joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005ea0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rdx
lea r8, [rcx + 8]
mov rcx, rbx
mov edx, 4
call fcn.140005f58
lea r8, str.desktop.ini
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140040550
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005f19
test al, 4
je 0x140005f19
and eax, 0xfffffffb
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
mov edx, eax
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call fcn.140004738
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400652d0
add rsp, 0x50
pop rbx
ret

Function at 0x140007e54
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, rdx
mov rbx, rcx
xor edi, edi
mov qword [rbp - 0x29], rdi
movdqa xmm0, xmmword [0x140089d70]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 0x29], di
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.140006a74
test eax, eax
js 0x140007f2b
lea r8d, [rdi + 1]
lea rdx, [0x140083068]
lea rcx, [rbp - 0x29]
call fcn.140010230
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], di
jne 0x140007ec2
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.140010230
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140007f0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 2
je 0x140007f0e
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x140007f2b
lea r8, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae r8, qword [rbp - 0x29]
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 4]
call fcn.14004f228
jmp 0x140007fa2
lea rcx, [0x140080108]
mov qword [rbp + 0x2f], rcx
mov dword [rbp + 0x27], 4
cdqe
mov qword [rbp + 0x37], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x963
lea rax, [0x140083028]
mov qword [rsp + 0x20], rax
lea r9, str.SetupUtilities::DeleteShortcut
mov r8d, 0x31c
lea rdx, [0x1400803a0]
lea rcx, [rbp - 9]
call qword [sym.imp.LoggingPlatform.DLL_public:_void___cdecl_StructuredEvent::constructor_char_const____ptr64__int__char_const____ptr64__struct__GUID_const____ptr64__unsigned_int__unsigned_int__unsigned_int__unsigned_int____ptr64]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 9]
call qword [sym.imp.LoggingPlatform.DLL_void___cdecl_LoggingWriteStructuredEvent_struct_StructuredEvent_const____ptr64__struct_StructuredEventParameter__const___ptr64_]
call qword [sym.imp.LoggingPlatform.DLL_void___cdecl_LoggingRotateIfNeeded_void_]
nop
lea rcx, [rbp - 0x29]
call fcn.140004738
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400652d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140017830
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov r15d, edx
mov rdx, r14
mov ecx, r15d
mov r8d, r9d
mov ebp, r9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov esi, eax
test eax, eax
jns 0x1400178a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rsp + 0x40], edi
test r14, r14
mov dword [rsp + 0x38], ebx
mov r9d, ebp
sete cl
mov edx, dword [rax]
mov dword [rsp + 0x30], edx
mov byte [rsp + 0x28], cl
mov dword [rsp + 0x20], r15d
call fcn.140014fb4
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140019120
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and dword [r8], 0
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.UpdateRingSettings.dll_class_IUpdateRingSettingsManager____ptr64___cdecl_GetUpdateRingSettingsManager_void_]
mov r9, rax
mov edx, SHFlushSFCache
mov rcx, qword [rax]
mov rax, qword [rcx + 0xa8]
mov rcx, r9
call qword [case.0x140023da2.8]
test al, al
je 0x140019175
mov rcx, qword [0x1400a3188]
mov rdx, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x140023da2.8]
jmp 0x14001917e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rdi], eax
cmp eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x1400191a0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rcx
mov rcx, rdx
mov rbx, qword [rax + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
mov rcx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [case.0x140023da2.8]

Function at 0x140019200
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rcx
mov rcx, rdx
mov rbx, qword [rax + 0x148]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
mov rcx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [case.0x140023da2.8]

Function at 0x140019250
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rcx
mov rcx, rdx
mov rbx, qword [rax + 0x158]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
mov rcx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [case.0x140023da2.8]
Function at 0x14001d110
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r9
mov rdi, r8
mov r14, rdx
xor r15d, r15d
mov ebx, r15d
mov qword [r8], r15
mov qword [r9], r15
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14001d17b
mov rax, qword [rsp + 0x70]
mov qword [rdi], rax
mov rax, qword [rsp + 0x78]
mov qword [rsi], rax
jmp 0x14001d255
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rdx, r14
lea rcx, [rsp + 0x50]
call qword [sym.imp.LoggingPlatform.DLL_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_StripPrivateInfoFromString_wchar_t_const____ptr64_]
nop
cmp qword [rax + 0x18], 8
jb 0x14001d1a8
mov rax, qword [rax]
lea rcx, str.directoryPath
mov qword [rbp - 0x38], rcx
mov dword [rbp - 0x40], 0xc
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14001d1d3
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x14001d1c7
jmp 0x14001d1d6
mov rcx, r15
mov qword [rbp - 0x28], rcx
lea rax, [0x140080108]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 3
mov dword [rbp - 0x10], ebx
mov eax, 2
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x11b14a2b
lea rax, [0x140083028]
mov qword [rsp + 0x20], rax
lea r9, str.FileSystemUtil::GetDiskSize
mov r8d, 0xed9
lea rdx, [0x1400840f0]
lea rcx, [rbp - 0x78]
call qword [sym.imp.LoggingPlatform.DLL_public:_void___cdecl_StructuredEvent::constructor_char_const____ptr64__int__char_const____ptr64__struct__GUID_const____ptr64__unsigned_int__unsigned_int__unsigned_int__unsigned_int____ptr64]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x78]
call qword [sym.imp.LoggingPlatform.DLL_void___cdecl_LoggingWriteStructuredEvent_struct_StructuredEvent_const____ptr64__struct_StructuredEventParameter__const___ptr64_]
call qword [sym.imp.LoggingPlatform.DLL_void___cdecl_LoggingRotateIfNeeded_void_]
nop
lea rcx, [rsp + 0x50]
call fcn.140004738
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400652d0
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400201ac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r14, rcx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 4
jb 0x1400201d5
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r14 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x140020235
mov rbx, rbp
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [r14 + 0x10], rax
jne 0x14002026d
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x140020247
cmp rbx, rdx
je 0x140020266
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14002023e
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x140020217
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1400203b8
mov rbp, rbx
xor eax, eax
jmp 0x140020255
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.1400652f8
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
xor r12d, r12d
mov dword [rax + 0x14], r12d
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400202ac
cvtsi2ss xmm0, rcx
jmp 0x1400202c1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400202d4
cvtsi2ss xmm1, rcx
jmp 0x1400202e9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x14002035a
mov rcx, r14
call fcn.1400206a4
mov rcx, qword [r14 + 0x30]
and rcx, r15
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
jne 0x140020323
mov qword [rsp + 0x28], r12
jmp 0x140020345
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
jmp 0x140020338
mov rbx, rax
cmp rax, r8
je 0x14002038e
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14002032c
mov rbx, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
jne 0x14002039a
mov qword [rcx + rax*8], rdi
jmp 0x1400203ac
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r12
jmp 0x14002034a
cmp r8, rbp
jne 0x1400203a5
mov qword [rcx + rax*8], rdi
jmp 0x1400203b1
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1400203b1
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400206a4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400206d4
cvtsi2ss xmm0, rdx
jmp 0x1400206e9
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140089d60]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140020717
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140020717
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140020745
cmp rbx, 0x200
jae 0x140020742
shl rbx, 3
cmp rbx, rcx
jae 0x140020745
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
jbe 0x14002076e
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400200a4
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140020880
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 4
jb 0x1400207c7
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x140020806
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x140020874
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x140020849
mov r10, qword [r10]
cmp r10, rax
je 0x1400207ff
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400207ff
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x1400208a6
cmp qword [rdi + r11*8], r10
jne 0x14002083f
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400207b7
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.140020b00
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140020874
Function at 0x1400208cc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400208fc
cvtsi2ss xmm0, rdx
jmp 0x140020911
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140089d60]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x14002093f
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14002093f
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14002096d
cmp rbx, 0x200
jae 0x14002096a
shl rbx, 3
cmp rbx, rcx
jae 0x14002096d
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
jbe 0x140020996
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400200a4
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140020aa8
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 4
jb 0x1400209ef
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x140020a2e
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x140020a9c
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x140020a71
mov r10, qword [r10]
cmp r10, rax
je 0x140020a27
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140020a27
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x140020abe
cmp qword [rdi + r11*8], r10
jne 0x140020a67
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400209df
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140020a9c
Function at 0x140020bbc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r13, rdx
mov r12, rcx
cmp rdx, r8
je 0x140020c7d
mov rax, qword [rcx + 8]
mov rdi, rdx
mov rbp, qword [rcx + 0x18]
movabs r14, 0xcbf29ce484222325
mov r15, qword [rdx + 8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
movabs rdx, 0x100000001b3
movzx eax, byte [rcx + r13 + 0x10]
inc rcx
xor r14, rax
imul r14, rdx
cmp rcx, 4
jb 0x140020c14
and r14, qword [r12 + 0x30]
add r14, r14
mov rax, qword [rbp + r14*8]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + r14*8 + 8]
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x18
call fcn.1400652f0
dec qword [r12 + 0x10]
cmp rbx, qword [rsp + 0x28]
je 0x140020c9e
cmp rdi, rsi
jne 0x140020c46
cmp qword [rsp + 0x30], r13
jne 0x140020c76
mov qword [rbp + r14*8], rdi
mov qword [r15], rdi
mov qword [rdi + 8], r15
lea r11, [rsp + 0x40]
mov rax, rsi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [rsp + 0x30], r13
jne 0x140020cb4
mov r13, qword [rsp + 0x20]
mov qword [rbp + r14*8], r13
mov rax, r13
jmp 0x140020cb7
mov rax, r15
mov qword [rbp + r14*8 + 8], rax
cmp rdi, rsi
je 0x140020c76
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
movabs r13, 0x100000001b3
movzx eax, byte [rdi + rcx + 0x10]
inc rcx
xor r14, rax
imul r14, r13
cmp rcx, 4
jb 0x140020cd7
and r14, qword [r12 + 0x30]
mov r13, qword [rsp + 0x20]
add r14, r14
mov rax, qword [rbp + r14*8 + 8]
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x18
call fcn.1400652f0
dec qword [r12 + 0x10]
cmp rbx, qword [rsp + 0x28]
je 0x140020d2d
cmp rdi, rsi
je 0x140020c71
jmp 0x140020d03
mov qword [rbp + r14*8], r13
mov qword [rbp + r14*8 + 8], r13
jmp 0x140020cbc
Function at 0x14002a240
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], bx
cmp word [rdx], bx
jne 0x14002a2b3
xor edx, edx
mov r8d, 0x618
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
mov ecx, 0x30c
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14002a2bd
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.14000c69c
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14002a351
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
setae r9b
cmovae rax, qword [rsp + 0x78]
cmp word [rax + rcx*2 - 2], 0x5c
jne 0x14002a351
lea r8, [rcx - 1]
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
cmp rcx, r8
cmovb r8, rcx
lea rdx, [rsp + 0x78]
test r9b, r9b
cmovne rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.140004600
lea rcx, [rsp + 0x78]
call fcn.140004738
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp - 0x78], xmm1
movdqa xmm0, xmmword [0x140089d70]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], bx
lea rcx, [rsp + 0x58]
call fcn.140004738
mov rcx, rdi
call fcn.14002a890
mov rax, qword [0x1400a9f50]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
mov r9d, 7
mov r8d, 0x100001
lea rcx, [0x1400a9f50]
mov rax, qword [rax + 0x218]
call qword [case.0x140023da2.8]
mov qword [rdi + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x14002a3fe
lea r9, [rdi + 0x58]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
cmp eax, 1
sete bl
jne 0x14002a3fe
lea rcx, [rdi + 0x10068]
lea rdx, [rsp + 0x78]
call fcn.14000c294
mov rcx, rdi
call fcn.14002a440
mov bl, al
jmp 0x14002a407
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0xc], eax
lea rcx, [rsp + 0x78]
call fcn.140004738
mov al, bl
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.1400652d0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret