joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f094
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x14007f113
cmp di, word [rcx]
je 0x14007f113
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14007f0bc
lea eax, [rdi + 2]
jmp 0x14007f118
xor ecx, ecx
call fcn.14007edc8
mov rdx, rbx
mov rcx, rax
call fcn.1400827cc
test eax, eax
je 0x14007f10f
mov edx, dword [reloc.OLEAUT32.dll_VariantCopy]
lea rax, [0x140189c58]
mov qword [rsp + 0x28], rax
lea r9, [0x14017b1f0]
mov eax, dword [reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Intel_Corporation
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.1400813a4
test eax, eax
jne 0x14007f10f
mov eax, 5
jmp 0x14007f118
xor eax, eax
jmp 0x14007f118
mov eax, 0x57
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140081b40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x140081ebc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140081b9a
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140081b9a
lea eax, [rbx + 1]
jmp 0x140081b9c
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400825e4
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor edi, edi
mov r12, rdx
mov r14, rcx
test rcx, rcx
je 0x140082738
test rdx, rdx
je 0x140082738
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, 0x8000
mov esi, eax
mov ecx, ebp
call fcn.1400873d0
mov rbx, rax
test rax, rax
jne 0x14008263e
lea edi, [rax + 8]
jmp 0x14008272c
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140082663
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14008272c
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x140082694
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14008272c
mov eax, dword [rsp + 0x70]
mov ebp, edi
shr eax, 3
mov r15b, dil
mov dword [rsp + 0x70], eax
test eax, eax
je 0x140082719
xor eax, eax
mov r13d, ebp
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x20]
mov rcx, rsi
movups xmmword [rsp + 0x20], xmm0
mov rdx, qword [rbx + r13*8]
lea r9d, [rax + 0x18]
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x1400826eb
cmp qword [rsp + 0x20], r14
jg 0x1400826eb
mov eax, dword [rsp + 0x28]
mov rcx, r14
sub rcx, qword [rsp + 0x20]
cmp rcx, rax
jl 0x1400826f5
inc ebp
cmp ebp, dword [rsp + 0x70]
jae 0x140082719
jmp 0x1400826a8
mov rdx, qword [rbx + r13*8]
mov r9d, 0x104
mov r8, r12
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x140082713
mov r15b, 1
jmp 0x140082719
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
jne 0x14008272c
mov edi, 5
mov rcx, rbx
call fcn.14008739c
mov eax, edi
jmp 0x14008273d
mov eax, 0x57
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400833b8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14017b278]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor ebp, ebp
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
lea rbx, [rcx + 0x30]
mov qword [rsp + 0x28], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
lea ecx, [rbp + 0x58]
call fcn.140087674
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov dword [rdi + 0x40], ebp
lea rbx, [rdi + 0x48]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
test rsi, rsi
je 0x140083447
mov rdx, rsi
jmp 0x14008348b
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.14009b2d0
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea rdx, str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14001f470
nop
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140086e90
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x140084d38
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14017b278]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140084dab
cmp byte [rcx + 0x72], 0
je 0x140084dab
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + SafeArrayPutElement]
cmp di, ax
je 0x140084dff
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140084dc5
sub eax, 1
je 0x140084dc9
cmp eax, 2
jne 0x140084dff
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140086e90
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140084df6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1400ad76c
cmp rdi, rax
jne 0x140084dff
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140084dad
xor al, al
jmp 0x140084dad
Function at 0x140085594
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14017b278]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x1400855d6
movzx eax, r14w
jmp 0x140085705
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140085612
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140085612
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140085705
cmp qword [rcx + 0x80], r14
je 0x140085702
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140085650
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140085679
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.1400ac9bc
cmp ax, di
je 0x140085702
movzx edi, si
jmp 0x140085702
lea r8, [rbp - 0x38]
mov word [rbp - 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x3e]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x140085702
cmp eax, 1
jle 0x1400856c7
cmp eax, 3
jne 0x140085702
movzx ecx, word [rbp - 0x40]
jmp 0x14008565c
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1400856f1
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.1400ad76c
cmp r14, rax
jne 0x140085702
lea rax, [rbp - 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rbp - 0x30], rax
movzx eax, si
jne 0x140085705
movzx eax, di
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140086e90
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14008602c
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x14017b278]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rdi, rcx
xor ebx, ebx
cmp dword [rcx + 0x20], ebx
jne 0x140086065
xor eax, eax
jmp 0x14008628a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov r8d, 3
lea rcx, [rsp + 0x60]
call fcn.1400397c0
nop
mov esi, 0x104
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x320]
call fcn.14009b2d0
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x210]
call fcn.14009b2d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov r8, rax
mov edx, esi
lea rcx, [rbp + 0x320]
lea rax, [rbp + 0x320]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400860e7
mov al, byte [r8 + rcx]
test al, al
je 0x1400860e7
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400860c8
lea rax, [rcx - 1]
test rdx, rdx
cmovne rax, rcx
mov byte [rax], bl
mov r8, rsi
lea rcx, [rbp + 0x210]
lea rax, [rbp + 0x210]
mov r9, qword [rsp + 0x60]
sub r9, rax
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x14008612c
mov al, byte [r9 + rcx]
test al, al
je 0x14008612c
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x14008610d
lea rax, [rcx - 1]
test r8, r8
cmovne rax, rcx
mov byte [rax], bl
lea rcx, [rbp + 0x210]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea r8, [0x14011bd8c]
mov rdx, rsi
lea rcx, [rbp + 0x210]
call fcn.140085f80
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
or dword [rsp + 0x38], 0xffffffff
lea rcx, [0x1400862f4]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1400862ac]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1400862fc]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400862ec]
lea r8, [fcn.1400862b4]
lea rdx, [0x14008630c]
lea rcx, [0x140086304]
call rax
mov rsi, rax
test rax, rax
je 0x140086274
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x100]
call fcn.14009b2d0
mov rax, qword [rdi + 0x10]
lea rcx, [rbp + 0x100]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rcx, [0x140086314]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x320]
mov rcx, rsi
call rax
mov rax, qword [rdi + 0x18]
mov rcx, rsi
call rax
lea rcx, [rbp + 0x104]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140086274
cmp dword [rbp + 0x100], ebx
je 0x140086266
lea rax, [rbp - 8]
mov qword [rbp - 0x10], rax
mov r8d, 3
lea rdx, [rbp + 0x104]
lea rcx, [rbp - 0x10]
call fcn.14004c810
nop
mov rcx, qword [rbp - 0x10]
call fcn.1400808f4
mov ebx, eax
lea rax, [rbp - 8]
mov rcx, qword [rbp - 0x10]
cmp rcx, rax
je 0x140086266
call fcn.14009f768
lea rcx, [rbp + 0x104]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x140086288
call fcn.14009f768
mov eax, ebx
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.140086e90
mov rbx, qword [rsp + 0x570]
add rsp, 0x540
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov rbp, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14008d3be
mov rdx, qword [rdi]
movabs rbx, 0xcbf29ce484222325
xor r13d, r13d
mov ecx, r13d
add r8, r8
je 0x14008d3f3
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x14008d3e0
mov r9, rbx
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400238e0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14008d41c
mov qword [r14], rax
mov byte [r14 + 8], r13b
jmp 0x14008d5cc
movabs rax, 0x2aaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
je 0x14008d5e7
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov ecx, 0x60
call fcn.140087674
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rdi
lea rcx, [rax + 0x10]
call fcn.14001f200
mov qword [rsi + 0x30], r13
mov qword [rsi + 0x38], r13
mov qword [rsi + 0x40], r13
mov qword [rsi + 0x48], r13
mov qword [rsi + 0x50], r13
mov qword [rsi + 0x58], r13
mov r9, qword [rbp + 0x10]
lea rcx, [r9 + 1]
movss xmm3, dword [rbp]
xorps xmm0, xmm0
test rcx, rcx
js 0x14008d490
cvtsi2ss xmm0, rcx
jmp 0x14008d4a5
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [rbp + 0x38]
xorps xmm2, xmm2
test rdi, rdi
js 0x14008d4b8
cvtsi2ss xmm2, rdi
jmp 0x14008d4d0
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
seta al
test al, al
je 0x14008d570
divss xmm0, xmm3
call fcn.1400b9ec4
xor ecx, ecx
movss xmm1, dword [0x140158fc0]
comiss xmm0, xmm1
jb 0x14008d513
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14008d513
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x14008d545
cmp rdi, 0x200
jae 0x14008d542
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x14008d545
mov rdi, rcx
mov rdx, rdi
mov rcx, rbp
call fcn.140092ed0
mov r9, rbx
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400238e0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [rbp + 0x10]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
lea rax, [r9 + 1]
mov qword [rbp + 0x10], rax
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x14008d5ad
mov qword [rcx + rax*8], rsi
jmp 0x14008d5bf
cmp r9, rdx
jne 0x14008d5b8
mov qword [rcx + rax*8], rsi
jmp 0x14008d5c4
cmp qword [rcx + rax*8 + 8], r8
jne 0x14008d5c4
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.140088628
int3
Function at 0x14008fe50
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [rsp + 0xb8]
mov rcx, rdx
mov qword [rsp + 0x50], rax
xor edx, edx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
add rsp, 0x68
ret

Function at 0x14008fec0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0xc8]
mov r10, r9
mov r9, qword [rsp + 0x90]
mov r11, r8
mov qword [rsp + 0x50], rax
mov rcx, rdx
mov rax, qword [rsp + 0xc0]
mov r8, r10
mov qword [rsp + 0x48], rax
mov rdx, r11
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
add rsp, 0x60
pop rbx
ret

Function at 0x14008ff40
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [rsp + 0xb0]
mov r10, r9
mov r9, qword [rsp + 0x80]
mov r11, r8
mov qword [rsp + 0x48], rax
mov rcx, rdx
mov rax, qword [rsp + 0xa8]
mov r8, r10
mov qword [rsp + 0x40], rax
mov rdx, r11
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x50
pop rbx
ret
Function at 0x1400931b0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14009338f
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140091180
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140093358
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400932cc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140093347
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x140093309
mov r10, qword [rax]
cmp r10, rcx
je 0x140093303
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140093347
mov r8, rax
cmp r10, rax
je 0x140093323
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x140093369
cmp r10, rax
jne 0x140093311
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140093250
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140093347
lea rcx, str.invalid_hash_bucket_count
call fcn.140088628
int3
Function at 0x140094620
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
lea rbx, [rcx + 8]
mov r9, qword [rcx + 0x30]
mov r11, rdx
mov rdi, qword [rcx + 0x18]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [r11 + 1]
imul r8, rdx
xor r8, rax
movzx eax, byte [r11 + 2]
imul r8, rdx
xor r8, rax
movzx eax, byte [r11 + 3]
imul r8, rdx
xor r8, rax
movzx eax, byte [r11 + 4]
imul r8, rdx
xor r8, rax
movzx eax, byte [r11 + 5]
imul r8, rdx
xor r8, rax
movzx eax, byte [r11 + 6]
imul r8, rdx
xor r8, rax
movzx eax, byte [r11 + 7]
imul r8, rdx
xor r8, rax
imul r8, rdx
and r9, r8
mov r8, qword [rbx]
mov r10, r9
shl r10, 4
add r10, rdi
mov rdx, qword [r10 + 8]
cmp rdx, r8
je 0x14009472f
mov rax, qword [r11]
mov rcx, qword [r10]
cmp rax, qword [rdx + 0x10]
je 0x1400946e0
cmp rdx, rcx
je 0x14009472f
mov rdx, qword [rdx + 8]
cmp rax, qword [rdx + 0x10]
jne 0x1400946d1
test rdx, rdx
je 0x14009472f
add r9, r9
mov rax, qword [rdi + r9*8]
cmp qword [r10 + 8], rdx
jne 0x14009470b
cmp rax, rdx
jne 0x140094701
mov qword [rdi + r9*8], r8
mov qword [r10 + 8], r8
jmp 0x140094717
mov r8, qword [rdx + 8]
mov qword [r10 + 8], r8
jmp 0x140094717
cmp rax, rdx
jne 0x140094717
mov rax, qword [rdx]
mov qword [rdi + r9*8], rax
mov rcx, rbx
call fcn.140094280
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400bd3e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400bd106
call fcn.14009fae0
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.14009f990
jmp 0x1400bd251
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400bd251
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400bd251
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400bd135
lock or dword [rcx + 0x14], 0x10
jmp 0x1400bd251
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400bd149
call fcn.1400bd808
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400bd159
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400bd15c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400bbc4c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400ae660
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400bd23f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400bd1ed
mov rcx, rbx
call fcn.1400bbc4c
cmp eax, 0xffffffff
je 0x1400bd1d8
mov rcx, rbx
call fcn.1400bbc4c
cmp eax, 0xfffffffe
je 0x1400bd1d8
mov rcx, rbx
call fcn.1400bbc4c
movsxd rdi, eax
lea r14, [0x14018b0f0]
mov rcx, rbx
sar rdi, 6
call fcn.1400bbc4c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400bd1df
lea rdx, [0x14017bb60]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400bd1ed
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400bd211
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1400bd211
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1400bd211
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1400bd22f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1400bd23a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400bd256
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400bd0d0
Function at 0x1400c9de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400c9e06
xor eax, eax
cmp ax, word [rcx]
je 0x1400c9e06
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400c9e06
test al, 0x10
je 0x1400c9e06
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret