joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003428
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rsp + 0x70]
lea r8d, [rcx + 0xe9c]
mov esi, edx
add r9d, 0xfffffcfc
mov edx, eax
xor esi, 0x42d3
xor edx, 0x5c
lea ebp, [rax + 0x2eb]
add eax, 0x4de
xor eax, 0x4dc
cmp esi, eax
je 0x1400035a0
mov rbx, qword [rsp + 0x78]
xor r10d, r10d
mov ecx, dword [0x140015024]
mov eax, dword [rbx + 0x48]
sub eax, 0x17c86d
imul ecx, eax
mov dword [0x140015024], ecx
mov ecx, dword [rbx + 0x3c]
mov edx, dword [rbx + 0x60]
add ecx, 0x5a31
mov eax, dword [rbx + 0x100]
add edx, ecx
imul eax, edx
mov dword [rbx + 0x100], eax
mov ecx, dword [0x140015068]
mov rax, qword [rbx + 0xa0]
mov r8d, dword [rax + r10]
add r10, 4
mov eax, dword [rbx + 0x18]
imul r8d, dword [rbx + 0x6c]
add eax, 0xffe3d90f
add eax, ecx
xor ecx, eax
mov dword [0x140015068], ecx
mov ecx, dword [rbx + 0xd4]
mov eax, dword [rbx + 0x58]
mov edx, r8d
add eax, 0xffe34f13
shr edx, 8
add ecx, eax
add dword [rbx + 0x60], ecx
movsxd rcx, dword [rbx + 0x70]
mov rax, qword [0x1400150b8]
mov byte [rcx + rax], dl
inc dword [rbx + 0x70]
movsxd rcx, dword [rbx + 0x70]
mov rax, qword [rbx + 0xa8]
mov byte [rcx + rax], r8b
mov eax, 1
inc dword [rbx + 0x70]
sub eax, dword [rbx + 0x14]
mov rcx, qword [section..data]
add dword [rcx + 0x24], eax
mov ecx, dword [rbx + 0xc4]
mov eax, dword [0x140015120]
add eax, 0xfffffff8
imul ecx, eax
mov dword [rbx + 0xc4], ecx
mov eax, dword [0x140015070]
xor eax, 0xfffd4b85
sub dword [0x140015028], eax
cmp r10, 0x1698
jl 0x14000347b
mov r8d, esi
lea eax, [rbp - 0xdc]
xor r8d, 0x2bf6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea edx, [rbp - 0xc47]
mov r8, qword [section..data]
lea ecx, [rsi + 0x3761]
call fcn.140001a50
mov eax, dword [rbx + 0x58]
add eax, 0x3df14761
xor dword [rbx + 0x6c], eax
jmp 0x140003632
mov rdi, qword [rsp + 0x78]
or r8d, ebp
mov r9d, dword [0x140015084]
add r9d, 0xffffc114
or r9, 0x2bf6
mov r11d, dword [rdi + 0xe4]
imul r11d, dword [0x1400150dc]
mov r10d, dword [rdi + 0x88]
mov ebx, dword [rdi + 0x24]
and r10d, edx
sub ebx, dword [0x1400150ac]
and r10d, 0x42d3
mov edx, dword [rdi + 0xcc]
xor ebx, 0x46ae
mov ecx, dword [rdi + 0x8c]
add r11d, 0x3cec
and edx, dword [rdi + 0x94]
or ecx, dword [rdi + 0x38]
add edx, esi
sub ecx, dword [rdi + 0x48]
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov eax, 0x43aa
sub eax, dword [rdi + 0x100]
add dword [0x140015034], eax
mov rbx, qword [rsp + 0x50]
lea eax, [rsi + 0x36d8]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180017b10
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x23
syscall
ret
Function at 0x140020a30
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x10050
call fcn.14009a190
sub rsp, rax
mov rsi, rdx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x10048], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x140165510]
movaps xmmword [rdi], xmm0
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov rcx, rdi
call fcn.14003e710
test rsi, rsi
je 0x140020b08
lea rbx, [rsp + 0x4a]
mov r8d, 0xfffe
mov rcx, rbx
mov dl, 0xaa
call fcn.1400cf760
cmp byte [rsp + 0x47], 0
jns 0x140020aab
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x140020ada
cmp eax, 0x7fff
jae 0x140020b2d
mov edx, eax
lea rcx, [rsp + 0x4a]
mov r8, rsi
call fcn.140069dc0
cmp byte [rsp + 0x47], 0
jns 0x140020aeb
mov rcx, qword [rsp + 0x30]
call fcn.140098d0c
mov rcx, qword [rsp + 0x10048]
xor rcx, rsp
call fcn.14009a1f0
mov eax, ebx
add rsp, 0x10050
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsp + 0x47], 0
js 0x140020b16
lea rcx, [rsp + 0x30]
jmp 0x140020b1b
mov rcx, qword [rsp + 0x30]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x140020ada
int3

Function at 0x140026ed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
mov rcx, qword [rdx + 8]
test rcx, rcx
js 0x140026f06
je 0x140026f05
mov rdx, qword [rdx]
xor r8d, r8d
lea r9, [0x140183220]
movzx r10d, al
movzx r11d, byte [rdx + r8]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc r8
cmp rcx, r8
jne 0x140026eea
ret
int3

Function at 0x1400283ae
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14002840c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400283f6
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400283e6
mov qword [rdi], rsi
call fcn.140042dd0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140042dd0
mov rcx, qword [rdi]
call fcn.14003a240
mov qword [rdi], 0
jmp 0x1400283d4
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140043fd0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14003afc0
mov qword [rsi], 0
test rax, rax
je 0x140044023
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140044057
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004401b
mov qword [rsi], rbx
call fcn.140042dd0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140042fb0
lea rcx, [rsi + 0x20]
call fcn.14004a220
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140042dd0
mov rcx, qword [rsi]
call fcn.14003a240
mov qword [rsi], 0
jmp 0x140044009
Function at 0x14004a6c0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14004a6e9
xor eax, eax
xor r9d, r9d
nop word [rax + rax]
movzx r10d, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x14004a6d0
movzx eax, r9b
ret
xor eax, eax
ret
Function at 0x140053030
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x1400867d0]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x1401aefd0]
lea rdx, [0x140086760]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400530c2
cmp dword [0x1401aefd8], 0
jne 0x1400530be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x1401aefdc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400530be
movsxd rax, esi
mov rsi, qword [rdi + rax*8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14009a1f0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400530a6
call fcn.1400ae650
int3
Function at 0x14005d460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x14005d55e
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x14016c0c0]
nop dword [rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm4, 0
movdqa xmm8, xmm2
pclmulqdq xmm8, xmm4, 0
movdqa xmm9, xmm1
pclmulqdq xmm9, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm1, xmm5, 0x11
movdqu xmm10, xmmword [rcx]
pxor xmm10, xmm6
pxor xmm0, xmm10
movdqu xmm6, xmmword [rcx + 0x10]
pxor xmm6, xmm7
pxor xmm3, xmm6
movdqu xmm6, xmmword [rcx + 0x20]
pxor xmm6, xmm8
pxor xmm2, xmm6
movdqu xmm6, xmmword [rcx + 0x30]
pxor xmm6, xmm9
pxor xmm1, xmm6
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x14005d4d0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x14016c0e0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp rdx, 0x10
jb 0x14005d5ee
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x14005d5c4
pmovzxdq xmm1, qword [0x14016c0e0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
pclmulqdq xmm0, xmmword [0x14016c0d0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14005daf0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x14005db36
mov r14, r12
test r14, r14
je 0x14005dc38
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x14005db98
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x14005db84
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1400cf0c0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x14005db12
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14005dc5e
lea rcx, [r13*8]
call fcn.140098cd0
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x14005dbfe
lea r14, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x14005dc38
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14005dbe6
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x14005dc1e
add r12, 0xfffffffffffffff8
jne 0x14005dc11
jmp 0x14005dc4b
test r15, r15
je 0x14005db12
mov rcx, r15
call fcn.140098d0c
mov r14, qword [rsi + 0x10]
jmp 0x14005db12
lea rcx, [0x140168205]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1400e0394
lea rcx, [0x140168205]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1400e0394
call fcn.1400dcd45
int3

Function at 0x140063e50
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401aaf40]
mov ecx, dword [0x1401a7af0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140063ebf
lea rcx, [0x1401aaf40]
call fcn.140098d5c
cmp dword [0x1401aaf40], 0xffffffff
jne 0x140063ebf
xorps xmm0, xmm0
movups xmmword [0x1401aaf30], xmm0
movups xmmword [0x1401aaf20], xmm0
movups xmmword [0x1401aaf10], xmm0
lea rcx, [0x1401aaf10]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401aaf40]
add rsp, 0x28
jmp fcn.140098e10
nop
add rsp, 0x28
ret
Function at 0x1400655a0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, r9
mov r14, r8
mov rsi, rdx
mov r12, rcx
mov rdi, qword [rsp + 0xd0]
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x5f]
mov byte [rbx], 0xaa
mov r13, qword [rcx]
lea rdx, str.ReadValue
lea r8, str....._basewin_registry.cc
lea rbp, [rsp + 0x38]
mov rcx, rbp
mov r9d, 0x1a6
call fcn.140042db0
mov rcx, rbx
mov rdx, rbp
mov r8, r13
mov r9d, 1
call fcn.14005a030
mov rcx, qword [r12]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rcx, rbx
call fcn.140059720
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009a1f0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140065660
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1038
call fcn.14009a190
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
lea r14, [rsp + 0x830]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400cf760
lea rax, [rsp + 0x2c]
mov dword [rax], 1
lea r9, [rsp + 0x28]
mov dword [r9], 0x800
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.1400655a0
test eax, eax
jne 0x14006570d
mov eax, dword [rsp + 0x2c]
cmp eax, 1
jne 0x140065711
lea rdx, [rsp + 0x830]
mov rcx, rsi
call fcn.140063512
xor edi, edi
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14009a1f0
mov eax, edi
add rsp, 0x1038
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x1400656ee
mov edi, 0x3f4
cmp eax, 2
jne 0x1400656ee
lea rdi, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400cf760
lea rcx, [rsp + 0x830]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x28], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x1400656ee
lea rdx, [rsp + 0x30]
jmp 0x1400656e4

Function at 0x140065770
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov r14, r8
mov rsi, rdx
mov r15, rcx
mov edi, dword [rsp + 0xd0]
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x5f]
mov byte [rbx], 0xaa
mov r12, qword [rcx]
lea rdx, str.WriteValue
lea r8, str....._basewin_registry.cc
lea r13, [rsp + 0x38]
mov rcx, r13
mov r9d, 0x1e3
call fcn.140042db0
mov rcx, rbx
mov rdx, r13
mov r8, r12
mov r9d, 0x20006
call fcn.14005a030
mov rcx, qword [r15]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
mov rdx, rsi
xor r8d, r8d
mov r9d, edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, rbx
call fcn.140059720
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009a1f0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140066a40
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x140165510]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1c
call fcn.140042db0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400477a0
mov rcx, rsi
call fcn.14003afb0
test al, al
je 0x140066b59
lea rbx, [rsi + 0x40]
mov rcx, rsi
call fcn.140064c40
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rbx
mov rdx, rax
call fcn.1400283ae
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140066b59
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140066b59
mov rbx, rax
lea rax, [0x140166c60]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], rbx
call fcn.140073790
mov eax, dword [rax + 0x50]
test rax, rax
setne dil
je 0x140066b59
mov qword [rsi + 0x30], rbx
mov qword [rsi + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.140047820
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14009a1f0
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140066e70
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140165510]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x64
call fcn.140042db0
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400477a0
test esi, esi
js 0x140066f75
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.14004a200
test al, al
jne 0x140066f81
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140066f9d
mov esi, dword [rsp + 0x2c]
test esi, esi
js 0x140066f7c
lea rcx, [rsp + 0x30]
call fcn.14004a560
lea rcx, [rsp + 0x50]
call fcn.140047820
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14009a1f0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x140066f4a
int3
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.14012cb60
jmp 0x140066f10
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x140066f40
Function at 0x140066fb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140165510]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x9c
call fcn.140042db0
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400477a0
test esi, esi
js 0x1400670b6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.14004a200
test al, al
jne 0x1400670bd
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.14004a560
lea rcx, [rsp + 0x50]
call fcn.140047820
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14009a1f0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14006708b
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.14012cb60
jmp 0x140067050

Function at 0x1400670e0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x140165510]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xb1
call fcn.140042db0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400477a0
mov qword [rbx + 8], r14
mov qword [rbx], 0
call fcn.14004a200
test al, al
jne 0x1400671bc
lea rdi, [rsp + 0x28]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.14004a560
lea rcx, [rsp + 0x50]
call fcn.140047820
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14009a1f0
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.14012cb60
jmp 0x140067169
Function at 0x1400675f0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edx, 1
jmp fcn.1400672f0

Function at 0x140067600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov rsi, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm6, xmmword [0x140165510]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2dd
call fcn.140042db0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400477a0
call fcn.14007fe50
test al, al
jne 0x1400676c1
cmp byte [rsi + 0x17], 0
jns 0x140067683
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x50]
call fcn.140047820
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14009a1f0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x40], 0xaaaaaaaa
cmp byte [rsi + 0x17], 0
jns 0x1400676dc
mov rsi, qword [rsi]
lea r8, [rsp + 0x20]
mov rcx, rsi
xor edx, edx
call fcn.14012cdb0
test eax, eax
jmp 0x14006768f

Function at 0x1400676f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x140165510]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x30c
call fcn.140042db0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400477a0
cmp byte [rdi + 0x17], 0
jns 0x140067762
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.140047820
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14009a1f0
mov eax, edi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400677b0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140199040]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400cf760
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14006784f
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1400b6604
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.140042ff0
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.14006f6e0
mov rcx, rsi
mov rdx, r14
call fcn.140043190
mov rcx, r14
call fcn.140043120
mov rcx, rbx
call fcn.140043120
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14009a1f0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret