rdi + 8], r11
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400fb984
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r9d, byte [rdx]
movabs rdx, 0xcbf29ce484222325
mov r8, qword [rcx + 0x30]
mov eax, r9d
mov r10, qword [rcx + 0x18]
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov rdx, qword [rcx + 8]
and r8, rax
add r8, r8
mov rax, qword [r10 + r8*8]
cmp qword [r10 + r8*8], rdx
jne 0x1400fb9cb
mov rcx, rdx
jmp 0x1400fb9d3
mov rcx, qword [r10 + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400fb9e3
cmp byte [rax + 0x10], r9b
je 0x1400fb9e6
mov rax, qword [rax]
jmp 0x1400fb9c0
mov rax, rdx
cmp rax, rdx
jne 0x1400fb9ff
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop dword [rax + rax]
int3
add rax, 0x18
add rsp, 0x28
ret
Function at 0x140107e20
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x90
and qword [rbp + 7], 0
mov rbx, r8
mov r8, qword [rbp + 0x7f]
mov r14, r9
mov rsi, rdx
mov byte [r9], 1
mov rdi, rcx
lea rdx, [rbp + 7]
mov rcx, rbx
mov r9d, 0x20019
call fcn.1400b2da8
mov r15d, eax
test eax, eax
je 0x140107eed
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x140107ecf
cmp qword [rbx + 0x18], 8
mov qword [rbp + 0xf], rsi
jb 0x140107e89
mov rbx, qword [rbx]
lea rcx, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rcx
lea rdx, [0x14044396a]
lea rcx, [rbp + 0xf]
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x1f]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140002998
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140107fb8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140107fb8
cmp qword [rdi + 0x18], 8
mov rdx, rdi
mov dword [rbp - 1], 8
jb 0x140107f01
mov rdx, qword [rdi]
mov rcx, qword [rbp + 7]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 0x2f]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x140107fa7
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x140107faf
cmp qword [rbx + 0x18], 8
mov qword [rbp + 0x1f], rsi
mov dword [rbp + 0x77], r15d
jb 0x140107f4c
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov qword [rbp + 0x17], rbx
jb 0x140107f5a
mov rdi, qword [rdi]
lea rcx, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x27], rcx
lea rdx, [0x1404439ae]
lea rcx, [rbp + 0x1f]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x27]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400045ac
jmp 0x140107faf
mov rsi, qword [rbp + 0x2f]
mov byte [r14], 0
lea rcx, [rbp + 7]
call fcn.1400f8348
lea r11, [rsp + 0x90]
mov rax, rsi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140108df4
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rbx, [0x1404f9028]
lea rdx, [0x1403a9f84]
lea rcx, [rsp + 0x28]
call fcn.14008c350
nop
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140108e51
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.14007d630
lea rdx, [0x1403a9ce8]
lea rcx, [rsp + 0x28]
call fcn.140077830
mov rdx, rax
mov rcx, rbx
call fcn.140099980
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140108e8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
call fcn.14007e6f0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140112420
add rsp, 0x270
pop rbx
ret

Function at 0x14010a25c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
lea rdi, [0x1404fcd28]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14010a317
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14010a2d1
movzx ebx, ax
or ebx, 0x80070000
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x14010a30e
lea rcx, str.DataCollection_adapter_failed_to_read_Profiles_Directory
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rcx
lea rdx, [0x140453711]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000789c
lea rdx, [0x1403a9f84]
jmp 0x14010a31c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14008c350
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14010a46c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
lea rdi, [0x1404fcd08]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14010a51f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14010a4d9
movzx ebx, ax
or ebx, 0x80070000
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x14010a516
lea rcx, str.DataCollection_adapter_failed_to_read_Windows_Directory
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rcx
lea rdx, [0x140453711]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000789c
lea rdx, [0x1403a9f84]
jmp 0x14010a524
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14008c350
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x14010a558
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
mov dword [rsp + 0x20], 1
mov edx, 0x103
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14010a5dc
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14008c350
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1402530b8
lea rcx, [rsp + 0x30]
call fcn.14007a7c0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret

Function at 0x14010c018
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
cmp rdx, 0x400
jbe 0x14010c060
lea rbx, [rdx - 0x401]
shr rbx, 0xa
inc rbx
imul rax, rbx, 0xfffffffffffffc00
add rdi, rax
mov r8d, 0x400
lea rdx, [0x1403ab3c0]
call fcn.1400d40b0
mov ecx, eax
sub rbx, 1
jne 0x14010c046
mov r8, rdi
lea rdx, [0x1403ab3c0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400d40b0

Function at 0x14010c95c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rdx]
mov rbx, r8
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400ae9d9.0]
mov rcx, qword [rbx]
mov edx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x14010c9a2
mov rcx, qword [rbx]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
add rsp, 0x20
pop rbx
ret
Function at 0x140110cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.140099980
lea rdx, [0x1403ade78]
lea rcx, [rbp - 0x30]
call fcn.14008c350
mov r8, qword [rbp - 0x20]
mov ebx, 1
test r8, r8
je 0x140110d8d
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x140110d8d
cmp rax, r8
jb 0x140110d80
cmp qword [rbp - 0x18], 8
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
cmovae rdx, qword [rbp - 0x30]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x140110d8d
mov rax, qword [rbp - 0x40]
cmp rax, 0x104
jb 0x140110d8d
mov dil, bl
jmp 0x140110d90
xor dil, dil
lea rcx, [rbp - 0x30]
call fcn.14007a7c0
test dil, dil
je 0x140110dc6
mov r8, rsi
lea rdx, [0x1403ade78]
lea rcx, [rbp - 0x30]
call fcn.140077558
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14008aed0
lea rcx, [rbp - 0x30]
call fcn.14007a7c0
cmp qword [rbp - 0x38], 8
lea rcx, [rbp - 0x50]
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140110df6
test al, 0x10
je 0x140110deb
xor bl, bl
lea rcx, [rbp - 0x50]
call fcn.14007a7c0
jmp 0x140110e2b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7b
je 0x140110e0e
add eax, 0xfffffffe
cmp eax, ebx
ja 0x140110e10
xor bl, bl
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140110e2b
mov rcx, qword [rbp - 0x50]
lea rdx, [rdx*2 + 2]
call fcn.14007e6f0
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140115680
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov r13, rsi
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov qword [rsp], r8
mov r8d, dword [rsp + 0x98]
mov r14, rdx
mov r15, rcx
xor eax, eax
mov esi, dword [rsi]
mov ebx, dword [rbx]
mov qword [rsp + 8], rax
jmp 0x1401156e8
add eax, 1
add esi, 1
mov dword [rsp + 8], eax
cmp esi, dword [rsp + 0xa0]
jge 0x140115819
cmp eax, dword [rsp + 0xa8]
jge 0x140115819
movzx eax, byte [rsi + rdi + 2]
shl ebx, 5
xor ebx, eax
mov r11, rsi
and ebx, r8d
movsxd rbp, dword [r9 + rbx*4]
mov dword [r9 + rbx*4], esi
mov r12, rdi
sub r11, rbp
cmp r11d, dword [rsp + 0x90]
jge 0x1401157e9
cmp ebp, dword [rsp + 0xb0]
jge 0x14011573b
mov r12, qword [rsp]
movzx eax, word [rsi + rdi]
lea r10, [rsi + rdi]
movzx ecx, word [rbp + r12]
lea r12, [rbp + r12]
cmp eax, ecx
jne 0x1401157e9
xor ecx, ecx
mov rax, qword [rcx + r10]
mov rdx, qword [rcx + r12]
xor rax, rdx
jne 0x140115783
add ecx, 8
cmp ecx, 0x100
jl 0x140115758
movzx eax, word [rcx + r10]
movzx edx, word [rcx + r12]
xor eax, edx
jne 0x140115783
add ecx, 2
jmp 0x14011578d
bsf rax, rax
shr rax, 3
add ecx, eax
cmp ecx, 3
jl 0x1401157e9
lea rbp, [rsi + 1]
lea rsi, [rcx + rsi - 1]
lea rdx, [rcx - 3]
movzx ecx, byte [rbp + rdi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, r8d
mov dword [r9 + rbx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x14011579f
lea rcx, [r11 - 1]
cmp r11, 0x101
jl 0x1401157cd
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [rcx + r13 + 0x100]
add word [r15 + rcx*4], 1
movzx ebp, byte [rdx + r13]
add ebp, 0x101
jmp 0x1401157f2
xor r11, r11
movzx edx, byte [rsi + rdi]
mov ebp, edx
add word [r14 + rbp*4], 1
mov eax, dword [rsp + 8]
mov rcx, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov word [rcx + rax*2], r11w
mov byte [rax + rbp], dl
jmp 0x1401156de
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov dword [rdi], esi
mov dword [rcx], ebx
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
pop rdi
pop rsi
ret
Function at 0x14011ac0c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rsi, r8
xor ebx, ebx
mov qword [r8], rbx
mov r14d, 0x104
mov r8, rcx
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.14011aa24
lea r8, [0x1403c0290]
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.14011a920
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14011acc1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14011adb5
mov rcx, qword [rbp + 0x178]
lea r8, [0x1403c01cc]
lea edx, [r14 - 0x3b]
call fcn.1400ca148
mov ebx, eax
jmp 0x14011adb5
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], ebx
mov rcx, rax
mov dword [rsp + 0x20], ebx
call fcn.140119c38
mov edi, eax
test eax, eax
jns 0x14011acfe
mov rcx, qword [rbp + 0x178]
lea r8, [0x1403c01cc]
mov r9d, eax
mov edx, 0xcf
call fcn.140070bd4
mov ebx, edi
jmp 0x14011adb5
lea r8, [0x1403c0298]
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.14011a920
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x14011ad5a
mov rcx, qword [rbp + 0x178]
lea r8, [0x1403c01cc]
mov edx, 0xd5
call fcn.1400ca148
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.14008cd94
jmp 0x14011adb5
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140119c38
mov edi, eax
test eax, eax
jns 0x14011ad97
mov rcx, qword [rbp + 0x178]
lea r8, [0x1403c01cc]
mov r9d, eax
mov edx, 0xd7
call fcn.140070bd4
lea rcx, [rsp + 0x28]
call fcn.14008cd94
jmp 0x14011acf7
lea rcx, [rsp + 0x28]
call fcn.14008cd94
movsxd rdx, dword [rsp + 0x20]
movsxd rcx, dword [rsp + 0x24]
shl rdx, 0x1f
or rcx, rdx
mov qword [rsi], rcx
lea rcx, [rsp + 0x30]
call fcn.14008cd94
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14013d210
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x48
mov rdi, rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400ae9d9.0]
mov rcx, rdi
call fcn.14013e0ac
nop
lea rbx, [rdi + 0x90]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x14013e1f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400dc334
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
jne 0x14013d2f6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14013d298
movzx ebx, ax
or ebx, 0x80070000
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x14013d2f2
add rdi, 0x40
cmp qword [rdi + 0x18], 8
jb 0x14013d2b0
mov rdi, qword [rdi]
mov qword [rsp + 0x70], rdi
lea rcx, str.Failed_to_create_a_working_thread_to_process_ETW_session
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x60], ebx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea rdx, [0x140443866]
mov rcx, rax
call fcn.140009c94
mov eax, ebx
jmp 0x14013d34a
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x14013d342
add rdi, 0x40
cmp qword [rdi + 0x18], 8
jb 0x14013d30e
mov rdi, qword [rdi]
mov qword [rsp + 0x60], rdi
lea rcx, str.Worker_thread_for_created
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1404435c5]
mov rcx, rax
call fcn.1400056ec
xor eax, eax
jmp 0x14013d34a
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x14013e97c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
cmp edx, 0x800705aa
je 0x14013ea20
test byte [0x1404e2680], 2
je 0x14013e9bd
lea r8, [rcx + 0x40]
cmp qword [r8 + 0x18], 8
jb 0x14013e9ae
mov r8, qword [r8]
mov r9d, ebx
lea rdx, [0x1403c6738]
call fcn.14013f8e0
call fcn.140091ae4
cmp dword [rax], 1
jbe 0x14013eaf5
lea rcx, [rdi + 0x40]
cmp qword [rcx + 0x18], 8
jb 0x14013e9d9
mov rcx, qword [rcx]
mov qword [rsp + 0x78], rcx
lea rdx, [0x1404438a3]
lea rcx, str.EtwEventListener::Start_failed
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140009c94
jmp 0x14013eaf5
lea rbx, [rcx + 0xe8]
xor edx, edx
mov rcx, rbx
call fcn.1400e2aec
cmp qword [rbx], 0
lea rdx, str.Failed_to_create_an_event._Listener_initialization_failed
mov rcx, qword [rsp + 0x58]
lea r8, str.amcorewcd_source_sensorhub_srcetweventlistener.cpp
setne al
mov qword [rsp + 0x20], rdx
movzx r9d, al
mov edx, SysAllocStringByteLen
call fcn.1400d02ac
lea rax, [rsp + 0x70]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14013d360]
and dword [rsp + 0x20], 0
lea rbx, [rdi + 0xe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400dc334
mov rax, qword [rbx]
lea rdx, str.Failed_to_create_a_working_thread._Listener_initialization_failed
mov rcx, qword [rsp + 0x58]
lea r8, str.amcorewcd_source_sensorhub_srcetweventlistener.cpp
dec rax
mov qword [rsp + 0x20], rdx
cmp rax, 0xfffffffffffffffd
mov edx, 0x9d
setbe al
movzx r9d, al
call fcn.1400d02ac
test byte [0x1404e2680], 2
je 0x14013eaf5
lea r8, [rdi + 0x40]
cmp qword [r8 + 0x18], 8
jb 0x14013eae3
mov r8, qword [r8]
mov r9d, 0x800705aa
lea rdx, [0x1403c6728]
call fcn.14013f8e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret