joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c640
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x120
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0xd0
mov rcx, rdi
call fcn.140152140
mov rcx, rdi
call fcn.140063ad0
mov dword [rsp + 0x20], 1
mov rbx, qword [rsi + 0x18]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
test rbx, rbx
je 0x14006c6de
mov qword [rsp + 0x28], rbx
mov eax, 1
lock xadd dword [rbx], eax
inc eax
cmp eax, 1
jle 0x14006c6cc
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rbx + 4], ecx
je 0x14006c6db
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbx + 4], ecx
inc dword [rbx + 8]
cmp byte [rsi + 0x20], 0
je 0x14006c6fa
lea rdx, str.GetPXHighPerfGPU___called_while_Paused
mov ecx, 1
call fcn.1400838f0
jmp 0x14006c7f7
mov rcx, rsi
call fcn.140066400
movzx edx, byte [rsi + 0xd4]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsi + 0xd5]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsi + 0xd6]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsi + 0xd7]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rsi + 0x108]
and rcx, rdx
add rcx, rcx
mov rax, qword [rsi + 0xf0]
mov rdx, qword [rax + rcx*8 + 8]
mov r8, qword [rsi + 0xe0]
cmp rdx, r8
je 0x14006c7f7
mov rcx, qword [rax + rcx*8]
mov eax, dword [rsi + 0xd4]
cmp eax, dword [rdx + 0x10]
je 0x14006c794
cmp rdx, rcx
je 0x14006c7f7
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x14006c786
test rdx, rdx
cmove rdx, r8
cmp rdx, r8
je 0x14006c7f7
mov rdx, qword [rdx + 0x18]
lea rcx, [rsp + 0x50]
call fcn.140063be0
nop
mov rdx, rax
mov rcx, rdi
call fcn.140063fe0
nop
lea rcx, [rsp + 0xf0]
call fcn.140004ff0
lea rcx, [rsp + 0xb8]
call fcn.140004ff0
lea rcx, [rsp + 0x98]
call fcn.140004ff0
lea rcx, [rsp + 0x78]
call fcn.140004ff0
lea rcx, [rsp + 0x58]
call fcn.140004ff0
nop
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x14006c83c
add dword [r8 + 8], 0xffffffff
mov eax, dword [r8 + 8]
jne 0x14006c814
mov dword [r8 + 4], 0
mov ecx, 0xffffffff
lock xadd dword [r8], ecx
cmp ecx, 1
je 0x14006c83c
test eax, eax
jne 0x14006c83c
xor r8d, r8d
lea edx, [rax + 1]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, rdi
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140072dc0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
test rdx, rdx
je 0x140072fd7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x100
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rsi, rdx
mov rdi, rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
call fcn.14000fad0
mov rbx, rax
call fcn.140062260
mov rcx, rax
mov rdx, rbx
call fcn.1400718a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0x18
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x140072e55
call fcn.140062260
mov rcx, rax
mov rdx, qword [rsp + 0x48]
call fcn.1400548d0
mov rcx, rsi
call fcn.1400730a0
test rax, rax
je 0x140072fb0
mov rcx, rax
call fcn.14010f5e0
mov r14d, eax
xor sil, sil
mov r8d, eax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140072ef7
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140072ee5
lea rdx, str.GetPackageId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140072edc
mov dword [rsp + 0x30], 0
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbp
call rax
movzx esi, sil
mov ecx, 1
cmp eax, 0x3d54
cmovne esi, ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
jne 0x140072f80
mov r8d, r14d
lea rdx, str.AMDSetHookE__X
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, r14d
mov r8d, r14d
lea rdx, str.Signal_mouse_event_process__d___x_
mov ecx, 6
call fcn.140083970
lea r8, [rsp + 0x50]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rdi], rax
test rax, rax
je 0x140072f66
lea r8, str.AMDRemoveHookM
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 8], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140072f80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_open_mouse_event__d
mov ecx, 6
call fcn.140083970
cmp qword [rdi + 0x10], 0
jne 0x140072fb0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x140073270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x10], rax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14014f2f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14007f070
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x780]
sub rsp, 0x880
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rbp + 0x770], rax
mov rdi, rcx
mov rbx, qword [rcx + 0x48]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x20], xmm1
test rbx, rbx
je 0x14007f0f7
mov qword [rsp + 0x20], rbx
mov eax, 1
lock xadd dword [rbx], eax
inc eax
cmp eax, 1
jle 0x14007f0e5
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [rbx + 4], ecx
je 0x14007f0f4
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbx + 4], ecx
inc dword [rbx + 8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.140152140
lea r8, str.OpenCL_ReleaseCommandQueues
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.140155cf8
mov dword [rsp + 0x40], 6
mov byte [rbp + 0x750], 0
xorps xmm0, xmm0
movsd qword [rbp + 0x758], xmm0
mov byte [rbp + 0x760], 0
mov rcx, qword [rdi + 0x58]
xor ebx, ebx
test rcx, rcx
je 0x14007f160
call qword [sym.imp.OpenCL.dll_clReleaseCommandQueue]
mov qword [rdi + 0x58], rbx
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je 0x14007f173
call qword [sym.imp.OpenCL.dll_clReleaseCommandQueue]
mov qword [rdi + 0x60], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x30]
sub rax, qword [rsp + 0x48]
xorps xmm3, xmm3
cvtsi2sd xmm3, rax
mulsd xmm3, qword [0x1401f9d00]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x38]
divsd xmm3, xmm0
comisd xmm3, xmmword [rbp + 0x758]
jbe 0x14007f1fd
cmp byte [rbp + 0x760], 0
je 0x14007f1d2
mov eax, dword [0x140230ce8]
add eax, 0xfffffffe
cmp eax, 1
ja 0x14007f1fd
movq r9, xmm3
lea r8, [rsp + 0x50]
mov ecx, dword [rsp + 0x40]
cmp byte [rbp + 0x750], 0
lea rdx, str._s_end___f_
jne 0x14007f1f7
lea rdx, str._s___f_
call fcn.140083970
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14007f23d
add dword [rcx + 8], 0xffffffff
mov r8d, dword [rcx + 8]
jne 0x14007f214
mov dword [rcx + 4], ebx
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
je 0x14007f23d
test r8d, r8d
jne 0x14007f23d
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor eax, eax
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.14014f2f0
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140080000
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movzx r14d, r8b
mov r15, rdx
mov rbx, rcx
xor edi, edi
mov qword [rbp - 0x19], rdi
call fcn.140061c90
mov rcx, rax
lea rdx, [rbp + 0xf]
call fcn.140014620
nop
lea r8d, [rdi + 1]
lea rdx, [0x1401c8320]
lea rcx, [rbp + 0xf]
call fcn.140011ba0
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.14007ce20
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140080076
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp + 0xf]
call fcn.140011ba0
nop
lea rcx, [rbp - 0x11]
call fcn.140004ff0
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x1400800db
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400800db
lea r8, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae r8, qword [rbp + 0xf]
lea rdx, str.Error_creating_folder:__s
mov ecx, 7
call fcn.1400838f0
jmp 0x1400801ee
mov qword [rbp - 0x11], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov rsi, qword [rbp + 0x1f]
lea rdi, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdi, qword [rbp + 0xf]
cmp rsi, 8
jae 0x140080110
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp + 7], 7
jmp 0x140080150
mov rbx, rsi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x11]
call fcn.140005370
mov qword [rbp - 0x11], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.140151a90
mov qword [rbp + 7], rbx
mov qword [rbp - 1], rsi
mov r8d, 1
lea rdx, [0x1401c8320]
lea rcx, [rbp - 0x11]
call fcn.140011ba0
mov rdx, r15
lea rcx, [rbp - 0x39]
call fcn.14007ce20
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140080184
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x11]
call fcn.140011ba0
nop
lea rcx, [rbp - 0x39]
call fcn.140004ff0
test r14b, r14b
jne 0x1400801b8
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400801e5
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea rax, [0x1401dfac8]
lea r8, [0x1401dfad0]
test r14b, r14b
cmovne r8, rax
lea rcx, [rbp - 0x19]
call fcn.14016e7b8
nop
lea rcx, [rbp - 0x11]
call fcn.140004ff0
mov rbx, qword [rbp - 0x19]
lea rcx, [rbp + 0xf]
call fcn.140004ff0
mov rax, rbx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14014f2f0
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140080bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140080d44
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140080d44
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x140080c4b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x140080d6b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140080c62
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140080c62
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140080c75
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140080cc2
mov r8d, eax
cmp eax, 0x800
jae 0x140080c8f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140080cc2
cmp eax, 0x10000
jae 0x140080ca9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140080cc2
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140080d44
add qword [r14], 2
test sil, sil
jne 0x140080ce3
cmp r10d, 3
jae 0x140080cef
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140080d21
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140080d00
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x140080bff
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140080d52
Function at 0x140081b10
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, r8
mov esi, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov ebx, eax
shl rbx, 0x20
or rbx, rax
movabs rax, 0xf042bb93fe0e6924
xor rbx, rax
xor r14d, r14d
mov eax, r14d
nop dword [rax + rax]
movsxd rcx, eax
movabs rbp, 0x78a923bc025dff38
add rcx, rdi
test cl, 7
je 0x140081b8e
inc eax
cmp eax, 0x10
jl 0x140081b70
jmp 0x140081b95
mov qword [rcx], rbp
mov qword [rcx + 8], rbx
mov ecx, dword [0x14023d458]
mov edx, 0x25dff38
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x14023d45c]
mov edx, 0x78a923bc
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x14023d460]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x14023d464]
mov rdx, rbx
shr rdx, 0x20
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbp
mov ecx, 0x30
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm6, xmm6
call fcn.1401567b4
test rax, rax
jne 0x140081c08
mov eax, 0xffffffff
jmp 0x140081c62
mov dword [rax], 0x30
lea rdx, [rsp + 0x40]
mov qword [rax + 4], 0x300c205
mov dword [rax + 0xc], r14d
movups xmm0, xmmword [rsp + 0x20]
mov rcx, qword [0x14023d248]
mov qword [rsp + 0x48], rax
movups xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], 0x20
movups xmmword [rax + 0x20], xmm6
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], 0x30
call qword [0x14023d2e8]
mov r8d, eax
lea rdx, str.auth_buffer_set__ret__d
mov ecx, 7
call fcn.140083970
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14014f2f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400835b0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
mov eax, 0xc070
call fcn.14014ffe0
sub rsp, rax
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0xc060], rax
mov rdi, r8
mov qword [rsp + 0x38], r8
mov bl, 1
mov word [0x140230d38], 1
xor eax, eax
cmp ecx, 3
cmovl eax, ecx
mov byte [reloc.d2d1.dll_Ordinal_1], 0
mov dword [0x140230ce0], eax
xor eax, eax
cmp edx, 4
cmovl eax, edx
mov byte [reloc.d2d1.dll_Ordinal_1], 0
mov dword [0x140230ce8], eax
lea rbp, [0x140230cf0]
cmp rbp, r8
je 0x140083670
mov qword [rsp + 0x30], rbp
mov eax, dword [r8]
mov dword [0x140230cf0], eax
mov rdx, qword [r8 + 8]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [0x140230cf8]
call fcn.140084840
mov rdx, qword [0x140230d00]
mov rcx, rbp
call fcn.14002b150
mov rdx, rax
mov rcx, rbp
call fcn.1400841b0
nop
mov eax, dword [0x140230ce8]
nop dword [rax + rax]
test eax, 0xfffffffd
jne 0x1400837eb
mov qword [rsp + 0x30], 0
xor ebx, ebx
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401cb710]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x1400837e0
mov r9, qword [rsp + 0x30]
lea r8, str._sAMDCN
mov edx, 0x2000
lea rcx, [rsp + 0x60]
call fcn.14000f700
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400836e5
cmp eax, 0xb7
jne 0x1400837cb
mov edx, 0x20
call fcn.1400839a0
mov rbx, rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, str._sdvrlog_s.txt
mov edx, 0x4000
lea rcx, [rsp + 0x4060]
call fcn.14000f700
mov r8d, 0x20
lea rdx, [0x1401e0980]
lea rcx, [rsp + 0x4060]
call fcn.14016e810
mov qword [0x140230d30], rax
test rax, rax
je 0x1400837cb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str.Process_Id:_d_n
mov rcx, qword [0x140230d30]
call fcn.140082f20
mov ecx, 8
call fcn.14014f310
lea rcx, [0x140083140]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14000f6d0]
xor edx, edx
xor ecx, ecx
call fcn.14016b4dc
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14008382e
cmp dword [rsp + 0x48], 0
je 0x140083841
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140129c40
test eax, eax
jne 0x140083826
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbx
call fcn.140155e3c
mov bl, 1
mov eax, dword [0x140230ce8]
cmp eax, 2
je 0x1400837f0
cmp eax, 3
jne 0x1400837f6
call fcn.1400830e0
nop
mov rcx, rdi
call fcn.140040840
movzx eax, bl
mov rcx, qword [rsp + 0xc060]
xor rcx, rsp
call fcn.14014f2f0
lea r11, [rsp + 0xc070]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ecx, eax
call fcn.1401299dc
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call fcn.140129a18
nop
mov ecx, 1
call fcn.140129a18
int3
Function at 0x140083659
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
mov eax, 0xc070
call fcn.14014ffe0
sub rsp, rax
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0xc060], rax
mov rdi, r8
mov qword [rsp + 0x38], r8
mov bl, 1
mov word [0x140230d38], 1
xor eax, eax
cmp ecx, 3
cmovl eax, ecx
mov byte [reloc.d2d1.dll_Ordinal_1], 0
mov dword [0x140230ce0], eax
xor eax, eax
cmp edx, 4
cmovl eax, edx
mov byte [reloc.d2d1.dll_Ordinal_1], 0
mov dword [0x140230ce8], eax
lea rbp, [0x140230cf0]
cmp rbp, r8
je 0x140083670
mov qword [rsp + 0x30], rbp
mov eax, dword [r8]
mov dword [0x140230cf0], eax
mov rdx, qword [r8 + 8]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [0x140230cf8]
call fcn.140084840
mov rdx, qword [0x140230d00]
mov rcx, rbp
call fcn.14002b150
mov rdx, rax
mov rcx, rbp
call fcn.1400841b0
nop
mov eax, dword [0x140230ce8]
nop dword [rax + rax]
test eax, 0xfffffffd
jne 0x1400837eb
mov qword [rsp + 0x30], 0
xor ebx, ebx
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401cb710]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x1400837e0
mov r9, qword [rsp + 0x30]
lea r8, str._sAMDCN
mov edx, 0x2000
lea rcx, [rsp + 0x60]
call fcn.14000f700
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400836e5
cmp eax, 0xb7
jne 0x1400837cb
mov edx, 0x20
call fcn.1400839a0
mov rbx, rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, str._sdvrlog_s.txt
mov edx, 0x4000
lea rcx, [rsp + 0x4060]
call fcn.14000f700
mov r8d, 0x20
lea rdx, [0x1401e0980]
lea rcx, [rsp + 0x4060]
call fcn.14016e810
mov qword [0x140230d30], rax
test rax, rax
je 0x1400837cb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str.Process_Id:_d_n
mov rcx, qword [0x140230d30]
call fcn.140082f20
mov ecx, 8
call fcn.14014f310
lea rcx, [0x140083140]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14000f6d0]
xor edx, edx
xor ecx, ecx
call fcn.14016b4dc
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14008382e
cmp dword [rsp + 0x48], 0
je 0x140083841
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140129c40
test eax, eax
jne 0x140083826
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbx
call fcn.140155e3c
mov bl, 1
mov eax, dword [0x140230ce8]
cmp eax, 2
je 0x1400837f0
cmp eax, 3
jne 0x1400837f6
call fcn.1400830e0
nop
mov rcx, rdi
call fcn.140040840
movzx eax, bl
mov rcx, qword [rsp + 0xc060]
xor rcx, rsp
call fcn.14014f2f0
lea r11, [rsp + 0xc070]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ecx, eax
call fcn.1401299dc
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call fcn.140129a18
nop
mov ecx, 1
call fcn.140129a18
int3
Function at 0x140083e60
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14022b800]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, rdx
mov qword [rsp + 0x30], 0
movabs rcx, 0x2c003b0020
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rbx, r8
mov rcx, rax
lea r8, [rsp + 0x30]
call fcn.140155e04
test rax, rax
je 0x140083f97
mov qword [rsp + 0x60], rsi
movabs rsi, 0xcbf29ce484222325
mov qword [rsp + 0x78], rdi
movabs rdi, 0x100000001b3
nop dword [rax]
mov rcx, rax
call fcn.14016b65c
mov rcx, qword [rbx + 8]
mov edx, eax
sar edx, 8
movzx r8d, dl
movzx r9d, al
xor r9, rsi
mov r10d, eax
imul r9, rdi
sar eax, 0x10
movzx edx, al
xor r9, r8
imul r9, rdi
mov eax, r10d
mov dword [rsp + 0x38], r10d
xor r9, rdx
sar eax, 0x18
imul r9, rdi
movzx edx, al
xor rdx, r9
imul rdx, rdi
and rdx, qword [rbx + 0x30]
shl rdx, 4
add rdx, qword [rbx + 0x18]
mov rax, qword [rdx + 8]
cmp rax, rcx
je 0x140083f5b
mov rdx, qword [rdx]
cmp r10d, dword [rax + 0x10]
je 0x140083f4f
nop word [rax + rax]
cmp rax, rdx
je 0x140083f5b
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x140083f40
test rax, rax
cmove rax, rcx
cmp rax, rcx
jne 0x140083f73
cmp r10d, 0xe
jge 0x140083f73
lea r8, [rsp + 0x38]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.140084600
lea r8, [rsp + 0x30]
xor ecx, ecx
lea rdx, [rsp + 0x40]
call fcn.140155e04
test rax, rax
jne 0x140083ed0
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014f2f0
add rsp, 0x50
pop rbx
ret