joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003400
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rdx + 0x30]
mov dword [rsp + 0x30], 0xffffffff
mov qword [rcx + 0x27f2], rax
lea rdx, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rdx
xor edi, edi
xor edx, edx
mov dword [rcx + 0x27e6], edi
mov rcx, qword [rcx + 0x27d6]
lea r9, [rbx + 0x27fa]
lea r8d, [rdi + 1]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
call qword [0x1400fac68]
test eax, eax
je 0x1400034c0
cmp eax, 1
je 0x1400034a2
cmp eax, 0x87cc000a
je 0x1400034a2
mov ecx, eax
and ecx, 0x490
cmp ecx, 0x490
jne 0x140003496
lea rcx, str._AsusSync_WaveIn__RunBody___IMediaObject::ProcessOutput__ERROR_NOT_FOUND_n
call fcn.1400959a0
jmp 0x140003536
lea rcx, str._AsusSync_WaveIn__RunBody___IMediaObject::ProcessOutput__HRESULT_0x_X_n
jmp 0x14000352f
mov r9d, dword [rbx + 0x2802]
lea rcx, str._AsusSync_WaveIn__RunBody___IMediaObject::ProcessOutput_fail__result:0x_X__read_from_buffer__I64d_ms__Buffer_status:0x_X_n
mov r8d, dword [rbx + 0x27e6]
mov edx, eax
call fcn.1400959a0
jmp 0x140003536
cmp dword [rbx + 0x2802], 0x1000000
jne 0x1400034de
mov edx, dword [rbx + 0x27e6]
lea rcx, str._AsusSync_WaveIn__RunBody___DMO_OUTPUT_DATA_BUFFERF_INCOMPLETE__size__d_n
call fcn.1400959a0
cmp byte [rbx + 0x281b], dil
jne 0x140003536
mov rcx, qword [rbx + 0x9d]
lea rax, [rbx + 0xd3]
mov r8d, dword [rbx + 0x27e6]
lea r9, [rsp + 0x34]
mov rdx, qword [rbx + 0x27f2]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x75]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x140003536
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e5
je 0x140003536
lea rcx, str._AsusSync_WaveIn__RunBody___Write_to_SCO_failed:_GetLastError_0x_X_n
mov edx, eax
call fcn.1400959a0
cmp byte [rbx + 0x12c], dil
jne 0x140003571
mov ecx, dword [rbx + 0x131]
mov eax, dword [rbx + 0x127]
dec eax
mov byte [rbx + 0x12b], dil
cmp ecx, eax
lea edx, [rcx + 1]
cmovge edx, edi
mov dword [rbx + 0x131], edx
cmp dword [rbx + 0x12d], edx
jne 0x140003571
mov byte [rbx + 0x12c], 1
mov qword [rbx + 0x27f2], rdi
cmp byte [rbx + 0x281a], dil
je 0x14000358a
mov byte [rbx + 0x281a], dil
jmp 0x14000359c
mov rcx, qword [rbx + 0xcb]
mov edx, 0x64
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140004340
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsxd rbp, edx
mov rsi, r8
mov rbx, rcx
mov dword [rsp + 0x30], ebp
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
xor edi, edi
call fcn.1400c5120
lea rcx, str._AsusSync_HFPController__SendAtCommand_wait_for_queue_mutex_Event_n
call fcn.1400959a0
mov rcx, qword [rbx + 0x3d]
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x1400044a5
mov edx, 0x100
cmp ebp, 0xd
je 0x1400043dc
lea rcx, str.ATBRSF
lea r9, [rcx + rbp*8]
mov r9, qword [rcx + rbp*8]
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400043e4
lea r8, str._s_s_r
mov qword [rsp + 0x20], rsi
call fcn.14000a910
jmp 0x1400043f0
mov r9, rsi
lea rcx, [rsp + 0x40]
lea r8, [0x14010d0fc]
call fcn.14000a910
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000449b
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140004410
xor r9d, r9d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140004464
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str._AsusSync_HFPController__SendAtCommand___SOCKET_ERROR:_0x_X___Send_Disconnect_Event_n
call fcn.1400959a0
cmp byte [rbx + 0x20], 1
jne 0x14000449b
mov rcx, qword [rbx]
xor edx, edx
call fcn.140006c80
lea rcx, str._AsusSync_HFPController__SendDisconnectEvent_n
mov byte [rbx + 0x20], 0
call fcn.1400959a0
jmp 0x14000449b
mov rcx, qword [rbx + 0x45]
test rcx, rcx
je 0x14000448a
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140004480
mov dword [rdx], ebp
add qword [rcx + 8], 4
jmp 0x14000448a
lea r8, [rsp + 0x30]
call fcn.14000a320
lea rdx, [rsp + 0x40]
lea rcx, str._AsusSync_HFPController__SendAtCommand___HF_Sent:__s_n
call fcn.1400959a0
mov rcx, qword [rbx + 0x3d]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x188]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400052b0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov byte [rcx + 0x75], 1
mov rbx, rcx
mov word [rcx + 0x92], 0x100
mov qword [rcx + 0x94], rdi
xor r8d, r8d
mov word [rcx + 0x148], 0x100
mov qword [rcx + 0x14a], rdi
lea edx, [rdi + 1]
mov rcx, qword [rcx + 0x7e]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSemaphore]
mov rcx, qword [rbx + 0xc]
test rcx, rcx
je 0x140005338
mov edx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140005328
lea rcx, str._AsusSync_Thread_os__Terminate___n
call fcn.1400959a0
mov rcx, qword [rbx + 0xc]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
jmp 0x140005334
lea rcx, str._AsusSync_Thread_os__Terminate_____thread_graceful_closed_n
call fcn.1400959a0
mov qword [rbx + 0xc], rdi
lea rcx, str._AsusSync_SmBase__Destructed_n
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400959a0
Function at 0x1400132e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov rdi, qword [r10 + 0x18]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r10 + 8]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r10 + 0x30]
mov r9, r8
shl r9, 4
add r9, rdi
mov rbx, qword [r9 + 8]
cmp rbx, rdx
je 0x1400133e1
mov eax, dword [r11]
mov rcx, qword [r9]
cmp eax, dword [rbx + 0x10]
je 0x14001336e
nop
cmp rbx, rcx
je 0x1400133e1
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140013360
test rbx, rbx
je 0x1400133e1
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r9 + 8], rbx
jne 0x140013399
cmp rax, rbx
jne 0x14001338f
mov qword [rdi + r8*8], rdx
mov qword [r9 + 8], rdx
jmp 0x1400133a5
mov rdx, qword [rbx + 8]
mov qword [r9 + 8], rdx
jmp 0x1400133a5
cmp rax, rbx
jne 0x1400133a5
mov rax, qword [rbx]
mov qword [rdi + r8*8], rax
mov rcx, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x18]
call fcn.14000b090
mov edx, 0x158
mov rcx, rbx
call fcn.1400c2470
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140014650
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x1400146d9
mov ecx, dword [r10]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x1400146dc
nop dword [rax]
cmp rax, rdx
je 0x1400146d9
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1400146c0
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret
Function at 0x140015140
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r14, rdx
mov rsi, rcx
movzx edi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rdi, rax
movabs rcx, 0x100000001b3
imul rdi, rcx
movzx eax, byte [r8 + 1]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 2]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 3]
xor rdi, rax
imul rdi, rcx
mov rdx, rdi
and rdx, qword [rsi + 0x30]
add rdx, rdx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
lea r12, [rsi + 8]
mov rbp, qword [r12]
cmp rax, rbp
je 0x1400151f2
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x1400151d5
cmp rax, rdx
je 0x1400151ef
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1400151c7
mov qword [r14], rax
mov byte [r14 + 8], 0
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, rax
movabs rax, 0xbe82fa0be82fa0
cmp qword [rsi + 0x10], rax
je 0x140015378
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
lfence
mov ecx, 0x158
call fcn.1400c2704
mov rbx, rax
mov qword [rsp + 0x38], rax
mov eax, dword [r15]
mov dword [rbx + 0x10], eax
lea rcx, [rbx + 0x18]
xor edx, edx
call fcn.14000ae70
nop
mov rdx, qword [rsi + 0x10]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140015252
cvtsi2ss xmm0, rcx
jmp 0x140015267
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14001527a
cvtsi2ss xmm1, rcx
jmp 0x14001528f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14001530f
mov rcx, rsi
call fcn.140015e20
mov rax, rdi
and rax, qword [rsi + 0x30]
add rax, rax
mov r8, qword [rsi + 0x18]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [r12]
cmp rcx, rdx
jne 0x1400152d1
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
jmp 0x1400152fb
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x1400152ee
nop dword [rax]
cmp rcx, rdx
je 0x140015344
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x1400152e0
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rsi + 0x10]
mov rbp, qword [rsp + 0x30]
mov rcx, qword [rbp + 8]
lea rax, [rdx + 1]
mov qword [rsi + 0x10], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rbp + 8], rbx
mov rax, qword [rsi + 0x18]
and rdi, qword [rsi + 0x30]
add rdi, rdi
mov rdx, qword [rax + rdi*8]
cmp rdx, qword [r12]
jne 0x140015354
mov qword [rax + rdi*8], rbx
jmp 0x140015366
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
jmp 0x1400152fb
cmp rdx, rbp
jne 0x14001535f
mov qword [rax + rdi*8], rbx
jmp 0x14001536b
cmp qword [rax + rdi*8 + 8], rcx
jne 0x14001536b
mov qword [rax + rdi*8 + 8], rbx
mov qword [r14], rbx
mov byte [r14 + 8], 1
jmp 0x1400151dd
lea rcx, str.unordered_map_set_too_long
call fcn.140099f98
int3
Function at 0x140015390
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r14, rdx
mov rsi, rcx
movzx edi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rdi, rax
movabs rcx, 0x100000001b3
imul rdi, rcx
movzx eax, byte [r8 + 1]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 2]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 3]
xor rdi, rax
imul rdi, rcx
mov rdx, rdi
and rdx, qword [rsi + 0x30]
add rdx, rdx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
lea r12, [rsi + 8]
mov rbp, qword [r12]
cmp rax, rbp
je 0x140015442
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x140015425
cmp rax, rdx
je 0x14001543f
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140015417
mov qword [r14], rax
mov byte [r14 + 8], 0
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, rax
movabs rax, 0xbe82fa0be82fa0
cmp qword [rsi + 0x10], rax
je 0x1400155d8
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
lfence
mov ecx, 0x158
call fcn.1400c2704
mov rbx, rax
mov qword [rsp + 0x38], rax
mov eax, dword [r15]
mov dword [rbx + 0x10], eax
xor edx, edx
lea rcx, [rbx + 0x18]
call fcn.14000ae70
lea rcx, [r15 + 8]
lea rdx, [rbx + 0x18]
call fcn.14000ba20
nop
mov rdx, qword [rsi + 0x10]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400154af
cvtsi2ss xmm0, rcx
jmp 0x1400154c4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400154d7
cvtsi2ss xmm1, rcx
jmp 0x1400154ec
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14001556f
mov rcx, rsi
call fcn.140015e20
mov rax, rdi
and rax, qword [rsi + 0x30]
add rax, rax
mov r8, qword [rsi + 0x18]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [r12]
cmp rcx, rdx
jne 0x14001552e
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
jmp 0x14001555b
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x14001554e
nop word [rax + rax]
cmp rcx, rdx
je 0x1400155a4
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140015540
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rsi + 0x10]
mov rbp, qword [rsp + 0x30]
mov rcx, qword [rbp + 8]
lea rax, [rdx + 1]
mov qword [rsi + 0x10], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rbp + 8], rbx
mov rax, qword [rsi + 0x18]
and rdi, qword [rsi + 0x30]
add rdi, rdi
mov rdx, qword [rax + rdi*8]
cmp rdx, qword [r12]
jne 0x1400155b4
mov qword [rax + rdi*8], rbx
jmp 0x1400155c6
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
jmp 0x14001555b
cmp rdx, rbp
jne 0x1400155bf
mov qword [rax + rdi*8], rbx
jmp 0x1400155cb
cmp qword [rax + rdi*8 + 8], rcx
jne 0x1400155cb
mov qword [rax + rdi*8 + 8], rbx
mov qword [r14], rbx
mov byte [r14 + 8], 1
jmp 0x14001542d
lea rcx, str.unordered_map_set_too_long
call fcn.140099f98
int3
Function at 0x1400161e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140015e45
cvtsi2ss xmm0, rdx
jmp 0x140015e5a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400f123c
movss xmm1, dword [0x14014b750]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140015e88
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140015e88
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140015eba
cmp rbx, 0x200
jae 0x140015eb7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140015eba
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400161e0
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14001639e
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140014130
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140016367
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400162d3
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140016356
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x140016310
mov r10, qword [rax]
cmp r10, rcx
je 0x14001630a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140016356
mov r8, rax
cmp r10, rax
je 0x140016332
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x140016378
cmp r10, rax
jne 0x140016320
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140016280
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140016356
lea rcx, str.invalid_hash_bucket_count
call fcn.140099f98
int3
Function at 0x14002aa90
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
lea rcx, str.bthprops.cpl
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov qword [rdi + 0x40], rax
test rax, rax
je 0x14002ab2c
lea rdx, str.BluetoothRegisterForAuthenticationEx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rdi + 0x40]
lea rdx, str.BluetoothSendAuthenticationResponseEx
mov qword [rdi + 0x50], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rdi + 0x40]
lea rdx, str.BluetoothUnregisterAuthentication
mov qword [rdi + 0x58], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rdx, qword [rdi + 0x50]
mov qword [rdi + 0x60], rax
test rdx, rdx
je 0x14002ab19
cmp qword [rdi + 0x58], 0
je 0x14002ab19
test rax, rax
jne 0x14002ab2c
mov r8, qword [rdi + 0x58]
lea rcx, str._AsusSync_BTRFCOMMClient__Init_load_function_fail_1:_I64X__2:_I64X__3:_I64X_n
mov r9, rax
call fcn.140095ab0
lea rcx, str.bthprops.cpl
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14002ac69
mov qword [rsp + 0x298], rbp
lea rdx, str.BluetoothFindFirstRadio
mov qword [rsp + 0x2a0], r12
mov rcx, rax
mov qword [rsp + 0x268], r14
mov qword [rsp + 0x260], r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
lea rdx, str.BluetoothFindNextRadio
mov rcx, rsi
mov r15, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
lea rdx, str.BluetoothGetRadioInfo
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
lea rdx, str.BluetoothFindRadioClose
mov rcx, rsi
mov r14, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov r12, rax
test r15, r15
je 0x14002ac49
test rbp, rbp
je 0x14002ac49
test r14, r14
je 0x14002ac49
test rax, rax
je 0x14002ac49
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 4
mov rax, r15
call qword [0x1400fac68]
mov rsi, rax
test rax, rax
je 0x14002ac49
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rax, r14
mov dword [rsp + 0x40], 0x208
call qword [0x1400fac68]
lea rdx, [rsp + 0x30]
mov rcx, rsi
test eax, eax
mov rax, rbp
cmove rbx, qword [rsp + 0x48]
call qword [0x1400fac68]
test eax, eax
je 0x14002ac3d
test rbx, rbx
je 0x14002ac00
mov rcx, rsi
mov rax, r12
call qword [0x1400fac68]
mov r14, qword [rsp + 0x268]
mov r12, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov r15, qword [rsp + 0x260]
mov qword [rsp + 0x28], 0
lea r8, [0x14002b150]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rdi + 0x28], rbx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002b7b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
test rdx, rdx
je 0x14002b87f
mov qword [rsp + 0x18], rbx
push rsi
mov eax, 0x13c0
call fcn.1400c3110
sub rsp, rax
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
movsxd rbx, r8d
mov rsi, rdx
mov qword [rsp + 0x13d0], rdi
call fcn.14009b664
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x14002b810
mov dword [rsp + 0x20], 0x270
mov rdi, rbx
test ebx, ebx
jle 0x14002b857
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.14002bc50
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rdi
jl 0x14002b842
mov rdi, qword [rsp + 0x13d0]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x13e0]
add rsp, 0x13c0
pop rsi
ret

Function at 0x14002bc50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14002bcb1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14002bc70
mov ecx, dword [r10]
jmp 0x14002bd9a
cmp ecx, 0x4e0
jb 0x14002bd9a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14002bcd0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14002bd20
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret