joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400066f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rcx
movabs r9, 0xcbf29ce484222325
xor ecx, ecx
mov rdi, rdx
mov r11d, ecx
mov rbx, r9
movabs rdx, 0x100000001b3
movzx eax, byte [r11 + r8 + 0x10]
inc r11
xor rbx, rax
imul rbx, rdx
cmp r11, 8
jb 0x140006724
movzx eax, byte [r8 + rcx + 0x18]
inc rcx
xor r9, rax
imul r9, rdx
cmp rcx, 8
jb 0x14000673a
mov rcx, qword [r10 + 0x18]
xor r9, rbx
and r9, qword [r10 + 0x30]
add r9, r9
cmp qword [rcx + r9*8 + 8], r8
jne 0x140006788
cmp qword [rcx + r9*8], r8
jne 0x14000677d
mov rax, qword [r10 + 8]
mov qword [rcx + r9*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140006781
mov rax, qword [r8 + 8]
mov qword [rcx + r9*8 + 8], rax
jmp 0x140006795
cmp qword [rcx + r9*8], r8
jne 0x140006795
mov rax, qword [r8]
mov qword [rcx + r9*8], rax
mov rax, qword [r8 + 8]
mov edx, 0x20
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.14000d238
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400067e4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
nop dword [rax + rax]
mov r11d, eax
xor r9d, r9d
mov r8, rbx
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
lea edx, [r11 + r11]
shr rdx, 3
lea r10, [rbx + rdx*8]
cmp rbx, r10
je 0x140006859
mov rcx, rdi
xor edx, edx
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, rsi
cmp rdx, 8
jb 0x140006838
xor r9, rcx
add r8, 8
cmp r8, r10
jne 0x140006833
lea r10, [rbx + r11*2]
jmp 0x140006880
mov rcx, rdi
xor edx, edx
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, rsi
cmp rdx, 2
jb 0x140006864
xor r9, rcx
add r8, 2
cmp r8, r10
jne 0x14000685f
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400068a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rcx
movabs r9, 0xcbf29ce484222325
xor ecx, ecx
mov rdi, rdx
mov r11d, ecx
mov rbx, r9
movabs rdx, 0x100000001b3
movzx eax, byte [r11 + r8 + 0x10]
inc r11
xor rbx, rax
imul rbx, rdx
cmp r11, 8
jb 0x1400068cc
movzx eax, byte [r8 + rcx + 0x18]
inc rcx
xor r9, rax
imul r9, rdx
cmp rcx, 8
jb 0x1400068e2
mov rcx, qword [r10 + 0x18]
xor r9, rbx
and r9, qword [r10 + 0x30]
add r9, r9
cmp qword [rcx + r9*8 + 8], r8
jne 0x140006930
cmp qword [rcx + r9*8], r8
jne 0x140006925
mov rax, qword [r10 + 8]
mov qword [rcx + r9*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140006929
mov rax, qword [r8 + 8]
mov qword [rcx + r9*8 + 8], rax
jmp 0x14000693d
cmp qword [rcx + r9*8], r8
jne 0x14000693d
mov rax, qword [r8]
mov qword [rcx + r9*8], rax
mov rax, qword [r8 + 8]
mov edx, 0x28
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.14000d238
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006be4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
mov r10, rcx
xor edx, edx
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r11]
xor r10, rax
imul r10, r8
inc rdx
cmp rdx, 8
jb 0x140006c1a
xor edx, edx
movzx eax, byte [rdx + r11 + 8]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140006c31
xor rcx, r10
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
mov r10, r8
add r10, r10
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r10*8]
je 0x140006cbf
mov rdi, qword [rcx + r10*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r10*8]
je 0x140006cbf
mov rdi, qword [rdi + 8]
mov rax, qword [r11]
cmp rax, qword [rdi + 0x10]
jne 0x140006c6d
mov rax, qword [r11 + 8]
cmp rax, qword [rdi + 0x18]
jne 0x140006c6d
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x20
mov rcx, rbx
call fcn.14000d238
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140006d56
mov rax, qword [rbx]
cmp rdi, rax
je 0x140006cf4
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x140006d14
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140006d43
cmp rax, rdi
jne 0x140006d1f
mov qword [rdx + r8*8], rbx
jmp 0x140006d43
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140006d43
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.140006f24
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000780c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
mov r10, rcx
xor edx, edx
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r11]
xor r10, rax
imul r10, r8
inc rdx
cmp rdx, 8
jb 0x140007842
xor edx, edx
movzx eax, byte [r11 + rdx + 8]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140007859
xor rcx, r10
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
mov r10, r8
add r10, r10
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r10*8]
je 0x1400078e7
mov rdi, qword [rcx + r10*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r10*8]
je 0x1400078e7
mov rdi, qword [rdi + 8]
mov rax, qword [r11]
cmp rax, qword [rdi + 0x10]
jne 0x140007895
mov rax, qword [r11 + 8]
cmp rax, qword [rdi + 0x18]
jne 0x140007895
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x28
mov rcx, rbx
call fcn.14000d238
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14000797e
mov rax, qword [rbx]
cmp rdi, rax
je 0x14000791c
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x14000793c
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000796b
cmp rax, rdi
jne 0x140007947
mov qword [rdx + r8*8], rbx
jmp 0x14000796b
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000796b
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.140007bf8
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007a74
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
mov r10, rcx
xor edx, edx
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r11]
xor r10, rax
imul r10, r8
inc rdx
cmp rdx, 8
jb 0x140007aaa
xor edx, edx
movzx eax, byte [r11 + rdx + 8]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140007ac1
xor rcx, r10
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
mov r10, r8
add r10, r10
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r10*8]
je 0x140007b4f
mov rdi, qword [rcx + r10*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r10*8]
je 0x140007b4f
mov rdi, qword [rdi + 8]
mov rax, qword [r11]
cmp rax, qword [rdi + 0x10]
jne 0x140007afd
mov rax, qword [r11 + 8]
cmp rax, qword [rdi + 0x18]
jne 0x140007afd
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x20
mov rcx, rbx
call fcn.14000d238
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140007be6
mov rax, qword [rbx]
cmp rdi, rax
je 0x140007b84
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x140007ba4
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140007bd3
cmp rax, rdi
jne 0x140007baf
mov qword [rdx + r8*8], rbx
jmp 0x140007bd3
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140007bd3
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.140006f24
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009664
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov rsi, rcx
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov r9d, ebp
movzx eax, byte [r9 + rdx]
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
inc r9
cmp r9, 4
jb 0x140009691
mov rcx, qword [rsi + 0x30]
and rcx, r8
mov rdx, qword [rsi + 0x18]
mov rax, rcx
add rax, rax
mov rax, qword [rdx + rax*8]
lea r8, [rcx + rcx]
lea r14, [rsi + 8]
mov rbx, qword [r14]
cmp qword [rdx + r8*8], rbx
jne 0x1400096db
mov rcx, rbx
jmp 0x1400096e3
mov rcx, qword [rdx + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400096fa
mov ecx, dword [r15]
cmp dword [rax + 0x10], ecx
je 0x1400096f5
mov rax, qword [rax]
jmp 0x1400096d0
mov rcx, rax
jmp 0x140009700
mov rax, rbx
mov rcx, rbx
cmp rcx, rbx
jne 0x14000978c
mov rbx, qword [rbx]
movabs rax, 0x492492492492492
cmp qword [r14 + 8], rax
jne 0x140009730
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rbp
mov ecx, 0x38
call fcn.14000d27c
mov ecx, dword [r15]
mov dword [rax + 0x10], ecx
mov qword [rax + 0x28], rbp
mov qword [rax + 0x30], 7
mov word [rax + 0x18], bp
mov qword [rax], rbx
mov qword [rax + 8], rdi
inc qword [r14 + 8]
mov qword [rbx + 8], rax
mov qword [rdi], rax
mov r9, qword [r14]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000a93c
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14000a93c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14000a96c
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rdx, qword [rcx + rax*8]
cmp rdi, rdx
je 0x14000aa00
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14000aa00
mov rdi, qword [rdi + 8]
mov eax, dword [rdi + 0x10]
cmp dword [r10], eax
jne 0x14000a9b1
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140002728
mov edx, 0x38
mov rcx, rbx
call fcn.14000d238
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14000aa9d
mov rax, qword [rbx]
cmp rdi, rax
je 0x14000aa35
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov r10, r8
add r10, r10
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x14000aa5b
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000aa8a
cmp rax, rdi
jne 0x14000aa66
mov qword [rdx + r8*8], rbx
jmp 0x14000aa8a
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000aa8a
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.14000aab4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000ace0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rdi + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000ad04
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14000ad5b
cmp qword [rcx + rdx*8], rdi
jne 0x14000ad50
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14000ad54
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14000ad68
cmp qword [rcx + rdx*8], rdi
jne 0x14000ad68
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r9 + 0x10]
call fcn.140002728
mov edx, 0x38
mov rcx, rdi
call fcn.14000d238
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400170d0]
lea rcx, [0x1400170d0]
mov rax, qword [rax + 0x18]
call qword [case.0x14000e5e6.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r8, rdi
lea rdx, str._sDiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x40]
call fcn.14000b2c0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14000b1ef
lea rcx, [rsp + 0x40]
call fcn.14000b23c
mov r8, rdi
lea rdx, str._s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x40]
call fcn.14000b2c0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14000b1ef
lea rcx, [rsp + 0x40]
call fcn.14000b23c
lea r9, str.Team_ToolsDiagnosticsHubCollector
mov r8, rdi
lea rdx, str._s_s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x40]
call fcn.14000b2c0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14000b1ef
mov edi, 0x80070057
jmp 0x14000b202
mov rdx, rsi
mov rcx, rbx
call fcn.14000ae24
mov edi, eax
test eax, eax
js 0x14000b202
xor edi, edi
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000b223
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14000e5e6.0]
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b4d0
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
call fcn.14000b6b4
mov ebp, eax
test eax, eax
jne 0x14000b68b
mov r9d, dword [rsp + 0x90]
lea rcx, [rbx + 0x50]
lea r8, str.Merging_ETL_files_with_flags__Flags:_0x_08x_
lea rdx, str.onecorecomdiagnostics_standardcollectorcorediagnosticshub.commonkerneltracecontrol.cpp
call fcn.140008c90
mov r9d, dword [rsp + 0x90]
mov r8d, edi
mov rax, qword [rbx + 8]
mov rdx, r14
mov rcx, r15
call qword [case.0x14000e5e6.0]
mov ebp, eax
test eax, eax
jne 0x14000b68b
lea rsi, [rbx + 0xf8]
mov rax, qword [rsi + 8]
cmp qword [rsi], rax
je 0x14000b68b
test edi, edi
je 0x14000b602
mov r12d, edi
mov rcx, qword [r14]
xor edi, edi
and qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000b5c2
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
cmovne rdi, qword [rsp + 0x40]
test rbx, rbx
je 0x14000b5d6
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r9, qword [r14]
lea r8, str.__s__I64d_
lea rdx, str.OriginalEtlFile_Name_ByteSize_
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call fcn.140008c90
add r14, 8
sub r12, 1
jne 0x14000b56b
xor edi, edi
xor r9d, r9d
and qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, r15
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000b659
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
cmovne rdi, qword [rsp + 0x40]
test rbx, rbx
je 0x14000b66d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r9, r15
mov qword [rsp + 0x20], rdi
lea r8, str.__s__I64d_
mov rcx, rsi
lea rdx, str.MergedEtlFile_Name_ByteSize_
call fcn.140008c90
lea r11, [rsp + 0x50]
mov eax, ebp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000d984
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140017850], eax
call fcn.14000d6d0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140017850], 0
jne case.default.0x14000d9da
mov ecx, 1
call fcn.14000d6d0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov ecx, 0x62801c16
movabs dword [0x3b450f99c12bd3cb], eax
invalid
Function at 0x140f60a44
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f60a4e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f60a77
pop rbp
sub rbp, 0x33
sub rbp, 0xf60a44
sub rsp, 0x20
jmp 0x140f60a96
mov rax, 0xf60a44
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x5846a1b6
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f60ab5
jmp 0x140f60acc
invalid
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14001fac0]
mov dword [rax], 1
mov rax, qword [0x14001fad0]
mov dword [rax], 1
mov rax, qword [0x14001fae0]
mov dword [rax], 1
mov rax, qword [0x14001fa50]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret