joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a1b0
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14003b650
push rbx
sub rsp, 0x130
mov ebx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp r8, rbx
lea r9, [rsp + 0x150]
cmova r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003b690
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rbx
ret
mov dword [rsp + 0x158], ebx
cmp dword [rsp + 0x150], ebx
jne 0x14003b6ee
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call fcn.140036e70
test rax, rax
je 0x14003b6ee
mov r9d, 0x65
mov qword [rsp + 0x20], rax
lea r8, str..._.._.._util_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.1400283f0
lea rcx, [rsp + 0x30]
call fcn.140028580
mov eax, dword [rsp + 0x150]
add rsp, 0x130
pop rbx
ret

Function at 0x14003a210
Capabilities:
Check os version
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor edi, edi
movzx esi, dl
mov rbx, rcx
test dl, dl
je 0x14003a25b
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x14003a25b
xor ecx, ecx
mov qword [rsp + 0x40], 0x18
mov dword [rsp + 0x54], edi
call fcn.14003a2b0
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x50], 1
cmp qword [rbx + 0x18], 8
jb 0x14003a265
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov r9d, 2
mov edx, esi
mov dword [rsp + 0x30], 0
shl edx, 0x13
mov rcx, rbx
or edx, 3
mov dword [rsp + 0x28], 0x200
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14003ac60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
xor edi, edi
lea r8, [0x14003ad20]
mov rbx, rcx
mov qword [rsp + 0x28], rdi
mov r9, rcx
mov dword [rsp + 0x20], edi
xor edx, edx
mov dword [rsp + 0x150], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14003acfc
lea edi, [rax + 2]
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r9d, [rdi + 0x19]
lea r8, str..._.._.._util_thread_thread_win.cc
mov dword [rsp + 0x20], 4
lea rdx, str.void___cdecl_crashpad::Thread::Start_void_
lea rcx, [rsp + 0x30]
call fcn.140028500
mov rcx, rax
lea rdx, str.Check_failed:_platform_thread_
call fcn.140007ed0
mov rcx, rax
lea rdx, [0x1400ca83c]
call fcn.140007ed0
mov rcx, rax
lea rdx, [0x1400cd4c0]
call fcn.140007ed0
test dil, 2
je 0x14003ad0c
lea rcx, [rsp + 0x30]
call fcn.140028830
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret

Function at 0x14003b4e0
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x140
xor r9d, r9d
lea r8, [rsp + 0x158]
xor edx, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14003b53b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_file_io_win.cc
mov r9d, 0xf1
mov dword [rsp + 0x20], 2
lea rdx, str.__int64___cdecl_crashpad::LoggingSeekFile_void____int64_int_
lea rcx, [rsp + 0x30]
call fcn.140028500
lea rdx, [0x1400cd988]
jmp 0x14003b589
cmp qword [rsp + 0x158], 0
jne 0x14003b59b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14003b5a6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_file_io_win.cc
mov r9d, 0xfb
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_void__
lea rcx, [rsp + 0x30]
call fcn.140028500
lea rdx, [0x1400cd9a0]
mov rcx, rax
call fcn.140007ed0
lea rcx, [rsp + 0x30]
call fcn.140028830
xor al, al
add rsp, 0x140
pop rbx
ret
mov al, 1
add rsp, 0x140
pop rbx
ret

Function at 0x14003b650
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14003b650
push rbx
sub rsp, 0x130
mov ebx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp r8, rbx
lea r9, [rsp + 0x150]
cmova r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003b690
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rbx
ret
mov dword [rsp + 0x158], ebx
cmp dword [rsp + 0x150], ebx
jne 0x14003b6ee
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call fcn.140036e70
test rax, rax
je 0x14003b6ee
mov r9d, 0x65
mov qword [rsp + 0x20], rax
lea r8, str..._.._.._util_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.1400283f0
lea rcx, [rsp + 0x30]
call fcn.140028580
mov eax, dword [rsp + 0x150]
add rsp, 0x130
pop rbx
ret
Function at 0x14003b770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rdi, r8
lea r9, [rsp + 0x160]
mov ebp, 0xffffffff
mov rsi, rdx
cmp r8, rbp
mov rbx, rcx
cmova edi, ebp
xor r14d, r14d
mov r8d, edi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003b85f
nop word [rax + rax]
mov dword [rsp + 0x168], ebp
cmp dword [rsp + 0x160], ebp
je 0x14003b7d5
mov rax, r14
jmp 0x14003b7f1
lea r8, str.bytes_read___static_cast_DWORD___1_
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x160]
call fcn.140036e70
test rax, rax
je 0x14003b823
mov r9d, 0x7e
mov qword [rsp + 0x20], rax
lea r8, str..._.._.._util_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::ReadFile_void__void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.1400283f0
lea rcx, [rsp + 0x30]
call fcn.140028580
cmp dword [rsp + 0x160], r14d
jne 0x14003b885
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x14003b885
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], r14
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14003b7c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
neg eax
sbb rax, rax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x160]
jmp 0x14003b86d
Function at 0x14003e8c0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, 0x23456789
mov dword [rdx], 0x12345678
mov dword [rdx + 4], r9d
mov rbx, r8
mov dword [rdx + 8], 0x34567890
mov r10, rcx
movzx eax, byte [rcx]
test al, al
je 0x14003e953
mov r8d, 0x12345678
mov r11d, 0x34567890
nop word [rax + rax]
mov rcx, r8
lea r10, [r10 + 1]
xor rcx, rax
movzx eax, cl
mov ecx, r8d
shr ecx, 8
xor ecx, dword [rbx + rax*4]
movzx eax, cl
mov r8d, ecx
add eax, r9d
mov dword [rdx], ecx
imul r9d, eax, 0x8088405
mov ecx, r11d
shr ecx, 8
inc r9d
mov dword [rdx + 4], r9d
mov eax, r9d
shr rax, 0x18
xor rax, r11
movzx eax, al
xor ecx, dword [rbx + rax*4]
mov dword [rdx + 8], ecx
mov r11d, ecx
movzx eax, byte [r10]
test al, al
jne 0x14003e900
mov rbx, qword [rsp + 8]
ret

Function at 0x14003e960
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rbx, rcx
je 0x14003ea26
xor r11d, r11d
cmp dword [rcx + 0xd4], r11d
jbe 0x14003ea26
nop word [rax + rax]
movzx eax, byte [r11 + rbx + 0x100]
mov edx, dword [rbx + 0x10128]
mov ecx, edx
mov r8, qword [rbx + 0x10138]
xor rcx, rax
mov r10d, dword [rbx + 0x10130]
movzx eax, cl
and r10d, 0xfffd
mov ecx, dword [rbx + 0x10130]
or r10d, 2
shr edx, 8
xor edx, dword [r8 + rax*4]
mov dword [rbx + 0x10128], edx
movzx eax, dl
add eax, dword [rbx + 0x1012c]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x1012c], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
xor ecx, dword [r8 + rax*4]
mov eax, r10d
xor eax, 1
mov dword [rbx + 0x10130], ecx
imul eax, r10d
shr eax, 8
xor byte [r11 + rbx + 0x100], al
inc r11d
cmp r11d, dword [rbx + 0xd4]
jb 0x14003e990
mov r9d, dword [rbx + 0xd4]
lea r8, [rbx + 0x100]
mov rdx, qword [rbx + 0x58]
mov rcx, qword [rbx + 0x38]
mov edi, dword [rbx + 0xd4]
call qword [rbx + 0x10]
xor edx, edx
mov dword [rbx + 0xd4], 0
cmp eax, edi
mov ecx, 0xffffffff
cmovne edx, ecx
mov ecx, dword [rbx + 0x84]
add qword [rbx + 0x10118], rdi
mov eax, edx
add qword [rbx + 0x10120], rcx
mov dword [rbx + 0x84], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140049470
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x140049498
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400494ab
mov al, 1
jmp 0x1400495a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14004959b
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x1400494c9
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._client_crash_report_database_win.cc
mov r9d, 0x317
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.140028500
mov rcx, rax
lea rdx, str.CreateDirectory
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140049542
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x40]
call fcn.140028830
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140049597
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049592
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400495bc
call fcn.14008df80
xor al, al
jmp 0x1400495a3
mov rcx, rbx
call fcn.1400498c0
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x170
pop rbx
ret
call fcn.14009464c
int3
Function at 0x1400495f0
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r15, rdx
lea r8, [rdx + 0x10]
lea rdx, [rsp + 0x30]
mov r12, rcx
call fcn.1400482c0
xor esi, esi
lea rcx, [rsp + 0x30]
mov r14, qword [rax]
mov qword [rsp + 0x40], r14
mov qword [rax], rsi
call fcn.140047ee0
test r14, r14
jne 0x140049655
lea esi, [r14 + 3]
jmp 0x1400497df
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x1f0], rdi
call fcn.140026db0
movups xmm0, xmmword [r15]
mov rbx, qword [r14 + 0x30]
mov rdi, qword [r14 + 0x38]
movaps xmmword [rsp + 0x30], xmm0
cmp rbx, rdi
je 0x14004969e
nop dword [rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x30]
call fcn.140032e30
test al, al
jne 0x14004969e
add rbx, 0xc8
cmp rbx, rdi
jne 0x140049680
mov rdi, qword [rsp + 0x1f0]
cmp rbx, qword [r14 + 0x38]
jne 0x1400496b6
mov esi, 1
jmp 0x1400497d6
lea rdx, [rbx + 0x18]
lea rcx, [rbp + 0x50]
call fcn.140026de0
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x30]
call fcn.14004f110
mov byte [r14 + 0x28], 1
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400497cb
cmp qword [rbp + 0x68], 8
lea rax, [rbp + 0x50]
lea rdx, [rsp + 0x30]
cmovae rax, qword [rbp + 0x50]
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._client_crash_report_database_win.cc
mov esi, 2
lea rdx, str.enum_crashpad::CrashReportDatabase::OperationStatus___cdecl_crashpad::CrashReportDatabaseWin::DeleteReport_const_struct_crashpad::PftReportInfo__
mov r9d, 0x535
mov dword [rsp + 0x20], esi
lea rcx, [rsp + 0x48]
call fcn.140028500
mov rcx, rax
lea rdx, str.DeleteFile
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140049779
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x48]
call fcn.140028830
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1400497d6
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400497c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004980d
call fcn.14008df80
jmp 0x1400497d6
mov rdx, r15
mov rcx, r12
call fcn.14004de50
lea rcx, [rbp + 0x50]
call fcn.140026dd0
lea rcx, [rsp + 0x40]
call fcn.140047ee0
mov eax, esi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
call fcn.14009464c
int3
Function at 0x1400498c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1400498e8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400499de
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x140049904
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._client_crash_report_database_win.cc
mov r9d, 0x302
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.140028500
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14004997d
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x40]
call fcn.140028830
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140049ac7
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049ac2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049aec
jmp 0x140049ac2
test al, 0x10
jne 0x140049acb
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x1400499f3
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov r9d, 0x306
mov dword [rsp + 0x20], 2
lea r8, str..._.._.._client_crash_report_database_win.cc
mov rbx, rax
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.140028380
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140049a63
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140007ed0
lea rcx, [rsp + 0x40]
call fcn.140028580
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140049ac7
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049ac2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ae6
call fcn.14008df80
xor al, al
jmp 0x140049acd
mov al, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x170
pop rbx
ret
call fcn.14009464c
int3
call fcn.14009464c
int3
Function at 0x140049b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx + 0x38]
mov r14, r8
mov rsi, qword [rcx + 0x30]
mov eax, edx
mov qword [rsp + 0x78], rbx
cmp rsi, rbx
je 0x140049c87
movabs rbp, 0x1ffffffffffffff
nop dword [rax]
cmp dword [rsi + 0x80], eax
jne 0x140049c77
cmp qword [rsi + 0x30], 8
lea rcx, [rsi + 0x18]
jb 0x140049b5a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140049c73
test al, 0x10
jne 0x140049c73
mov rdi, qword [r14 + 8]
mov rcx, qword [r14 + 0x10]
cmp rdi, rcx
je 0x140049b93
mov rdx, rsi
mov rcx, rdi
call fcn.14001a2f0
sub qword [r14 + 8], 0xffffffffffffff80
jmp 0x140049c73
mov rax, qword [r14]
mov rbx, rdi
sub rbx, rax
sar rbx, 7
cmp rbx, rbp
je 0x140049c9e
sub rcx, rax
lea r13, [rbx + 1]
sar rcx, 7
mov rax, rbp
mov rdx, rcx
shr rdx, 1
sub rax, rdx
cmp rcx, rax
jbe 0x140049bca
mov r15, rbp
jmp 0x140049bd5
lea r15, [rdx + rcx]
cmp r15, r13
cmovb r15, r13
mov rdx, r15
mov rcx, r14
call fcn.14004f030
mov r12, rax
shl rbx, 7
add rax, rbx
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.14001a2f0
mov rbp, qword [r14 + 8]
mov rbx, qword [r14]
cmp rdi, rbp
jne 0x140049c2a
mov rdi, r12
cmp rbx, rbp
je 0x140049c53
nop
mov rdx, rbx
mov rcx, rdi
call fcn.14001a2f0
sub rdi, 0xffffffffffffff80
sub rbx, 0xffffffffffffff80
cmp rbx, rbp
jne 0x140049c10
jmp 0x140049c53
mov r9, r12
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.14004ee70
mov r9, qword [rsp + 0x60]
mov rdx, rdi
mov r8, qword [r14 + 8]
sub r9, 0xffffffffffffff80
mov rcx, r14
call fcn.14004ee70
mov r9, r15
mov r8, r13
mov rdx, r12
mov rcx, r14
call fcn.14004ec60
mov rbx, qword [rsp + 0x78]
movabs rbp, 0x1ffffffffffffff
mov eax, dword [rsp + 0x68]
add rsi, 0xc8
cmp rsi, rbx
jne 0x140049b40
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400073e0
int3
Function at 0x14004a0f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
movups xmm0, xmmword [rdx]
mov rbx, qword [rcx + 0x30]
mov r14, r9
mov rdi, qword [rcx + 0x38]
mov ebp, r8d
movaps xmmword [rsp + 0x20], xmm0
mov rsi, rcx
cmp rbx, rdi
je 0x14004a14e
nop dword [rax + rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x20]
call fcn.140032e30
test al, al
jne 0x14004a14e
add rbx, 0xc8
cmp rbx, rdi
jne 0x14004a130
cmp rbx, qword [rsi + 0x38]
jne 0x14004a15b
mov eax, 1
jmp 0x14004a1aa
mov eax, dword [rbx + 0x80]
cmp eax, ebp
jne 0x14004a18e
cmp qword [rbx + 0x30], 8
lea rcx, [rbx + 0x18]
jb 0x14004a173
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, 1
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x14004a19d
mov ecx, 1
mov edx, 4
cmp eax, ecx
cmove ecx, edx
test ecx, ecx
jne 0x14004a1a8
mov byte [rsi + 0x28], 1
mov qword [r14], rbx
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14004c790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rbx, rdx
xor edi, edi
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x58], edi
call fcn.1400482c0
lea rcx, [rsp + 0x20]
mov rsi, qword [rax]
mov qword [rsp + 0x58], rsi
mov qword [rax], rdi
call fcn.140047ee0
test rsi, rsi
jne 0x14004c7de
lea edi, [rsi + 3]
jmp 0x14004c859
movups xmm0, xmmword [rbx]
mov rbx, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x38]
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, rdi
je 0x14004c81e
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x20]
call fcn.140032e30
test al, al
jne 0x14004c81e
add rbx, 0xc8
cmp rbx, rdi
jne 0x14004c800
cmp rbx, qword [rsi + 0x38]
jne 0x14004c82b
mov edi, 1
jmp 0x14004c859
cmp qword [rbx + 0x30], 8
lea rcx, [rbx + 0x18]
jb 0x14004c839
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14004c824
shr edi, 3
and edi, 2
jne 0x14004c859
mov rdx, rbx
mov rcx, rbp
call fcn.1400481a0
lea rcx, [rsp + 0x58]
call fcn.140047ee0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14004c880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rbx, rdx
lea r8, [rdx + 0x10]
lea rdx, [rsp + 0x58]
call fcn.1400482c0
lea rcx, [rsp + 0x58]
mov rsi, qword [rax]
mov qword [rsp + 0x68], rsi
mov qword [rax], 0
call fcn.140047ee0
test rsi, rsi
jne 0x14004c8c3
lea edi, [rsi + 3]
jmp 0x14004c939
movups xmm0, xmmword [rbx]
mov rbx, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x38]
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, rdi
je 0x14004c8fe
nop dword [rax + rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x20]
call fcn.140032e30
test al, al
jne 0x14004c8fe
add rbx, 0xc8
cmp rbx, rdi
jne 0x14004c8e0
cmp rbx, qword [rsi + 0x38]
jne 0x14004c90b
mov edi, 1
jmp 0x14004c939
cmp qword [rbx + 0x30], 8
lea rcx, [rbx + 0x18]
jb 0x14004c919
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14004c904
shr edi, 3
and edi, 2
jne 0x14004c939
mov rdx, rbx
mov rcx, rbp
call fcn.1400481a0
lea rcx, [rsp + 0x68]
call fcn.140047ee0
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005b060
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [r8 + 0x18], 0x10
mov rsi, rdx
mov rdi, qword [rcx]
mov rdx, r8
mov rbx, r8
jb 0x14005b091
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
xor ebp, ebp
movabs r9, 0xcbf29ce484222325
mov ecx, ebp
test r8, r8
je 0x14005b0c5
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x14005b0b2
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140012e30
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14005b0fb
cmp rdx, qword [rdi + 8]
je 0x14005b0fb
add rdx, 0x30
lea rcx, [rsp + 0x40]
call fcn.140009b60
mov ecx, ebp
mov edi, 1
jmp 0x14005b11a
mov qword [rsp + 0x20], rbp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], 0xf
mov edi, ebp
mov qword [rsp + 0x30], rbp
mov ecx, 2
mov qword [rsi], rbp
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], rbp
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 0xf
mov byte [rax], bpl
test ecx, ecx
je 0x14005b183
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14005b183
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b17e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b238
call fcn.14008df80
test edi, edi
je 0x14005b1d3
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005b1c0
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b1bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b238
call fcn.14008df80
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], bpl
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14005b209
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14005b204
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005b238
mov rcx, r8
call fcn.14008df80
mov qword [rbx + 0x10], rbp
mov rax, rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008e050
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.14009464c
int3