joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023e00
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [rcx]
mov rdx, qword [r14 + 8]
xorps xmm0, xmm0
lea rdi, [rsp + 0x30]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov r8, rdi
call fcn.140080340
cmp byte [rdi + 0x17], 0
jns 0x140023e4b
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x47], 0
jns 0x140023e6c
mov rcx, qword [rsp + 0x30]
call fcn.1400a5630
test rsi, rsi
je 0x140023f1d
test edi, edi
je 0x140023f1d
mov ecx, edi
add rcx, rcx
call fcn.1400a5d28
mov rbx, rax
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
xorps xmm0, xmm0
lea r14, [rsp + 0x30]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
mov r8, r14
call fcn.140080340
cmp byte [r14 + 0x17], 0
jns 0x140023eb9
mov r14, qword [rsp + 0x30]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x47], 0
jns 0x140023ed9
mov rcx, qword [rsp + 0x30]
call fcn.1400a5630
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140023f3b
mov rcx, rbx
call fcn.1400a5d94
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x30]
call fcn.140086510
cmp byte [rsi + 0x17], 0
js 0x140023f4e
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1400a5934
test edi, edi
setne bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a77a0
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14011cbdc]
lea rdx, str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
call fcn.1400da0b0
mov rcx, qword [rsi]
call fcn.1400a5630
jmp 0x140023f04
Function at 0x140028490
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor eax, eax
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x1400285ac
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x1400285e8
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr edi, 5
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x1400285f0
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
and dil, al
mov byte [r8 + 0x16], dil
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x1400285e2
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x1400285f4
pop rdi
pop rsi
ret
mov dl, byte [r8 + 0x19]
jmp 0x1400285db
xor r10d, r10d
jmp 0x1400284ef
xor eax, eax
jmp 0x140028584
cmp byte [r8 + 0x1a], 0
je 0x1400285df
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x1400285df
cmp ecx, 0x666f736f
jne 0x1400285df
cmp edx, 0x76482074
jne 0x1400285df
mov byte [r8 + 0x19], 1
jmp 0x1400285df
Function at 0x14002bf70
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400a98e0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14002c02d
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1400a5d94
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.14009d1a0
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14002c060
cmp byte [rsi + 0x17], 0
jns 0x14002bfff
mov rcx, qword [rsi]
call fcn.1400a5630
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x14002c02d
mov rcx, qword [rsp + 0x30]
call fcn.1400a5630
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400a77a0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002c460
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400a98e0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002c4f5
cmp word [rsp + 0x70], 0
je 0x14002c4f5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1400a5d94
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.14009d1a0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400a77a0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.14002bf70
test al, al
jne 0x14002c543
lea rax, [0x1401278b2]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.14009d1a0
cmp byte [rsp + 0x57], 0
jns 0x14002c4d7
mov rcx, qword [rsp + 0x40]
call fcn.1400a5630
jmp 0x14002c4d7
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x14002c4d7
Function at 0x14002d2e0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
je 0x14002d42e
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], 0
test rdi, rdi
je 0x14002d330
mov rcx, rdi
call fcn.140025900
mov rcx, rdi
call fcn.1400a5630
mov rdx, qword [rsi + 0x48]
mov qword [rsi + 0x48], 0
test rdx, rdx
je 0x14002d350
lea rcx, fcn.1400619b0
xor r8d, r8d
call fcn.140068b90
mov rcx, qword [rsi + 0x38]
movabs rax, 0xfffffffc00000000
and rax, rcx
cmp rax, qword [0x14013c508]
jne 0x14002d36f
call fcn.14005dfe0
mov rdi, qword [rsi + 0x30]
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
test rdi, rdi
je 0x14002d38f
mov rcx, rdi
call fcn.140025900
mov rcx, rdi
call fcn.1400a5630
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x14002d3cd
call fcn.14007a8b0
mov rdi, qword [rsi + 0x28]
cmp qword [0x14014bb70], 0
je 0x14002d3ed
mov rcx, qword [0x14014bb70]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x14012eaa8]
mov qword [rsi + 0x28], 0
lea rcx, [rsi + 0x20]
call fcn.140006110
lea rcx, [rsi + 0x18]
call fcn.140006110
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001b4a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140128172]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002d451
lea rcx, [sym.opera.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14002d428
call qword [0x14012eaa8]
mov rcx, rax
xor edx, edx
call fcn.1400255c0
jmp 0x14002d3af
xor ecx, ecx
mov dl, 1
jmp 0x14002d421
test rcx, rcx
jne 0x14002d2f6
cmp dword [rsi + 0x14], 0
jne 0x14002d2f6
cmp qword [rsi + 8], 0
jne 0x14002d2f6
jmp 0x14002d30f
xor ecx, ecx
jmp 0x14002d41f
Function at 0x140031420
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x14003153f
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x14003153f
lea rbx, [rdi + 8]
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rcx, rbx
mov rdx, rax
call fcn.14000c380
mov r15, qword [rbx]
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400315c9
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.1400a5638
mov r14, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.1400a5638
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x14013c508]
je 0x140031563
mov rax, r14
and rax, r12
cmp rax, qword [0x14013c508]
je 0x1400315d4
mov qword [rdi + 0x18], r14
lea r15, [rdi + 0x10]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400553b0]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r15
mov rdx, rax
call fcn.14000c380
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 1
jbe 0x14003156d
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x1400315e1
mov eax, r14d
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14005e390
jmp 0x1400314e4
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x14013c508]
jne 0x140031582
call fcn.14005e390
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x1400315c9
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x1400315b0
mov rcx, rdi
call fcn.140059910
mov rcx, rdi
call fcn.1400a5630
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x1400315f8
mov rcx, rbx
call fcn.1400a5630
mov r14d, 0x3b
jmp 0x14003153f
mov rcx, r14
call fcn.14005de80
jmp 0x1400314f7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x14012eaa8]
jmp 0x140031552
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x14012eaa8]
jmp 0x1400315c1
Function at 0x140031c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
movapd xmmword [rsp + 0x10], xmm7
movapd xmmword [rsp], xmm6
mov r11, qword [r8]
mov r10, qword [r8 + 8]
mov rax, r10
sub rax, r11
sar rax, 2
lea r9, [rax - 1]
cmp r9, 2
jb 0x140031cd8
cvtsi2sd xmm0, ecx
cvtsi2sd xmm1, edx
add rax, 0xfffffffffffffffd
movq xmm2, rax
punpckldq xmm2, xmmword [0x14011dd90]
subpd xmm2, xmmword [0x14011dda0]
haddpd xmm2, xmm2
mov ecx, 1
movq xmm3, qword [0x14011dd90]
movapd xmm4, xmmword [0x14011dda0]
movsd xmm5, qword [0x140127c20]
mov rdx, qword [r8]
mov r10, qword [r8 + 8]
sub r10, rdx
sar r10, 2
cmp r10, rcx
jbe 0x140031cfa
movq xmm6, rax
punpckldq xmm6, xmm3
subpd xmm6, xmm4
haddpd xmm6, xmm6
lea r10, [rcx - 1]
movq xmm7, r10
punpckldq xmm7, xmm3
subpd xmm7, xmm4
haddpd xmm7, xmm7
mulsd xmm6, xmm0
mulsd xmm7, xmm1
addsd xmm7, xmm6
divsd xmm7, xmm2
addsd xmm7, xmm5
cvttsd2si r10d, xmm7
mov dword [rdx + rcx*4], r10d
dec rax
inc rcx
cmp rcx, r9
jne 0x140031c70
mov r11, qword [r8]
mov r10, qword [r8 + 8]
cmp r10, r11
je 0x140031cfd
mov dword [r10 - 4], 0x7fffffff
mov rcx, r8
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x28
jmp fcn.14009e180
int3
int3

Function at 0x140033990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140119af0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x20b
call fcn.1400824a0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400960c0
mov qword [rsp + 0x80], 0xa
mov al, byte [0x14014b81a]
test al, al
jne 0x140033a4d
cmp byte [rsi + 0x17], 0
jns 0x140033a17
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x40]
call fcn.140088540
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400a77a0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
lea r9, [rsp + 0x90]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x88]
mov qword [r8], rax
lea rdx, [rsp + 0x80]
call fcn.140089af0
jmp 0x140033a0e
Function at 0x140033a80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rdi, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [0x140119af0]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r9d, 0x214
call fcn.1400824a0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400960c0
mov qword [rsp + 0xa0], 0xa
mov al, byte [0x14014b81a]
test al, al
jne 0x140033be9
cmp byte [rdi + 0x17], 0
jns 0x140033b0b
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140033c5f
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor esi, esi
mov rcx, rdi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140033b88
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x140033be5
call fcn.14007a8b0
mov rsi, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
setne dil
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140033bbe
call fcn.14007a8b0
cmp qword [0x14014bb70], 0
je 0x140033c1b
mov rcx, qword [0x14014bb70]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [0x14012eaa8]
lea rcx, [rsp + 0x60]
call fcn.140088540
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400a77a0
mov eax, edi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x140033b80
movzx ecx, al
lea r9, [rsp + 0xb0]
mov qword [r9], rsi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0xa8]
mov qword [r8], rax
lea rdx, [rsp + 0xa0]
call fcn.140089af0
jmp 0x140033b02
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140128172]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140033c66
lea rcx, [sym.opera.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140033c59
call qword [0x14012eaa8]
mov rcx, rax
xor edx, edx
call fcn.1400255c0
jmp 0x140033ba8
xor ecx, ecx
mov dl, 1
jmp 0x140033c4f
xor edi, edi
jmp 0x140033bbe
xor ecx, ecx
jmp 0x140033c4d
Function at 0x140033c70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140119af0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x233
call fcn.1400824a0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400960c0
mov qword [rsp + 0x80], 0xa
mov al, byte [0x14014b81a]
test al, al
jne 0x140033d38
cmp byte [rsi + 0x17], 0
jns 0x140033cf7
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
lea rcx, [rsp + 0x40]
call fcn.140088540
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400a77a0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
lea r9, [rsp + 0x90]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x88]
mov qword [r8], rax
lea rdx, [rsp + 0x80]
call fcn.140089af0
jmp 0x140033cee
Function at 0x140033f00
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140119af0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, [0x1401278ff]
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x43a
call fcn.1400824a0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400960c0
mov qword [rsp + 0x80], 0xa
mov al, byte [0x14014b81a]
test al, al
jne 0x140033fbc
cmp byte [rsi + 0x17], 0
jns 0x140033f87
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea rcx, [rsp + 0x40]
call fcn.140088540
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400a77a0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
lea r9, [rsp + 0x90]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x88]
mov qword [r8], rax
lea rdx, [rsp + 0x80]
call fcn.140089af0
jmp 0x140033f7e

Function at 0x140036140
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov al, byte [rcx + 8]
cmp al, byte [rdx + 8]
je 0x14003618a
test al, al
jne 0x1400361bb
test rsi, rsi
je 0x1400361b8
xor eax, eax
mov qword [rsi], rax
mov rdi, qword [rdx]
mov qword [rdx], rax
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140036174
call fcn.14007a8b0
mov rcx, rsi
mov rdx, rdi
call fcn.14000c380
mov byte [rsi + 8], 1
add rsp, 0x28
pop rdi
pop rsi
ret
test al, al
je 0x140036183
mov rdi, qword [rdx]
mov qword [rdx], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400361a7
call fcn.14007a8b0
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14000c380
int3
mov rcx, rsi
call fcn.140006110
mov byte [rsi + 8], 0
jmp 0x140036183

Function at 0x140036920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140036940
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x140036980
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400369a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret
Function at 0x1400369e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140036a03
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x140036a60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140036a83
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x140036ae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140036b09
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x140036b70
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140036b99
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret
Function at 0x140036ed0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x140036f2a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140036f20
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
ret