joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c7a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x140118b20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14006c7cd
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006c7c3

Function at 0x14006d150
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x140116fe8]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006d1b3
mov rax, qword [0x140116fe0]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14007c600
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140116fe8]
call fcn.14007b8a0
cmp dword [0x140116fe8], 0xffffffff
jne 0x14006d18d
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14007eec0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14007b74c
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140117020]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006d273
lea r8, [0x140116ff0]
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r9d, edi
call fcn.140045800
mov qword [0x140116fe0], rsi
lea rcx, [0x140116fe8]
call fcn.14007b938
jmp 0x14006d18d
lea rcx, [0x140117020]
call fcn.14007b8a0
cmp dword [0x140117020], 0xffffffff
jne 0x14006d244
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x140117010], xmm2
movups xmmword [0x140117000], xmm1
movups xmmword [0x140116ff0], xmm0
lea rcx, [0x140117020]
call fcn.14007b938
jmp 0x14006d244

Function at 0x14006d8b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140111508]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006d8e4
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14006d8e4
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14006d8de
Function at 0x14006d8f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140111508]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006d92e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14006d927
call fcn.1400462c0
jmp 0x14006d90e

Function at 0x14006dde0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x14006de0c
xor ecx, ecx
lea r9, [0x1400fbd20]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 1
cmp r8, rcx
jne 0x14006ddf0
ret

Function at 0x14006ef10
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14006ef48
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x14006ef52
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14006ef59
add rdi, rbx
sub rsi, rbx
jne 0x14006ef2a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x14006ef32
int3

Function at 0x14006f840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x14006f8d8
test rax, rax
jne 0x14006f8c7
cmp dword [rsi + 0x50], 0
jne 0x14006f8c7
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x14006f8b5
lea rdi, [rsi + 0x20]
movabs r14, 0x100003600
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.14005a110
cmp rax, 0xffffffffffffffff
jne 0x14006f8a7
cmp dword [rsi + 0x58], 1
jne 0x14006f8f4
jmp 0x14006f8e1
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x14006f883
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400d20a0
mov rax, qword [rsi + 0x40]
jmp 0x14006f858
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x14006f8f4
bt r14, rax
jb 0x14006f8a7
mov rax, qword [rsi + 0x10]
mov bl, 1
nop word [rax + rax]
cmp rax, qword [rsi + 0x18]
je 0x14006f8bb
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.14005a110
cmp rax, 0xffffffffffffffff
jne 0x14006f8bb
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x14006f92e
add rax, 1
mov qword [rsi + 0x10], rax
jmp 0x14006f900
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x14006f924
bt r14, rcx
jae 0x14006f924
jmp 0x14006f8bb
Function at 0x140073690
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140118c30]
cmp rsi, 1
jbe 0x1400736b3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14006d8f0
lea rcx, [0x140118c30]
call fcn.140046050
test al, al
je 0x1400736f9
mov qword [0x140118c38], 0
lea rdi, [0x140118c30]
lea rsi, [0x140118c38]
mov rcx, rsi
xor edx, edx
call fcn.1400464d0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400460f0
jmp 0x1400736a3
mov rsi, qword [0x140118c30]
jmp 0x1400736a3

Function at 0x1400786a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14011a1a8]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400786d5
lea rcx, [0x14011a1a0]
add rsp, 0x28
jmp fcn.14006d8b0
lea rcx, [0x14011a1a8]
call fcn.14007b8a0
cmp dword [0x14011a1a8], 0xffffffff
jne 0x1400786c5
mov qword [0x14011a1a0], 0
lea rcx, [0x14011a1a0]
xor edx, edx
call fcn.1400464d0
lea rcx, [0x14011a1a8]
call fcn.14007b938
jmp 0x1400786c5

Function at 0x14007aef0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14011a6d0]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007af56
lea rcx, [0x14011a6c8]
xor edx, edx
call fcn.14006d8f0
mov eax, dword [0x14011a6e0]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007af92
lea rcx, [0x14011a6d8]
xor edx, edx
add rsp, 0x28
jmp fcn.14006d8f0
lea rcx, [0x14011a6d0]
call fcn.14007b8a0
cmp dword [0x14011a6d0], 0xffffffff
jne 0x14007af15
mov qword [0x14011a6c8], 0
lea rcx, [0x14011a6c8]
xor edx, edx
call fcn.1400464d0
lea rcx, [0x14011a6d0]
call fcn.14007b938
jmp 0x14007af15
lea rcx, [0x14011a6e0]
call fcn.14007b8a0
cmp dword [0x14011a6e0], 0xffffffff
jne 0x14007af44
mov qword [0x14011a6d8], 0
lea rcx, [0x14011a6d8]
xor edx, edx
call fcn.1400464d0
lea rcx, [0x14011a6e0]
call fcn.14007b938
jmp 0x14007af44

Function at 0x14007b0f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14011a6e8]
cmp rsi, 1
jbe 0x14007b113
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14006d8f0
lea rcx, [0x14011a6e8]
call fcn.140046050
test al, al
je 0x14007b159
mov qword [0x14011a6f0], 0
lea rdi, [0x14011a6e8]
lea rsi, [0x14011a6f0]
mov rcx, rsi
xor edx, edx
call fcn.1400464d0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400460f0
jmp 0x14007b103
mov rsi, qword [0x14011a6e8]
jmp 0x14007b103
Function at 0x14007b170
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14011a700]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007b1ad
lea rcx, [0x14011a6f8]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14006d8f0
lea rcx, [0x14011a700]
call fcn.14007b8a0
cmp dword [0x14011a700], 0xffffffff
jne 0x14007b199
mov qword [0x14011a6f8], 0
lea rcx, [0x14011a6f8]
xor edx, edx
call fcn.1400464d0
lea rcx, [0x14011a700]
call fcn.14007b938
jmp 0x14007b199
Function at 0x1400bf8d0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14007b74c
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400bf940]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400896c0
mov qword [rbx], rax
test rax, rax
je 0x1400bf927
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400c0dd0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x17], 0
jns 0x1400c0ddd
mov rcx, qword [rcx]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400c1830
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x140114c48]
test rax, rax
je 0x1400c1974
cmp eax, 2
jne 0x1400c18ac
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x1400c1944
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140035120
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400c1937
mov eax, 1
lock xadd qword [0x140114c80], rax
test rax, rax
jle 0x1400c18cc
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140114c00], eax
mov qword [0x140114bf8], rsi
mov rcx, qword [0x1401101c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x1400c1944
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xaf
mov r9d, 2
call fcn.140035120
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.1400556b0
mov rcx, rsi
call fcn.1400355b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14007c600
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x140114c48]
test rax, rax
je 0x1400c197b
jmp 0x1400c185e
Function at 0x1400c3010
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov edi, 2
cmp rdx, 1
jne 0x1400c304a
mov rsi, qword [r14 + 8]
cmp rdi, rsi
ja 0x1400c314b
jae 0x1400c3141
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x1400c3065
cvtsi2ss xmm0, rax
jmp 0x1400c307a
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400c3058
mov rdi, rdx
jmp 0x1400c3027
mov rcx, rdx
call fcn.140058560
mov rdi, rax
jmp 0x1400c3027
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.1400a7ca0
cvttss2si rcx, xmm0
movss xmm1, dword [0x1400f3460]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rsi, 3
jb 0x1400c312d
mov rcx, rsi
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rbx, rsi
sub rbx, rdx
movabs rdx, 0x3333333333333333
mov rcx, rbx
shr rcx, 2
and rbx, rdx
and rcx, rdx
add rcx, rbx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x1400c312d
cmp rax, 2
jb 0x1400c3135
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400c3135
mov rcx, rax
call fcn.140058560
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rsi
jb 0x1400c314b
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, r14
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400a9850
Function at 0x1400cae00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x38]
mov rbp, qword [rcx + 0x40]
mov r15d, 1
cmp rdi, rbp
je 0x1400cae98
mov r14, r8
mov rsi, rcx
lea rbx, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.1400ca450
test al, al
jne 0x1400cae5c
add rdi, 0x70
cmp rbp, rdi
jne 0x1400cae41
mov rdi, rbp
cmp rdi, qword [rsi + 0x40]
je 0x1400cae98
cmp byte [rdi + 0x27], 0
jns 0x1400cae6e
mov rcx, qword [rdi + 0x10]
jmp 0x1400cae72
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov r15d, 1
cmovne r15d, ecx
test r15d, r15d
jne 0x1400cae98
mov qword [r14], rdi
xor r15d, r15d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007c600
mov eax, r15d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d9800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d982a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d986b
mov edi, eax
test bl, bl
jne 0x1400d9923
mov eax, edi
and eax, 0x400
je 0x1400d9923
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14007c600
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x1400d984c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x81
mov r9d, 2
call fcn.1400c2020
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400556b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fad0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400d98f8
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400556b0
cmp byte [rsp + 0x57], 0
jns 0x1400d9914
mov rcx, qword [rsp + 0x40]
call fcn.14007b788
lea rcx, [rsp + 0x58]
call fcn.1400c20a0
jmp 0x1400d984c
and edi, 0x10
shr edi, 4
jmp 0x1400d984e

Function at 0x1400d9930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d9958
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d9988
test eax, 0x410
sete bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14007c600
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x1400d9a3f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x74
mov r9d, 2
call fcn.1400c2020
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400556b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fad0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400d9a19
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400556b0
cmp byte [rsp + 0x57], 0
jns 0x1400d9a35
mov rcx, qword [rsp + 0x40]
call fcn.14007b788
lea rcx, [rsp + 0x58]
call fcn.1400c20a0
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14007c600
xor eax, eax
jmp 0x1400d997d
Function at 0x1400d9a60
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d9a87
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d9aa2
and eax, 0x410
cmp eax, 0x410
je 0x1400d9b95
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400d9aae
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x1400d9ad7
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14007c600
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x1400d9b8e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.1400c2020
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400556b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14005fad0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400d9b68
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400556b0
cmp byte [rsp + 0x4f], 0
jns 0x1400d9b84
mov rcx, qword [rsp + 0x38]
call fcn.14007b788
lea rcx, [rsp + 0x50]
call fcn.1400c20a0
xor edi, edi
jmp 0x1400d9abb
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14007c600
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400d9bc0

Function at 0x1400d9bc0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400d9be8
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x1400d9c16
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14007c600
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x1400d9bf4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.1400c2020
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400556b0
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14005fad0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x1400d9ca3
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1400556b0
cmp byte [rsp + 0x57], 0
jns 0x1400d9cbf
mov rcx, qword [rsp + 0x40]
call fcn.14007b788
lea rcx, [rsp + 0x58]
call fcn.1400c20a0
jmp 0x1400d9bf4
Function at 0x1400e0370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rcx
test r8d, r8d
jne 0x1400e039e
movabs rax, 0x100000001
mov qword [r14], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15d, r8d
mov dword [r14], 0
test dl, 1
jne 0x1400e03bf
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov ebp, edx
test dl, 1
je 0x1400e03af
jmp 0x1400e03c4
movzx ebp, dx
xor ebx, ebx
bsr ecx, ebp
xor ecx, 0x1f
mov eax, 0x20
sub eax, ecx
imul eax, r15d
cmp eax, 0xde3
jg 0x1400e04c1
mov eax, 1
mov esi, eax
lea eax, [rsi + rsi]
cmp esi, r15d
jle 0x1400e03e5
or cl, 0x20
mov r8, 0xffffffffffffffff
shl r8, cl
sar esi, 2
movzx r10d, dx
xor eax, eax
test esi, esi
jne 0x1400e0480
xor esi, esi
mov rcx, r10
mov dword [r14], 0
test rcx, rcx
je 0x1400e0439
xor edx, edx
mov edi, ecx
and edi, 0xfffffff
mov dword [r14 + rdx*4 + 4], edi
shr rcx, 0x1c
inc rdx
test rcx, rcx
jne 0x1400e041c
mov word [r14], dx
test al, 1
je 0x1400e0447
mov rcx, r14
mov edx, ebp
call fcn.1400e0090
test esi, esi
je 0x1400e0466
mov rcx, r14
call fcn.1400e01e0
test esi, r15d
je 0x1400e0462
mov rcx, r14
mov edx, ebp
call fcn.1400e0090
sar esi, 1
jne 0x1400e044b
imul ebx, r15d
mov rcx, r14
mov edx, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400dffe0
xor eax, eax
mov r9d, 1
mov rcx, r10
imul rcx, rcx
test esi, r15d
je 0x1400e04ab
test rcx, r8
mov edx, 1
cmove rdx, r10
movzx eax, al
cmovne eax, r9d
imul rcx, rdx
sar esi, 1
je 0x1400e040e
mov rdx, rcx
shr rdx, 0x20
je 0x1400e048b
jmp 0x1400e040e
call fcn.1400ce270
int3
Function at 0x1400062c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400062e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400062e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret