joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9280
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400d92bc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400d92c6
add rdi, rbx
sub rsi, rbx
jne 0x1400d929a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14008d5e0
int3

Function at 0x1400d92d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
xor eax, eax
lea rcx, [0x140168e80]
movaps xmm0, xmmword [rsp + rax + 0x20]
xorps xmm0, xmmword [rax + rcx]
movaps xmmword [rsp + rax + 0x20], xmm0
add rax, 0x10
cmp rax, 0x30
jne 0x1400d930b
lea rdi, [rsi + 0xf8]
mov eax, dword [0x14018a254]
lea rcx, [rsp + 0x20]
bt eax, 0x19
jae 0x1400d9391
mov edx, 0x100
mov r8, rsi
call fcn.1400166a0
lea rax, [0x1400151a0]
test rdi, rdi
je 0x1400d935e
lea rcx, [0x140014440]
mov qword [rdi], rcx
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008fec0
nop
add rsp, 0x58
pop rdi
pop rsi
ret
bt eax, 9
jae 0x1400d93b9
mov edx, 0x100
mov r8, rsi
call fcn.140017890
lea rax, [0x140017d60]
test rdi, rdi
je 0x1400d935e
lea rcx, [0x140017a60]
jmp 0x1400d935b
mov rdx, rsi
call fcn.140124b10
lea rax, [0x140125460]
test rdi, rdi
je 0x1400d935e
lea rcx, [0x1401244a0]
jmp 0x1400d935b

Function at 0x1400db05d
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14008d2b8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14010a9e0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.14008e2ac
mov qword [rbx], rax
test rax, rax
je 0x1400db0b4
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400dc4b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400dc4db
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock inc dword [rsi]
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, rsi
call fcn.140120bb0
lock dec dword [rsi]
je 0x1400dc4fa
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.140120b50
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400013b0
Function at 0x1400e28b0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret

Function at 0x1400f6290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400f6298
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x1400f62f6
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x1400f62d6
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008fec0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14008ea04
cmp eax, 0xffffffff
je 0x1400f6373
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1400f6314
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x1400f637d
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x1400f6350
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x1400f62d6
mov edi, edi
test rdi, rdi
jle 0x1400f6422
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.14008e9ac
cmp eax, 0xffffffff
jne 0x1400f6352
mov edi, 0xffffffff
jmp 0x1400f62d6
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x1400f640b
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1400f6373
mov rcx, qword [rsi + 0x40]
call fcn.14008ea04
cmp eax, 0xffffffff
je 0x1400f6373
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400f638e
cmp eax, 2
je 0x1400f6373
cmp eax, 3
je 0x1400f6339
jmp 0x1400f6341
movzx edi, byte [rsp + 0x57]
jmp 0x1400f62d6
Function at 0x1400f6580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400f6588
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x1400f65e6
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x1400f65c6
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008fec0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14008ea04
cmp eax, 0xffffffff
je 0x1400f666b
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1400f6604
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1400f6674
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x1400f6645
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x1400f65c6
mov edi, edi
test rdi, rdi
jle 0x1400f6719
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.14008e9ac
cmp eax, 0xffffffff
jne 0x1400f6647
mov di, 0xffff
jmp 0x1400f65c6
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x1400f6702
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1400f666b
mov rcx, qword [rsi + 0x40]
call fcn.14008ea04
cmp eax, 0xffffffff
je 0x1400f666b
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400f6685
cmp eax, 2
je 0x1400f666b
cmp eax, 3
je 0x1400f662b
jmp 0x1400f6635
movzx edi, word [rsp + 0x56]
jmp 0x1400f65c6
Function at 0x1400f6890
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14008ea0c
cmp rax, rbx
jne 0x1400f692c
cmp edi, 1
je 0x1400f68d4
cmp edi, 2
je 0x1400f692c
mov rcx, qword [rsi + 0x40]
call fcn.14008ea90
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400f6950
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400f6985
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14008ea0c
xor ebx, ebx
test rsi, rsi
jle 0x1400f69aa
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x1400f69aa
inc rbx
cmp rsi, rbx
jne 0x1400f698c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400f69c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x1400f6a2a
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x1400f6a50
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14008ea0c
mov esi, 0xffffffff
cmp rax, 1
je 0x1400f6a2d
jmp 0x1400f6a30
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x1400f6b00
mov ebp, eax
cmp eax, 3
je 0x1400f6adf
cmp ebp, 1
ja 0x1400f6b00
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14008ea0c
cmp rax, rsi
jne 0x1400f6b00
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x1400f6a68
jmp 0x1400f6a2d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14008ea0c
cmp rax, 1
je 0x1400f6a2d
mov esi, 0xffffffff
jmp 0x1400f6a30

Function at 0x1400f6b50
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400f6b85
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14008ea0c
xor ebx, ebx
test rsi, rsi
jle 0x1400f6bab
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x1400f6bab
inc rbx
cmp rsi, rbx
jne 0x1400f6b8c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400f6bc0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x1400f6c2a
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x1400f6c50
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14008ea0c
mov si, 0xffff
cmp rax, 1
je 0x1400f6c2d
jmp 0x1400f6c30
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x1400f6d00
mov ebp, eax
cmp eax, 3
je 0x1400f6cdf
cmp ebp, 1
ja 0x1400f6d00
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14008ea0c
cmp rax, rsi
jne 0x1400f6d00
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x1400f6c68
jmp 0x1400f6c2d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14008ea0c
cmp rax, 1
je 0x1400f6c2d
mov si, 0xffff
jmp 0x1400f6c30
Function at 0x1400fd890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov r15b, byte [rbp + 0x78]
test byte [r9 + 8], 1
jne 0x1400fd8ef
movzx eax, word [rbp + 0x70]
movzx edx, r15b
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov word [rsp + 0x20], ax
mov rdx, r14
mov r8, rdi
call qword [rbx + 0x30]
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1401837c8]
call fcn.14005f49a
mov r12, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1400fd929
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rbp - 0x20]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [0x14015c320]
movaps xmmword [r13], xmm0
mov rax, qword [r12]
xor r15b, 1
movzx esi, r15b
mov rcx, r12
mov rdx, r13
call qword [rax + rsi*8 + 0x28]
movzx ebx, byte [r13 + 0x17]
test bl, bl
mov rcx, qword [r13]
mov r8, qword [r13 + 8]
mov rax, rbx
cmovs rax, r8
test rax, rax
je 0x1400fd9e1
test bl, bl
mov rsi, rcx
cmovns rsi, r13
test rdi, rdi
je 0x1400fd9d0
movzx eax, word [rsi]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400fd9d4
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1400fd9a6
xor edi, edi
mov bl, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
add rsi, 2
test bl, bl
mov rax, r13
cmovs rax, rcx
movzx edx, bl
cmovs rdx, r8
lea rax, [rax + rdx*2]
cmp rsi, rax
jne 0x1400fd981
jmp 0x1400fd9e1
xor edi, edi
jmp 0x1400fd9b1
mov rbx, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [rbx + 0x60]
jmp 0x1400fd99e
shr bl, 7
mov qword [r14], rdi
test bl, bl
je 0x1400fd8db
call fcn.14008d2a8
jmp 0x1400fd8db

Function at 0x14010b6d0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edx, 1
jmp fcn.140006530
Function at 0x14010d700
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
movaps xmmword [rsp + 0xc0], xmm6
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x50], r14
movaps xmm6, xmmword [0x14015c320]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x9c
call fcn.140048d60
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140048d80
mov qword [rbx], r14
mov rcx, qword [rsi]
lea rdi, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, eax
mov rbx, qword [rdi]
test byte [0x14017ff80], 0x19
jne 0x14010d7e4
xor edi, edi
cmp esi, 1
sbb rdi, rdi
or rdi, rbx
lea rcx, [rsp + 0x60]
call fcn.140046d50
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14008fec0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], r14
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x14017ff80]
lea r9, [0x14016398f]
mov rcx, rdi
mov dl, 0x45
call fcn.14003a350
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14010d7a7
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14010d7a7

Function at 0x14010dc40
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 4
lea r15, [rsp + 0x3c]
mov dword [r15], eax
lea r12, [rsp + 0x38]
mov dword [r12], eax
lea rsi, [rsp + 0x34]
mov dword [rsi], 0
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.140048d60
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14010dd02
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14010dce5
cmp dword [rsp + 0x38], 4
jne 0x14010dce5
mov eax, dword [rsp + 0x34]
mov dword [r14], eax
xor edi, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008fec0
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x14010dce5

Function at 0x140111850
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401814d8]
cmp ecx, 0xffffffff
je 0x140111875
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x140111870
Function at 0x14011bbe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
sub r9, r8
je 0x14011bc1a
mov rdx, r9
shr rdx, 2
xor eax, eax
lea r10, [0x1401702b0]
movzx r11d, dl
movzx esi, byte [r8 + rax]
xor esi, r11d
shr edx, 8
xor edx, dword [r10 + rsi*4]
inc rax
cmp r9, rax
jne 0x14011bbfd
jmp 0x14011bc1c
xor edx, edx
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret
Function at 0x14012cc30
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd r10, dword [rdx + 8]
cmp r9d, r10d
jge 0x14012cc55
mov r11, qword [rdx]
xor r8d, r8d
mov rax, r9
or r8, qword [r11 + rax*8]
inc rax
cmp r10, rax
jne 0x14012cc47
jmp 0x14012cc58
xor r8d, r8d
cmp r10d, r9d
jge 0x14012cc6f
mov r11, qword [rcx]
mov rax, r10
or r8, qword [r11 + rax*8]
inc rax
cmp r9, rax
jne 0x14012cc63
cmp r9d, r10d
cmovl r10d, r9d
test r10d, r10d
jle 0x14012cc99
mov r9, qword [rcx]
mov r11, qword [rdx]
mov r10d, r10d
xor eax, eax
mov rsi, qword [r11 + rax*8]
xor rsi, qword [r9 + rax*8]
or r8, rsi
inc rax
cmp r10, rax
jne 0x14012cc86
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret

Function at 0x14012e0d0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x14015c320]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.1400e26d0
mov rcx, rsi
mov rdx, rdi
call fcn.1400e2940
mov r8d, 0xd8
mov rcx, rdi
xor edx, edx
call fcn.1400924f0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14008fec0
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x140131bb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov r12, rdx
mov r14, rcx
mov r10d, dword [rsp + 0xe0]
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x78], rax
movsxd r8, dword [rcx + 0x18]
lea ecx, [r10 + 4]
mov esi, ecx
shr esi, 6
xor edx, edx
mov edi, 0
cmp rsi, r8
jae 0x140131c08
mov rdi, qword [r9 + rsi*8]
shr rdi, cl
shl edi, 5
and edi, 0x20
lea ecx, [r10 + 3]
mov eax, ecx
shr eax, 6
cmp rax, r8
jae 0x140131c23
mov rdx, qword [r9 + rax*8]
shr rdx, cl
shl edx, 4
and edx, 0x10
or edx, edi
lea ecx, [r10 + 2]
mov eax, ecx
shr eax, 6
xor edi, edi
mov esi, 0
cmp rax, r8
jae 0x140131c47
mov rsi, qword [r9 + rax*8]
shr rsi, cl
shl esi, 3
and esi, 8
or edx, esi
lea ecx, [r10 + 1]
mov eax, ecx
shr eax, 6
cmp rax, r8
jae 0x140131c64
mov rdi, qword [r9 + rax*8]
shr rdi, cl
shl edi, 2
and edi, 4
or edx, edi
mov eax, r10d
shr eax, 6
xor edi, edi
cmp rax, r8
jae 0x140131c82
mov rdi, qword [r9 + rax*8]
mov ecx, r10d
shr rdi, cl
add edi, edi
and edi, 2
or edx, edi
test r10d, r10d
je 0x140131ca8
dec r10d
mov eax, r10d
shr eax, 6
xor edi, edi
cmp rax, r8
jae 0x140131ca6
mov rdi, qword [r9 + rax*8]
mov ecx, r10d
shr rdi, cl
and edi, 1
or edx, edi
mov r15d, edx
shr r15, 5
lea eax, [r15 - 1]
neg r15
and eax, edx
xor edx, 0x3f
mov r13d, r15d
and r13d, edx
or r13d, eax
mov rax, r13
shr rax, 1
and r13d, 1
add r13, rax
xor esi, esi
mov r8d, 0xd8
mov rcx, r12
xor edx, edx
call fcn.1400924f0
mov rdi, r13
not rdi
mov r8, rsi
xor r8, r13
dec r8
and r8, rdi
sar r8, 0x3f
mov qword [rsp + 0x20], r12
mov rcx, r14
mov rdx, r12
mov r9, rbx
call fcn.1401317e0
inc rsi
add rbx, 0xd8
cmp rsi, 0x11
jne 0x140131ce9
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx + 0x40], rax
movaps xmm0, xmmword [0x14015c320]
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [r12 + 0x48]
mov rcx, r14
call fcn.140131db0
movsxd rax, dword [r14 + 0x40]
test rax, rax
je 0x140131d88
and r15d, 1
lea rcx, [r15 - 1]
neg r15
xor edx, edx
mov rbx, qword [rsp + rdx*8 + 0x30]
and rbx, r15
mov rdi, qword [r12 + rdx*8 + 0x48]
and rdi, rcx
or rdi, rbx
mov qword [r12 + rdx*8 + 0x48], rdi
inc rdx
cmp rax, rdx
jne 0x140131d68
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008fec0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret