joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x20], rsi
mov rsi, r9
xor r9d, r9d
lea rax, [rcx + rax*2]
mov qword [rsp], rax
cmp rcx, rax
jae 0x180016da7
mov qword [r11 + 0x18], rbp
lea rbp, [0x180000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
nop
test rsi, rsi
je 0x180016bee
cmp r8, rsi
jae 0x180016d84
movzx edx, byte [r8]
test dl, dl
je 0x180016d84
xor ebx, ebx
mov eax, edx
shr rax, 3
mov rcx, rsi
movsx r9, byte [rax + rbp + 0x651a8]
test r9d, r9d
sete bl
add ebx, r9d
test rsi, rsi
jne 0x180016c22
movsxd rcx, ebx
add rcx, r8
xor r14d, r14d
lea rax, [r8 + 1]
cmp r8, rcx
cmovb r14d, edx
cmp rax, rcx
jae 0x180016c3b
movzx r13d, byte [rax]
jmp 0x180016c3e
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x180016c4d
movzx r12d, byte [rax]
jmp 0x180016c50
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x180016c5f
movzx r15d, byte [rax]
jmp 0x180016c62
xor r15b, r15b
lea r10, [r9*4]
movzx eax, r14b
mov ebp, dword [r10 + rbp + 0x651c8]
and ebp, eax
movzx r9d, r13b
shl ebp, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or ebp, eax
movzx r11d, r15b
shl ebp, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or ebp, eax
mov eax, r11d
shr r11d, 2
and eax, 0x3f
or r11d, edx
shl ebp, 6
or ebp, eax
shr r11d, 2
or r11d, r9d
lea rax, [0x180000000]
mov ecx, dword [r10 + rax + 0x651f8]
shr r11d, 2
shr ebp, cl
mov ecx, 0x100
cmp ebp, dword [r10 + rax + 0x651e0]
sbb eax, eax
xor r9d, r9d
and eax, 0x40
mov edx, r9d
or r11d, eax
mov eax, ebp
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
mov eax, r9d
or r11d, edx
cmp ebp, 0xffff
cmova eax, ecx
lea rcx, [0x180000000]
mov ecx, dword [r10 + rcx + 0x65210]
or r11d, eax
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x180016d66
test r15b, r15b
mov eax, r9d
mov ecx, r9d
mov ebp, 0xfffd
setne cl
test r12b, r12b
setne al
add ecx, eax
mov eax, r9d
test r13b, r13b
setne al
add ecx, eax
mov eax, r9d
test r14b, r14b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
mov ebx, ecx
mov word [rdi], bp
add rdi, 2
movsxd rax, ebx
lea rbp, [0x180000000]
add r8, rax
cmp rdi, qword [rsp]
jb 0x180016be0
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov word [rdi], r9w
test rax, rax
je 0x180016dbd
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1800191a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6180], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x180019223
xor edx, edx
add rcx, 0x6188
call fcn.180029490
mov r8, rsi
lea rcx, [rbx + 0x6188]
mov rdx, rbp
call fcn.180028b10
mov eax, dword [rbx + 0x6188]
xor edx, edx
mov r9, qword [rbx + 0x6180]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6190]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x1800779d0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001922f
add rcx, 0x6188
call fcn.180028b10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180022960
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1800779c8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x60cc], ecx
test rbx, rbx
je 0x1800229cf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1800229e0
lea rdx, [0x180066124]
mov rcx, rbx
mov rdi, rax
call fcn.1800160a0
mov rbx, rax
test rax, rax
je 0x1800229ca
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18003ba50
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.180014fc0
test rax, rax
je 0x18003ba6e
call fcn.180015400
mov rbx, qword [rax + 0x90]
jmp 0x18003ba70
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18003ba9b
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x180059dc0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180059def
xor eax, eax
mov qword [0x180077a38], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180059e00]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18005b210
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1800772c0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rdx
mov edx, ecx
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18005b29e
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rbx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x18005b295
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x18005b2c1
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x18005b272
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800604f0
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret
mov rax, qword [rsp + 0x38]
mov qword [0x180077a80], rax
mov eax, dword [rsp + 0x40]
mov qword [0x180077a88], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18005b2a0

Function at 0x18005b2f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1800772c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18005b37e
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18005b375
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x18005b3a1
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18005b352
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800604f0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x18005b380
Function at 0x18005b3d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800772c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
lea rax, [rsp + 0x30]
mov rdx, rcx
mov qword [rsp + 0x20], rax
mov rdi, rcx
mov r9d, 0x40
mov rcx, qword [0x180077a90]
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x18005b43c
lea rdx, str.Failed_to_change_memory_protection_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180059210
lea rdx, [0x1800596d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18005b4df
mov rcx, qword [0x180077a90]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18005b49a
cmp qword [rsp + 0x38], rbx
jne 0x18005b49a
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rcx, qword [0x180077a90]
mov r8, rbx
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x18005b496
lea rdx, str.Failed_to_restore_memory_protection_
jmp 0x18005b41b
mov al, 1
jmp 0x18005b4e1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_write_to_memory_
call fcn.180059210
lea rdx, [0x1800596d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rcx, qword [0x180077a90]
mov r8, rbx
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800604f0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18005c030
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x180077240], 0
je 0x18005c177
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18005c13d
cmp byte [0x180077aa0], 0
jne 0x18005c080
lea rcx, [rsp + 0x30]
mov byte [0x180077aa0], 1
mov byte [0x180077aa2], 0
call fcn.180008520
mov rcx, qword [rax]
mov qword [0x180077aa8], rcx
lea rcx, [rsp + 0x30]
call fcn.180008520
mov rcx, qword [rax]
movabs rax, 0x431bde82d7b634db
sub rcx, qword [0x180077aa8]
imul rcx
movsxd rcx, dword [0x180077248]
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x18007724c]
cmp rdx, rax
jle 0x18005c113
cmp rdx, rcx
jge 0x18005c118
movsxd rax, dword [0x180077244]
cmp rdx, rax
jle 0x18005c177
cmp byte [0x180077aa2], 0
jne 0x18005c177
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x20
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov cl, 0x20
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x180077aa2], 1
add rsp, 0x28
ret
cmp rdx, rcx
jl 0x18005c177
cmp byte [0x180077aa1], 0
jne 0x18005c177
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x11
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x180077aa1], 1
add rsp, 0x28
ret
cmp byte [0x180077aa0], 0
je 0x18005c162
cmp byte [0x180077aa1], 0
je 0x18005c162
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov cl, 0x11
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x180077aa2], 0
mov byte [0x180077aa1], 0
mov byte [0x180077aa0], 0
add rsp, 0x28
ret
Function at 0x1410e1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410e11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1410e1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410e106f
add dl, dl
jne 0x1410e1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410e10f6
xor eax, eax
add dl, dl
jne 0x1410e10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410e11ad
add dl, dl
jne 0x1410e10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410e10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1410e107e
mov eax, 1
add dl, dl
jne 0x1410e1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410e10fb
sub eax, ebx
mov ebx, 1
jne 0x1410e114c
mov ecx, 1
add dl, dl
jne 0x1410e112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410e113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410e1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410e107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1410e1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410e1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410e115d
cmp eax, 0x7d00
jae 0x1410e119b
cmp eax, 0x500
jb 0x1410e1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410e107e
cmp eax, 0x7f
ja 0x1410e119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410e107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410e11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1410e107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140006d20
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1401188d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x120], 0
je 0x140006ddd
mov eax, dword [0x1401188d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x148], 1
je 0x140006dd9
mov ecx, dword [rsi + 0x1d30]
test ecx, ecx
jne 0x140006dd9
mov ecx, 1
lock xadd dword [rsi + 0x1d30], ecx
cmp ecx, 0x7fffffff
je 0x140006de7
test rsi, rsi
je 0x140006dea
lea rbx, [rax + 0x148]
call fcn.140009eb0
mov edx, 0x570
mov rcx, rax
xor r8d, r8d
call fcn.140009f70
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.140051e10
mov ecx, dword [0x14011b9f0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rbx], rdi
lock dec dword [rsi + 0x1d30]
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x140006dce
call fcn.14005dc78
jmp 0x140006d4a
int3
int3
Function at 0x14000b6b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14005e1d0
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14010a040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.140090270
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b763
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14000b767
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.14000b7c0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005e230
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14000b744
mov edi, 0x3f4
cmp eax, 2
jne 0x14000b744
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.140090270
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x14000b744
lea rdx, [rsp + 0x40]
jmp 0x14000b73a
Function at 0x1400110c0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x14010a040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1400edb10]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0xac
call fcn.140052d50
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.14004ed20
mov qword [rsp + 0x88], 0xb
mov al, byte [0x14011b3cb]
test al, al
jne 0x1400111ec
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rdi + 8], rax
mov qword [rdi], 0
lea rbx, [rsp + 0x98]
mov qword [rbx], rax
mov rcx, qword [rsi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, eax
mov r14, qword [rbx]
mov rcx, rdi
call fcn.140011220
mov qword [rbx], 0xb
mov al, byte [0x14011b3cb]
test al, al
jne 0x1400111c8
xor edi, edi
cmp esi, 1
sbb rdi, rdi
or rdi, r14
lea rcx, [rsp + 0x40]
call fcn.14004c090
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14005e230
mov rax, rdi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx ecx, al
lea r8, [rsp + 0x20]
mov qword [r8], 0
lea rdx, [rsp + 0x98]
mov r9d, 2
call fcn.140041e60
jmp 0x140011193
movzx ecx, al
lea r9, [rsp + 0x98]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x90]
mov qword [r8], rax
lea rdx, [rsp + 0x88]
call fcn.1400b5300
jmp 0x140011144
Function at 0x140017020
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x140017066
mov r15, rbx
test r15, r15
je 0x140017141
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x1400170c2
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400170b1
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.14008fbd0
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x140017042
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14001715d
lea rcx, [r13*8]
call fcn.14005c69c
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x140017123
xor r15d, r15d
mov r8, rcx
add r8, r15
je 0x140017141
mov r9, qword [r14 + r15]
mov qword [r8], r9
add r15, 8
cmp rdx, r15
jne 0x140017108
add r15, rcx
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x140017143
add rbx, 0xfffffffffffffff8
jne 0x140017136
ud2
test r12, r12
je 0x140017042
mov rcx, r12
call fcn.14005c694
mov r15, qword [rsi + 0x10]
jmp 0x140017042
call fcn.1400927c0
int3
Function at 0x140019190
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x10040
call fcn.14005e1d0
sub rsp, rax
mov rsi, rdx
mov rax, qword [0x14010a040]
xor rax, rsp
mov qword [rsp + 0x10038], rax
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rax
mov r8, rdi
call fcn.140052970
test rsi, rsi
jne 0x140019230
cmp byte [rsp + 0x37], 0
js 0x1400191ed
lea rcx, [rsp + 0x20]
jmp 0x1400191f2
mov rcx, qword [rsp + 0x20]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
cmp byte [rsp + 0x37], 0
jns 0x140019213
mov rcx, qword [rsp + 0x20]
call fcn.14005c694
mov rcx, qword [rsp + 0x10038]
xor rcx, rsp
call fcn.14005e230
mov eax, ebx
add rsp, 0x10040
pop rbx
pop rdi
pop rsi
ret
lea rbx, [rsp + 0x3a]
mov r8d, 0xfffe
mov rcx, rbx
mov dl, 0xaa
call fcn.140090270
cmp byte [rsp + 0x37], 0
jns 0x140019251
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x140019202
cmp eax, 0x7fff
jae 0x140019282
mov edx, eax
lea rcx, [rsp + 0x3a]
mov r8, rsi
call fcn.1400ad8e0
jmp 0x140019202
int3
Function at 0x1400215f0
Capabilities:
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x14010a040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1400edb10]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x20d
call fcn.140052d50
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.14004ed20
mov qword [rsp + 0x80], 0xb
mov al, byte [0x14011b3cb]
test al, al
jne 0x1400216e9
cmp byte [rsi + 0x17], 0
jns 0x140021677
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov qword [rsp + 0x90], 0xb
mov al, byte [0x14011b3cb]
test al, al
jne 0x1400216c5
cmp esi, 0xffffffff
setne bl
lea rcx, [rsp + 0x40]
call fcn.14004c090
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14005e230
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
lea r8, [rsp + 0x20]
mov qword [r8], 0
lea rdx, [rsp + 0x90]
mov r9d, 2
call fcn.140041e60
jmp 0x140021698
movzx ecx, al
lea r9, [rsp + 0x90]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x88]
mov qword [r8], rax
lea rdx, [rsp + 0x80]
call fcn.1400b5300
jmp 0x14002166e

Function at 0x140024520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140024540
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x140024580
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400245a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x1400245e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140024603
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret