joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140278790
Capabilities:
Terminate process

Disassembly:
cmp qword [rcx + 0x1048], 0
je 0x140278786
mov rcx, qword [rcx + 0x1048]
jmp 0x140278790
ret
push rbx
sub rsp, 0x80
mov rbx, rcx
mov qword [rsp + 0xa0], rdi
add rcx, 0x10
mov edi, edx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x1c], 1
jne 0x14027896b
lea rcx, [rbx + 0x290]
mov qword [rsp + 0x98], rsi
xor edx, edx
mov byte [rbx + 9], 1
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
call fcn.14026f5b0
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140240210
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x388], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x328], rax
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x330], rax
call fcn.14026f5b0
mov rcx, rax
mov qword [rbx + 0x250], rax
call sub.KERNEL32.dll_GetThreadId
lea r8, [rbx + 0x25c]
mov dword [rbx + 0x258], eax
lea rdx, [rbx + 0x258]
lea rcx, [rbx + 0x250]
lea r9d, [rsi + 0x18]
call fcn.1402775c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
lea rdx, [rbx + 0x290]
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x160], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x170], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbx + 0x180], eax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call fcn.1402401e0
lea rcx, [rbx + 0x188]
lea r8, [rsp + 0x50]
lea edx, [rsi + 0x18]
call fcn.14023ffe0
mov qword [rbx + 0x248], rax
lea rcx, [rbx + 0x760]
mov rax, qword [rbx + 0x388]
lea rdx, str.Simulated_exception__d.
mov r8d, edi
mov qword [rbx + 0x278], rax
call fcn.14027a850
cmp qword [rbx], 0
mov rsi, qword [rsp + 0x98]
je 0x14027897b
mov rax, qword [rbx]
xor edx, edx
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x178]
mov rax, qword [rbx]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x110]
test al, 1
je 0x140278954
mov rax, qword [rbx]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x168]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x178]
jmp 0x14027897b
cmp dword [rbx + 0x3c], 2
je 0x14027897b
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rbx + 0x3c], 1
mov rdi, qword [rsp + 0xa0]
jne 0x140278993
mov ecx, dword [rbx + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbx + 0x10]
add rsp, 0x80
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14027cad0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
call fcn.14027cb80
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
jne 0x14027cb0b
mov rcx, rsi
call fcn.14027b6c0
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call fcn.14027b6e0
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rsi
mov ebx, eax
call fcn.14027b6c0
mov rcx, rdi
test ebx, ebx
jne 0x14027cb52
call fcn.14027b6c0
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
call fcn.14027cb80
mov rcx, rdi
mov rbx, rax
call fcn.14027b6c0
mov rdi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x140281280
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea r14, vtable.grpc_core::ExecCtx.0
mov qword [rax - 0x58], r14
xor ebp, ebp
mov qword [rax - 0x50], rbp
xorps xmm0, xmm0
movdqa xmmword [rax - 0x48], xmm0
mov qword [rax - 0x38], rbp
mov qword [rax - 0x30], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
nop
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bpl
mov qword [rsp + 0x68], rbp
mov edx, dword [0x14051cf40]
mov rax, qword gs:[0x58]
mov ecx, 0x68
mov rsi, qword [rax + rdx*8]
add rsi, rcx
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
call fcn.1402851b0
nop
lea rax, [rsp + 0x30]
mov qword [rsi], rax
mov rbx, qword [rdi]
cmp rbx, qword [rdi + 8]
je 0x14028133b
nop word [rax + rax]
cmp dword [rbx], 2
jne 0x140281331
mov rax, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jne 0x140281320
mov qword [rsp + 0x30], r14
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.14028c450
nop
mov rax, qword [rsp + 0x70]
mov qword [rsi], rax
test byte [rsp + 0x58], 4
jne 0x140281366
call fcn.140285040
nop
lea rcx, [rdi + 0x18]
call fcn.1400aa2c0
nop
mov rcx, qword [rdi + 0x18]
call fcn.1402341ac
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1402813fc
mov rax, qword [rdi + 0x10]
sub rax, rcx
sar rax, 5
movabs rdx, 0x7ffffffffffffff
cmp rax, rdx
jbe 0x1402813a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
shl rax, 5
cmp rax, 0x1000
jb 0x1402813eb
test cl, 0x1f
je 0x1402813bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1402813cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub rcx, rax
cmp rcx, 8
jae 0x1402813db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rcx, 0x27
jbe 0x1402813e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rax
call fcn.1402341ac
nop
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1402854e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov rsi, qword [rsp + 0x68]
mov r15, rcx
mov rdi, r9
mov byte [rsp + 0x68], 0
mov rbx, r8
movzx eax, word [rsi]
mov word [rcx + 0x10], ax
mov ecx, 0x50
call fcn.14027b6e0
mov r14, rax
lea rax, vtable.ThreadInternalsWindows.0
lea rcx, [r14 + 8]
mov qword [r14], rax
mov byte [r14 + 0x40], 0
call fcn.140285420
lea rcx, [r14 + 0x38]
call sub.KERNEL32.dll_InitializeConditionVariable
mov ecx, 0x28
call fcn.14027b6e0
mov qword [r14 + 0x48], rax
mov qword [rax], r14
mov rax, qword [r14 + 0x48]
mov qword [rax + 8], rbx
xor ebx, ebx
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x10], rdi
mov rax, qword [r14 + 0x48]
mov qword [rax + 0x18], rbx
mov rcx, qword [r14 + 0x48]
movzx eax, byte [rsi]
mov byte [rcx + 0x20], al
mov r9, qword [r14 + 0x48]
cmp byte [r9 + 0x20], bl
je 0x1402855b1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [r14 + 0x48]
mov qword [rcx + 0x18], rax
mov r9, qword [r14 + 0x48]
cmp qword [r9 + 0x18], rbx
jne 0x1402855b1
mov rcx, r9
call fcn.14027b6c0
xor al, al
xor cl, cl
jmp 0x14028560e
mov qword [rsp + 0x28], rbx
lea r8, [0x1402858a0]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140285600
mov rcx, qword [r14 + 0x48]
mov rax, rcx
test rcx, rcx
je 0x1402855f2
cmp byte [rcx + 0x20], bl
je 0x1402855f2
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14 + 0x48]
mov rcx, rax
call fcn.14027b6c0
xor al, al
xor cl, cl
jmp 0x14028560e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
movzx ecx, al
mov byte [rsp + 0x68], al
mov qword [r15 + 8], r14
test cl, cl
je 0x140285623
mov dword [r15], 1
jmp 0x14028564a
mov dword [r15], 4
test r14, r14
je 0x140285646
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
mov rcx, r14
call fcn.14027b6c0
movzx eax, byte [rsp + 0x68]
mov qword [r15 + 8], rbx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140285656
mov byte [rcx], al
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x140285e10
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
lea rbp, vtable.grpc_core::ExecCtx.0
mov qword [rax - 0x58], rbp
xor ebx, ebx
mov qword [rax - 0x50], rbx
xorps xmm0, xmm0
movdqa xmmword [rax - 0x48], xmm0
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bl
mov qword [rsp + 0x68], rbx
mov ecx, dword [0x14051cf40]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
test byte [rsp + 0x58], 4
jne 0x140285e91
call fcn.1402851b0
lea rax, [rsp + 0x30]
mov qword [rsi], rax
call fcn.14029f920
xor ecx, ecx
call fcn.1402a0170
call fcn.140298790
movsxd rdi, dword [0x14051f178]
test edi, edi
js 0x140285ed9
mov rbx, rdi
shl rbx, 4
lea rax, [0x14051f188]
add rbx, rax
mov rax, qword [rbx]
test rax, rax
je 0x140285ed0
call rax
sub rbx, 0x10
sub edi, 1
jns 0x140285ec6
call fcn.14029f580
call fcn.140053030
call fcn.140053030
call fcn.14029cb30
call fcn.14029fd60
call fcn.14029d6f0
call fcn.14029e700
call fcn.14029ff90
call fcn.140285130
nop
mov qword [rsp + 0x30], rbp
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.14028c450
mov rax, qword [rsp + 0x70]
mov qword [rsi], rax
test byte [rsp + 0x58], 4
jne 0x140285f31
call fcn.140285040
nop
mov byte [0x14051f16c], 0
mov rcx, qword [0x14051f170]
call sub.KERNEL32.dll_WakeAllConditionVariable
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140290400
Capabilities:
Get number of processors

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov r12, r9
mov r15d, r8d
mov r14, rdx
mov rbp, rcx
mov r13, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x138], 0
je 0x140290485
lea rax, str._reserved
mov qword [rsp + 0x20], rax
lea r9, str.assertion_failed:__s
mov edx, 0x169
mov r8d, 2
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.14027b590
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rax, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x50], rax
xor edi, edi
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x80], eax
mov byte [rsp + 0x84], dil
mov qword [rsp + 0x88], rdi
mov ecx, dword [0x14051cf40]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rax, qword [rsi]
mov qword [rsp + 0x90], rax
call fcn.1402851b0
lea rax, [rsp + 0x50]
mov qword [rsi], rax
test rbx, rbx
je 0x140290518
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x140443d80]
call fcn.14029cd00
mov rdi, rax
xor r8d, r8d
mov rdx, r13
lea rcx, [0x140443d20]
call fcn.14029cd00
mov rbx, rax
mov rax, qword [rsp + 0x40]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14028c6f0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8d, r15d
mov rdx, r14
mov rcx, rbp
call fcn.14028fdf0
mov rbx, rax
lea rax, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x50], rax
or qword [rsp + 0x78], 1
lea rcx, [rsp + 0x50]
call fcn.14028c450
mov rcx, qword [rsp + 0x90]
mov qword [rsi], rcx
test byte [rsp + 0x78], 4
jne 0x1402905a4
call fcn.140285040
nop
mov rax, rbx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140290830
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1404f4fb8]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rdi, rcx
xor ecx, ecx
call fcn.1402a3d50
mov rsi, rax
lea r14, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x30], r14
xor ebp, ebp
mov qword [rsp + 0x38], rbp
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], bpl
mov qword [rsp + 0x68], rbp
mov ecx, dword [0x14051cf40]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
call fcn.1402851b0
lea rax, [rsp + 0x30]
mov qword [rbx], rax
cmp byte [0x14051fb98], bpl
je 0x140290904
mov qword [rsp + 0x20], rdi
lea r9, str.grpc_channel_destroy_channel_p_
mov edx, 0x1dd
lea r8d, [rbp + 1]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.14027b590
lea rdx, str.Channel_Destroyed
lea rcx, [rsp + 0x88]
call fcn.14028e0f0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb8], xmm1
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov edx, 0x1df
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surfacechannel.cc
call fcn.140296e60
mov qword [rsi + 0x18], rax
xor edx, edx
lea rcx, [rdi + 0x70]
call fcn.1402a4590
mov r8, qword [rax]
mov rdx, rsi
mov rcx, rax
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
or rax, 0xffffffffffffffff
lock xadd qword [rdi + 0x70], rax
cmp rax, 1
jne 0x140290986
lea rcx, [rdi + 0x70]
call fcn.1402a3e00
nop
mov qword [rsp + 0x30], r14
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.14028c450
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
test byte [rsp + 0x58], 4
jne 0x1402909b0
call fcn.140285040
nop
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140233ef0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140294a20
Capabilities:
Hash data using murmur3

Disassembly:
mov r8d, dword [rcx + 8]
test r8d, r8d
je 0x140294a71
mov rax, qword [rdx]
cmp r8d, 1
je 0x140294a6d
test rax, rax
je 0x140294a3d
mov r9, qword [rdx + 8]
jmp 0x140294a42
movzx r9d, byte [rdx + 8]
test rax, rax
je 0x140294a5a
mov rcx, qword [rdx + 0x10]
mov rdx, r9
mov r8d, dword [0x140521a9c]
jmp fcn.1403361e0
mov r8d, dword [0x140521a9c]
lea rcx, [rdx + 9]
mov rdx, r9
jmp fcn.1403361e0
mov eax, dword [rax + 0x60]
ret
mov rcx, qword [rdx]
lea rax, [0x1404fc530]
sub rcx, rax
movabs rax, 0x6666666666666667
imul rcx
lea rax, [0x1405218f0]
sar rdx, 4
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov eax, dword [rax + rdx*4]
ret
Function at 0x140299f10
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push r15
sub rsp, 0xe0
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea r15, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rax - 0x80], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x70], eax
mov byte [rsp + 0x74], 0
mov qword [rsp + 0x78], 0
mov ecx, dword [0x14051cf40]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov r14, qword [rax + rcx*8]
add r14, rdx
mov rax, qword [r14]
mov qword [rsp + 0x80], rax
call fcn.1402851b0
lea rax, [rsp + 0x40]
mov qword [r14], rax
cmp byte [0x14051fb98], 0
je 0x140299fea
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, str.grpc_insecure_channel_create_target_s__args_p__reserved_p_
mov edx, 0x5e
lea r8d, [rdx - 0x5d]
lea rcx, str.D:p4grpc1.22.1_src_srccoreext_transportchttp2clientinsecurechannel_create.cc
call fcn.14027b590
test rbx, rbx
je 0x14029a01e
lea rax, str.reserved__nullptr
mov qword [rsp + 0x20], rax
lea r9, str.assertion_failed:__s
mov edx, 0x5f
lea r8d, [rdx - 0x5d]
lea rcx, str.D:p4grpc1.22.1_src_srccoreext_transportchttp2clientinsecurechannel_create.cc
call fcn.14027b590
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rdx, [0x140299ed0]
lea rcx, [0x14051fb80]
call fcn.1402854b0
mov rdx, qword [0x14051fb78]
lea rcx, [rsp + 0xb8]
call fcn.1402b8b80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa8], xmm1
mov r8d, 1
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.1402b0750
mov rbx, rax
mov rcx, qword [0x14051fb78]
mov r9, qword [rcx]
mov r8, rax
mov rdx, rsi
call qword [r9 + reloc.WS2_32.dll_recv]
mov rdi, rax
mov rcx, rbx
call fcn.1402b0aa0
test rdi, rdi
jne 0x14029a0ae
lea r8, str.Failed_to_create_client_channel
lea edx, [rdi + 0xd]
mov rcx, rsi
call fcn.140293180
mov rdi, rax
mov qword [rsp + 0x40], r15
or qword [rsp + 0x68], 1
lea rcx, [rsp + 0x40]
call fcn.14028c450
mov rcx, qword [rsp + 0x80]
mov qword [r14], rcx
test byte [rsp + 0x68], 4
jne 0x14029a0db
call fcn.140285040
nop
mov rax, rdi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14029a350
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov qword [rax - 0x168], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1404f4fb8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rdx
mov rdi, rcx
lea rbp, vtable.grpc_core::ExecCtx.0
mov qword [rsp + 0x30], rbp
xor esi, esi
mov qword [rsp + 0x38], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 1
call sub.KERNEL32.dll_GetCurrentProcessorNumber
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], sil
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x14051cf40]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov r14, qword [rax + rcx*8]
add r14, rdx
mov rax, qword [r14]
mov qword [rsp + 0x70], rax
call fcn.1402851b0
lea rax, [rsp + 0x30]
mov qword [r14], rax
mov qword [rdi], rbx
cmp dword [rbx + 8], esi
jne 0x14029a4a2
lea rcx, [rsp + 0x90]
call fcn.14029b240
mov rax, qword [rdi]
cmp dword [rax + 8], esi
jne 0x14029a422
cmp dword [rax + 0x10], esi
jne 0x14029a422
mov qword [rdi + 8], rax
jmp 0x14029a49f
lea rbx, [rax + 0x18]
mov ecx, dword [rax + 0x10]
call fcn.14029bc90
mov ecx, eax
lea r8, [rsp + 0x90]
mov rdx, rbx
call fcn.1402bb740
test eax, eax
jne 0x14029a479
mov rax, qword [rdi]
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x20], ecx
lea r9, str.Unexpected_error_decompressing_data_for_algorithm_with_enum_value__d.
mov edx, 0x3d
lea r8d, [rdx - 0x3b]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_surface_byte_buffer_reader.cc
call fcn.14027b590
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
jmp 0x14029a4a7
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
call fcn.14029a280
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x90]
call fcn.14029a870
mov dword [rdi + 0x10], esi
mov esi, 1
mov qword [rsp + 0x30], rbp
or qword [rsp + 0x58], 1
lea rcx, [rsp + 0x30]
call fcn.14028c450
mov rcx, qword [rsp + 0x70]
mov qword [r14], rcx
test byte [rsp + 0x58], 4
jne 0x14029a4d1
call fcn.140285040
nop
mov eax, esi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140233ef0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1402b2a40
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1404f4fb8]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor edi, edi
mov dword [rsp + 0x68], 0x18
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x68]
mov dword [rsp + 0x28], 0x80
lea rcx, str.windows_bios.data
mov edx, 0x40000000
mov qword [rsp + 0x70], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1402b2ada
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.CreateFile_failed___d_.
mov dword [rsp + 0x20], eax
lea edx, [rdi + 0x48]
lea r8d, [rdi + 2]
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_securitycredentials_altscheck_gcp_environment_windows.cc
call fcn.14027b590
xor al, al
jmp 0x1402b2bfc
xor eax, eax
lea rcx, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call sub.VCRUNTIME140.dll_memset
or dword [rsp + 0xbc], 0x100
lea rax, str._Get_WmiObject__Class_Win32_BIOS_.Manufacturer
lea r9, str.powershell.exe
mov qword [rsp + 0x20], rax
lea r8, str._s__s
mov dword [rsp + 0x80], WSAGetLastError
mov edx, 0x100
mov qword [rsp + 0xd0], rdi
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xd8], rbx
call fcn.14004dcf0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xf0]
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1402b2bcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x5b
lea r9, str.CreateProcess_failed___d_._n
lea rcx, str.D:p4grpc1.22.1_src_srccorelib_securitycredentials_altscheck_gcp_environment_windows.cc
mov dword [rsp + 0x20], eax
lea r8d, [rdx - 0x59]
call fcn.14027b590
xor al, al
jmp 0x1402b2bfc
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140233ef0
mov rbx, qword [rsp + 0x210]
add rsp, 0x200
pop rdi
ret
Function at 0x1402b6000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x18]
mov rdi, rcx
mov edx, dword [0x14051cf40]
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, 0x68
mov rax, qword [rax + rdx*8]
mov rcx, qword [rcx + rax]
call fcn.14028c540
mov rbx, rax
lea rcx, [rdi + 0xd0]
add rbx, qword [rdi + 0x108]
call fcn.1402d7d30
cmp rax, rbx
mov qword [rdi + 0x100], rax
mov rcx, rax
mov edx, 1
mov rax, qword [rdi + 0x10]
cmovl rcx, rbx
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov qword [rsp + 0x30], rax
call fcn.1402b83e0
mov rcx, qword [rdi + 0x58]
lea r9, [rdi + 0x78]
lea r8, [rdi + 0x60]
lea rdx, [rsp + 0x20]
call fcn.1402b4a10
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret