Function at 0x1400020f0
Capabilities:
Hash data with crc32
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0xa0
mov rax, qword [0x140066008]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor r12d, r12d
mov qword [rsp + 0x58], 0x100000
mov dword [rsp + 0x28], r12d
lea rcx, str.LOG:C:UsersPublicMyLog
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
lea r8d, [r12 + 3]
call qword [sym.imp.clfsw32.dll_CreateLogFile]
cmp rax, 0xffffffffffffffff
je 0x140002aa3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 4
lea r8d, [r12 + 3]
lea rcx, str.LOG:C:UsersPubliclllllog
call qword [sym.imp.clfsw32.dll_CreateLogFile]
cmp rax, 0xffffffffffffffff
je 0x140002aa3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x1000
lea r9d, [r12 + 4]
mov ecx, 0x500000
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140002aa3
mov rcx, qword [0x140078500]
lea r9d, [r12 + 4]
mov edx, 0x1000
mov r8d, 0x3000
mov qword [rcx + 0x70], rax
movabs rcx, 0x110000000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140002aa3
mov rcx, qword [0x140078500]
mov esi, 0x40
mov rdx, qword [rcx + 0x70]
mov qword [rcx + 0x78], rax
mov ecx, esi
nop dword [rax + rax]
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rdx
mov qword [rax - 0x20], rdx
mov qword [rax - 0x18], rdx
mov qword [rax - 0x10], rdx
mov qword [rax - 8], rdx
sub rcx, 1
jne 0x140002210
lea rcx, str.RtlClearBit
call fcn.140001410
mov rcx, qword [0x140078500]
mov rdx, qword [rcx + 0x70]
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
lea rdx, [rdx + 0x40]
mov qword [rdx - 0x28], rax
mov qword [rdx - 0x20], rax
mov qword [rdx - 0x18], rax
mov qword [rdx - 0x10], rax
mov qword [rdx - 8], rax
sub rcx, 1
jne 0x140002260
lea rcx, str.IoSizeofWorkItem
call fcn.140001410
mov rdx, qword [0x140078500]
mov rcx, qword [rdx + 0x70]
mov qword [rcx + 8], rax
mov rcx, qword [rdx + 0x78]
mov rax, qword [rdx + 0x38]
mov qword [rcx + 8], rax
mov rcx, qword [0x140066be0]
cmp rcx, 0xffffffffffffffff
je 0x140002aa3
mov edx, 8
mov r8d, 0x7a00
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002aa3
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, str.C:UsersPubliclllllog.blf
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r12
mov r8d, 0x7a00
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rdi + 0x68]
lea rbx, [rdi + 0x1fe]
add rcx, rdi
mov r8d, r12d
cmp r12w, word [rdi + 4]
jae 0x14000237f
mov rdx, rbx
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 0x200]
movzx eax, word [rdi + 4]
inc r8d
cmp r8d, eax
jl 0x140002362
mov eax, dword [rdi + 0x10]
lea rdx, [rdi + 0x70]
xor eax, 1
mov dword [rdi + 0x28], 0x71
and eax, 0xfffffffd
lea rcx, [rdi + 0x71]
mov r8d, 0x5000
mov dword [rdi + 0x10], eax
call fcn.140006210
movdqa xmm0, xmmword [str.ffffffffffffffff_]
mov r8d, r12d
mov rax, qword [0x140078500]
movups xmmword [rdi + 0x15d1], xmm0
movups xmmword [rdi + 0x15e1], xmm0
movups xmmword [rdi + 0x15f1], xmm0
mov r9d, dword [rdi + 0x68]
mov dword [rdi + 0x15c5], 0x1560
add r9, rdi
mov dword [rdi + 0x15c1], 0x1590
mov dword [rdi + 0x15d1], 0xc1fdf008
mov dword [rdi + 0x15d5], 0x30
mov dword [rdi + 0x15e1], r12d
mov rcx, qword [rax + 0x78]
movzx eax, word [rdi + 4]
mov qword [rdi + 0x15e9], rcx
mov dword [rdi + 0xc], r12d
cmp r12w, ax
jae 0x140002481
mov rdx, r12
mov r10d, 0x50
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 0x200]
mov word [r9 + rdx*2], ax
inc r8d
movzx eax, word [rdi + 4]
mov ecx, 0x20
cmp eax, r8d
movzx eax, byte [rdi + 2]
cmovne cx, r12w
shl ax, 8
or cx, ax
mov eax, 0x10
test rdx, rdx
cmove ax, r10w
inc rdx
or cx, ax
mov word [rbx - 0x200], cx
movzx eax, word [rdi + 4]
cmp r8d, eax
jl 0x140002430
and dword [rdi + 0x10], 0xfffffffd
mov r9, rdi
or dword [rdi + 0x10], 1
mov edx, 0xffffffff
movzx r8d, ax
shl r8d, 9
test r8d, r8d
je 0x1400024cd
lea r10, [0x140062100]
nop word [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
xor edx, dword [r10 + rax*4]
add r8d, 0xffffffff
jne 0x1400024b0
not edx
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rdi + 0xc], edx
mov dword [rsp + 0x28], 0x80
lea rcx, str.C:UsersPubliclllllog.blf
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r12
mov r8d, 0x7a00
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xffffffffffffffff
call fcn.1400016a0
mov r15, rax
lea rdi, [rax + 0x398]
call fcn.14001ca60
movzx r8d, ax
lea rdx, str.C:UsersPublic_x
lea rcx, [0x140078520]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x40]
lea r8, [0x140078520]
xor r9d, r9d
lea rdx, [rsp + 0x58]
call qword [sym.imp.clfsw32.dll_AddLogContainer]
test eax, eax
je 0x140002aa3
mov edx, 0x28
mov r8d, 0x1ff
call fcn.140001000
mov edx, 0x68
lea r8d, [rdx - 0x40]
call fcn.140001000
mov rcx, qword [0x140066be0]
cmp rcx, 0xffffffffffffffff
je 0x140002aa3
mov edx, 8
mov r8d, 0x10000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140002aa3
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, str.C:UsersPublicMyLog.blf
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov rbx, rax
lea edx, [r9 + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r12
mov r8d, 0x100
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, str.C:UsersPublicMyLog.blf
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x1ff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r12
mov r8d, 0x100
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x313
mov r8d, 2
call fcn.140001000
mov edx, 0x317
mov r8d, 9
call fcn.140001000
mov edx, 0x319
mov r8d, 9
call fcn.140001000
xor r8d, r8d
mov edx, 0x31b
call fcn.140001000
mov edx, 0x31f
mov r8d, 9
call fcn.140001000
mov edx, 0x323
mov r8d, 3
call fcn.140001000
mov edx, 0x32b
mov r8d, 2
call fcn.140001000
mov edx, 0x1b98
mov r8d, 0x65c8
call fcn.140001000
mov edx, 0x9598
mov r8d, 0x65c8
call fcn.140001000
xor edx, edx
mov r8d, 0x400
call fcn.1400010b0
mov edx, 0x800
mov r8d, 0x7a00
call fcn.1400010b0
mov edx, 0x8200
mov r8d, 0x7a00
call fcn.1400010b0
mov rcx, qword [0x140066be0]
cmp rcx, 0xffffffffffffffff
je 0x140002aa3
mov edx, 8
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140002aa3
mov rcx, rax
nop dword [rax]
nop word [rax + rax]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea rcx, [rcx + 0x40]
mov qword [rcx - 0x28], rdi
mov qword [rcx - 0x20], rdi
mov qword [rcx - 0x18], rdi
mov qword [rcx - 0x10], rdi
mov qword [rcx - 8], rdi
sub rsi, 1
jne 0x1400027b0
mov rax, qword [0x140078500]
mov r8, rbp
mov edx, 0xa0
cmp dword [rax + 0x80], r12d
je 0x14000287c
mov ecx, 0x20000
call fcn.140001220
mov r8, rbp
mov edx, 0x7b0
mov ecx, 0x20000
mov rsi, rax
call fcn.140001220
mov r8, rbp
mov edx, 0xa0
mov ecx, 0x2000
mov rdi, rax
call fcn.140001220
mov rcx, rsi
mov rbx, rax
call fcn.140001310
mov rcx, rdi
call fcn.140001310
mov rcx, rbx
call fcn.140001310
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 4
lea rcx, str.LOG:C:UsersPublicMyLog
lea r8d, [r9 + 3]
call qword [sym.imp.clfsw32.dll_CreateLogFile]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002a9d
jmp 0x14000294a
mov ecx, 0x2000
call fcn.140001220
mov r8, rbp
mov edx, 0xa0
mov ecx, 0x20000
mov rbx, rax
call fcn.140001220
mov rcx, rbx
mov rdi, rax
call fcn.140001310
mov rcx, rdi
call fcn.140001310
mov ecx, dword [rdi + 4]
cmp ecx, 0x1000
jbe 0x1400028c0
mov esi, 0xe
jmp 0x1400028cb
xor edx, edx
mov eax, 0x1000
div ecx
mov esi, eax
mov rcx, qword [0x140066be0]
cmp rcx, 0xffffffffffffffff
je 0x140002aa3
mov edx, 8
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140002aa3
mov ebx, r12d
cmp dword [rdi], r12d
jbe 0x140002844
xor edx, edx
mov eax, ebx
div esi
test edx, edx
jne 0x14000293f
mov r8d, dword [rdi + 4]
lea r9, [rsp + 0x48]
mov ecx, ebx
mov rdx, rbp
inc rcx
mov dword [rsp + 0x48], r12d
add rcx, rcx
mov qword [rsp + 0x20], r12
mov rcx, qword [rdi + rcx*8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002aae
inc ebx
cmp ebx, dword [rdi]
jb 0x140002905
jmp 0x140002844
xor r9d, r9d
lea r8, str.C:UsersPubliccontain1
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.clfsw32.dll_AddLogContainer]
mov rcx, qword [0x140066be0]
cmp rcx, 0xffffffffffffffff
je 0x140002aa3
mov edx, 8
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140002aa3
mov rcx, qword [0x140066be0]
cmp rcx, 0xffffffffffffffff
je 0x140002aa3
mov edx, 8
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140002aa3
mov dword [rsp + 0x4c], r12d
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x38], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x4c]
mov r9d, 0x1000
mov qword [rsp + 0x30], rcx
mov r8, rbx
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x28], 0x1000
mov rcx, rdi
mov edx, 0x8007a84c
mov qword [rsp + 0x20], rax
mov byte [rbx], 1
mov dword [rbx + 4], 0xff8
mov dword [rbx + 0x2c], 2
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140078500]
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
xorps xmm0, xmm0
mov dword [rsp + 0x50], 1
mov r9d, 1
mov dword [rsp + 0x20], 0xd
movups xmmword [rsp + 0x60], xmm0
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r15 + 0x14d1]
call fcn.140001e60
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140002bf0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
call fcn.14000a970
int3
mov ecx, 1
call fcn.14000a970
int3