joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r13, r8
mov qword [rsp + 0x20], rdx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x1400a9577
mov r13, qword [r13]
movabs rsi, 0xcbf29ce484222325
mov rbp, r15
sub rbp, 1
jae 0x1400a9592
mov rbx, rsi
jmp 0x1400a9628
movabs rax, 0x100000001b3
mov edx, r15d
and edx, 3
cmp rbp, 3
jae 0x1400a95ac
xor ebp, ebp
jmp 0x1400a95fd
mov rdi, r15
sub rdi, rdx
xor ebp, ebp
nop word cs:[rax + rax]
nop
movzx ebx, byte [r13 + rbp]
xor rbx, rsi
imul rbx, rax
movzx esi, byte [r13 + rbp + 1]
xor rsi, rbx
imul rsi, rax
movzx ebx, byte [r13 + rbp + 2]
xor rbx, rsi
imul rbx, rax
movzx esi, byte [r13 + rbp + 3]
xor rsi, rbx
imul rsi, rax
add rbp, 4
cmp rdi, rbp
jne 0x1400a95c0
mov rbx, rsi
test rdx, rdx
je 0x1400a9628
add rbp, r13
xor edi, edi
nop word [rax + rax]
movzx ebx, byte [rbp + rdi]
xor rbx, rsi
imul rbx, rax
add rdi, 1
mov rsi, rbx
cmp rdx, rdi
jne 0x1400a9610
and rbx, qword [rcx + 0x30]
mov r14, qword [rcx + 8]
mov r12, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
mov rdi, qword [r12 + rax]
lea rbp, [rbx + rbx]
add rbp, 1
mov rsi, rdi
cmp rdi, r14
jne 0x1400a9668
jmp 0x1400a9690
mov rsi, qword [rsi]
cmp rdi, r14
je 0x1400a9690
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rsi
je 0x1400a971d
cmp qword [rsi + 0x20], r15
jne 0x1400a9660
cmp qword [rsi + 0x28], 0xf
jbe 0x1400a96a0
mov rcx, qword [rsi + 0x10]
jmp 0x1400a96a4
mov rax, r14
cmp rax, rsi
jne 0x1400a9678
jmp 0x1400a971d
lea rcx, [rsi + 0x10]
mov rdx, r13
mov r8, r15
call fcn.14016e7e0
test eax, eax
jne 0x1400a9660
mov rbx, rsi
cmp rdi, r14
jne 0x1400a96c8
jmp 0x1400a9710
mov rbx, qword [rbx]
cmp rdi, r14
je 0x1400a9710
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x1400a9718
cmp r15, qword [rbx + 0x20]
jne 0x1400a9718
cmp qword [rbx + 0x28], 0xf
jbe 0x1400a96f0
mov rdx, qword [rbx + 0x10]
jmp 0x1400a96f4
lea rdx, [rbx + 0x10]
mov rcx, r13
mov r8, r15
call fcn.14016e7e0
test eax, eax
je 0x1400a96c0
jmp 0x1400a9718
mov rax, r14
cmp rax, rbx
jne 0x1400a96d4
cmp rsi, rbx
jne 0x1400a9723
mov rsi, r14
mov rbx, r14
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ac5f0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x1400ac647
mov r12, r8
mov ebx, edx
mov edi, ecx
bt edx, 8
jae 0x1400ac62c
mov eax, ebx
and eax, 0x200
jne 0x1400ac647
cmp edi, 2
lea rax, [0x1401eb950]
lea rcx, [0x1401ebb50]
cmove rcx, rax
cmp word [rcx], 0
je 0x1400ac666
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014ac50
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400ac647
cmp byte [0x1401eb940], 0
setne al
bt ebx, 8
jb 0x1400ac647
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400ac647
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x1400ac6c6
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
mov r13d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x1400ac762
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x1400ac6ff
test dx, dx
jne 0x1400ac784
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x1400ac72d
cmp ebp, 2
jne 0x1400ac723
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x1400ac72d
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x1400ac745
dec r14
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x1400ac737
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x1400ac78b
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x1400ac784
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.14017b830
test eax, eax
je 0x1400ac6ec
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x1400ac762
cmp dword [rsp + 0x2c], 0
je 0x1400ac647
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x1400ac7aa
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140185cb0
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.14000e290
jmp 0x1400ac647
Function at 0x1400ad490
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14004e7f0
cmp qword [rsp + 0x70], 7
jbe 0x1400ad4db
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x1400ad533
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400ad52e
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400ad6f6
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14014a880
test ebp, ebp
je 0x1400ad5fe
mov r14b, 1
test rsi, rsi
je 0x1400ad6d8
mov ecx, ebp
add rcx, rcx
call fcn.14014a890
mov rbx, rax
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14004e7f0
cmp qword [rsp + 0x70], 7
jbe 0x1400ad57d
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x1400ad5d4
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400ad5cf
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400ad6f6
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14014a880
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x1400ad606
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400ad5f0
jmp 0x1400ad608
xor r14d, r14d
jmp 0x1400ad6d8
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14004ec90
mov rax, qword [rsi + 0x18]
cmp rdi, rsi
je 0x1400ad68f
cmp rax, 0x10
jb 0x1400ad662
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400ad65d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x1400ad6f6
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14014a880
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
jmp 0x1400ad6c7
cmp rax, 0x10
jb 0x1400ad6c7
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400ad6c2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x1400ad6f6
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14014a880
mov qword [rsp + 0x70], 0xf
mov rcx, rbx
call fcn.14014a880
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14014ac50
mov eax, r14d
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140178800
ud2
Function at 0x1400b4c50
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea rsi, [rcx + 0x48]
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x1400b4c7e
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rbx, [rdi + 0x40]
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1400b4c98
mov qword [rbx], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x20], rbx
lea rcx, [0x1401b5318]
lea r9, [0x1401abd20]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbx]
test eax, eax
js 0x1400b4d01
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x90]
test eax, eax
js 0x1400b4d0f
cmp rdi, r15
je 0x1400b4cee
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x1400b4ce3
mov r15, qword [r15]
mov rcx, rdi
mov rdx, r15
call fcn.1400060c0
add rdi, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.140032450
mov al, 1
jmp 0x1400b4d26
test rcx, rcx
je 0x1400b4d24
mov qword [rbx], 0
jmp 0x1400b4d1e
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400b4d24
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400bd300
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x60], rax
test dl, dl
je 0x1400bd354
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x1400bd354
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 1
mov dword [rax], 0x18
lea rcx, [0x1401acdbc]
mov qword [rax + 8], rcx
jmp 0x1400bd356
xor eax, eax
movzx edx, bl
shl edx, 0x13
or edx, 3
cmp qword [rsi + 0x18], 7
jbe 0x1400bd369
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rax
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014ac50
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x1400bd3c0
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x1400bd493
and eax, 0xfeff
cmp eax, 6
je 0x1400bd493
mov eax, dword [0x1401ec018]
mov ecx, dword [0x1401e8ff8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x1400bd4ba
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x1401ec010]
mov sil, 1
test eax, eax
jne 0x1400bd49f
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400bd48f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21
mov r9d, 2
call fcn.14003d2f0
lea rcx, [rsp + 0x40]
lea rdx, [0x1401ace5b]
call fcn.140002b70
mov rcx, rsi
call fcn.14003d430
xor esi, esi
jmp 0x1400bd49f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14014ac50
mov eax, esi
add rsp, 0x150
pop rsi
ret
lea rcx, [0x1401ec018]
call fcn.14014aa00
mov eax, dword [0x1401ec018]
cmp eax, 0xffffffff
jne 0x1400bd427
lea rcx, [0x140198f90]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.1400bda40
mov qword [0x1401ec010], rax
lea rcx, [0x1401ec018]
call fcn.14014aa70
jmp 0x1400bd427
Function at 0x1400be250
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1401ec028]
mov ecx, dword [0x1401e8ff8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x1400be488
mov rax, qword [0x1401ec020]
test rax, rax
je 0x1400be31e
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call rax
test eax, eax
je 0x1400be2ce
cmp dword [rsp + 0x2c], 0
setne byte [rsi + 0x89]
je 0x1400be325
mov byte [rsi + 0x88], 0
mov dl, 1
jmp 0x1400be348
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400be31e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.14003d2f0
lea rcx, [rsp + 0x40]
lea rdx, [0x140198faa]
call fcn.140002b70
mov rcx, rbx
call fcn.14003d430
mov byte [rsi + 0x89], 0
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x88]
cmp byte [rsi + 0x89], 0
setne dl
lea rax, [rsi + 0x38]
lea r9, [rsi + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1400be4e0
test al, al
je 0x1400be37e
cmp byte [rsi + 0x88], 0
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
mov r8, rsi
je 0x1400be3c1
call fcn.1400be6d0
jmp 0x1400be3c6
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400be469
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x218
mov r9d, 2
call fcn.14003c4c0
lea rcx, [rsp + 0x38]
lea rdx, str.GetProcessBasicInformation_failed
jmp 0x1400be45c
call fcn.1400bec50
test al, al
je 0x1400be422
mov dl, byte [rsi + 0x88]
mov rcx, rdi
mov r8, rsi
call fcn.1400bdab0
mov sil, 1
test al, al
jne 0x1400be46b
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400be469
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x226
mov r9d, 2
call fcn.14003c4c0
lea rcx, [rsp + 0x38]
lea rdx, str.ReadMemoryInfo_failed
jmp 0x1400be45c
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400be469
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x221
mov r9d, 2
call fcn.14003c4c0
lea rcx, [rsp + 0x38]
lea rdx, str.ReadProcessData_failed
call fcn.140002b70
mov rcx, rsi
call fcn.14003c960
xor esi, esi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14014ac50
mov eax, esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401ec028]
call fcn.14014aa00
mov eax, dword [0x1401ec028]
cmp eax, 0xffffffff
jne 0x1400be29b
lea rcx, [0x140198f90]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400bda40
mov qword [0x1401ec020], rax
lea rcx, [0x1401ec028]
call fcn.14014aa70
jmp 0x1400be29b
Function at 0x1400c56d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0xc]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c5762
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rbp - 0xc]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0xc]
test eax, eax
jne 0x1400c5776
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400c579b
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400c5734
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400c577d
cmp eax, 0xffffffff
je 0x1400c57a0
mov esi, eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
call fcn.14014ac50
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp - 0xc]
jmp 0x1400c577b
int3

Function at 0x1400c5db0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rdi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400c5cf0
test rax, rax
jne 0x1400c5e41
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400c5e41
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400c5e3f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xf3
mov r9d, 2
call fcn.14003d2f0
lea rcx, [rsp + 0x38]
lea rdx, [0x1401ae2ce]
call fcn.140002b70
mov rcx, rsi
call fcn.14003d430
xor esi, esi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14014ac50
mov eax, esi
add rsp, 0x148
pop rdi
pop rsi
ret

Function at 0x1400cb080
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400cb099
mov dword [rsi], eax
mov al, 1
jmp 0x1400cb09b
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400cd390
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.14016ed50
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x1400cd3c8
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x1400cd3d8
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400d85a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rdx]
mov rcx, rdi
call fcn.1401859f0
test rax, rax
je 0x1400d85e7
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs r8, 0x100000001b3
movzx esi, byte [rdi + rdx]
xor rcx, rsi
imul rcx, r8
inc rdx
cmp rax, rdx
jne 0x1400d85cc
and ecx, 0x7fffffff
jmp 0x1400d85ec
mov ecx, 0x4222325
mov edx, 0x1f31d
call fcn.140180380
imul ecx, eax, 0xfffff4ec
shr rax, 0x20
imul eax, eax, 0x41a7
lea edx, [rax + rcx]
add edx, 0x7fffffff
add eax, ecx
cmovns edx, eax
movsxd rax, edx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400e8c20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e8c40
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x1400e8c80
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e8ca0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x1400e8ce0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e8d03
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1400e8d60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e8d83
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x1400e8de0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e8e09
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x1400e8e70
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e8e99
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x1400e8f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400e8f5f

Function at 0x1400e8f50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400e8f50
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x1400e8fe0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400e903f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400e9030
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret