joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050d30
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140050e68
lea rcx, [rsp + 0x30]
mov byte [rcx + 0x17], 0x15
lea rax, str.ExitCodeWatcherThread
cmp rcx, rax
ja 0x140050d86
lea rcx, [rsp + 0x45]
cmp rcx, rax
ja 0x140050e6b
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x30]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.140050ea0
cmp byte [rdi + 0x17], 0
js 0x140050e59
mov dword [rsi + 0x90], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x98], 0
test rax, rax
je 0x140050e23
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x98]
inc rax
cmp rax, 2
jae 0x140050e3b
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140050e1b
mov qword [rsi + 0x98], rdi
call fcn.1400b9400
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012f6f0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
call fcn.1400b9400
mov rcx, qword [rsi + 0x98]
call fcn.1401142f0
mov qword [rsi + 0x98], 0
jmp 0x140050e05
mov rcx, qword [rsp + 0x30]
call fcn.14012cd4c
jmp 0x140050dbd
int3
lea rax, str.char_traits::copy_overlapped_range
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__stringchar_traits.h
lea r9, str.__s2_____s1____s2_____s1____n
mov r8d, 0xf3
call fcn.140167fb0
int3
Function at 0x140050f80
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x140051101
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x140051101
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r14, rax
cmp qword [rdi + 8], rax
je 0x14005100e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x140051122
mov rax, r14
inc rax
cmp rax, 2
jb 0x140051002
mov qword [rdi + 8], r14
call fcn.1400b9400
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400511dc
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.14012cd5c
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.14012cd5c
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r14
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r15
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x140219dc8]
je 0x140051155
mov rax, r15
and rax, r12
cmp rax, qword [0x140219dc8]
je 0x14005115f
mov qword [rdi + 0x18], r15
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14008f3e0]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp qword [rdi + 0x10], rax
je 0x1400510f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x14005113d
mov rax, r15
inc rax
cmp rax, 2
jb 0x1400510ec
mov qword [rdi + 0x10], r15
call fcn.1400b9400
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x10]
inc r15
cmp r15, 1
jbe 0x140051180
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x14005116c
mov eax, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400b9400
mov rcx, qword [rdi + 8]
call fcn.1401142f0
mov qword [rdi + 8], 0
jmp 0x140050fed
call fcn.1400b9400
mov rcx, qword [rdi + 0x10]
call fcn.1401142f0
mov qword [rdi + 0x10], 0
jmp 0x1400510d7
call fcn.1400b23f0
jmp 0x14005107a
mov rcx, r15
call fcn.1400b22b0
jmp 0x14005108d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x140243008]
jmp 0x140051110
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x140219dc8]
jne 0x140051195
call fcn.1400b23f0
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x1400511dc
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x1400511c3
mov rcx, rdi
call fcn.14009d140
mov rcx, rdi
call fcn.14012cd4c
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x1400511e7
mov rcx, rbx
call fcn.14012cd4c
mov r14d, 0x3b
jmp 0x140051101
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x140243008]
jmp 0x1400511d4
Function at 0x140054fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14005501b
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x140243008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
test al, al
jns 0x140054ffd
call fcn.14012cd4c
jmp 0x140054ffd
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x140230938]
call fcn.1400ba180
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140055060
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140243008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401ee3a0]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x140243008]
movzx eax, byte [rbx + 0x17]
test al, al
js 0x1400550a7
mov edx, eax
and edx, 0x7f
jmp 0x1400550ab
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x14005500d
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x140055107
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x140243008]
cmp eax, 0xffffffff
jne 0x1400550dd
xor edi, edi
inc r14
movzx eax, byte [rbp - 9]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rbp - 0x20]
mov r8, rbx
cmovs rdx, qword [rbp - 0x18]
cmovs r8, rcx
add rdx, r8
cmp r14, rdx
je 0x14005500d
test rdi, rdi
je 0x1400550db
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400550c3
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x1400550dd
Function at 0x140059060
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400590a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400590c5
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400590a1
mov qword [rsi], rdi
call fcn.1400b9400
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140059137
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400b9400
mov r14, qword [rsi]
cmp qword [0x140231c98], 0
je 0x1400590f6
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140243008]
mov qword [rsi], 0
jmp 0x14005908f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200159]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005913a
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140059131
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.14002cab0
jmp 0x1400590d7
xor ecx, ecx
mov dl, 1
jmp 0x14005912a
int3
xor ecx, ecx
jmp 0x140059128
Function at 0x140059140
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x14005916c
call fcn.1400b9400
mov qword [rsi], 0
test r15, r15
je 0x1400591a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400591fa
cmp r12, 2
jb 0x14005919a
mov qword [rsi], r15
call fcn.1400b9400
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400591c9
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400b9400
mov rbx, qword [rdi]
cmp qword [0x140231c98], 0
je 0x14005922e
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x140243008]
mov qword [rdi], 0
jmp 0x1400591b8
call fcn.1400b9400
mov r14, qword [rsi]
cmp qword [0x140231c98], 0
je 0x140059272
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140243008]
mov qword [rsi], 0
jmp 0x14005918c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200159]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400592b6
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14005926c
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.14002cab0
jmp 0x1400591db
xor ecx, ecx
mov dl, 1
jmp 0x140059262
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200159]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400592ba
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400592b0
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.14002cab0
jmp 0x14005920c
xor ecx, ecx
mov dl, 1
jmp 0x1400592a6
xor ecx, ecx
jmp 0x140059260
xor ecx, ecx
jmp 0x1400592a4
Function at 0x1400594c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1401ee3a0]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DoDeleteFile
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x106
call fcn.1400bab70
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.1400d8580
movzx eax, byte [rsi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rsi + 8]
cmovs rdx, rcx
test rdx, rdx
je 0x1400595f6
test al, al
jns 0x140059556
cmp rcx, 0x103
ja 0x140059681
mov rcx, rsi
mov rdx, rdi
call fcn.1400fce40
movzx eax, byte [rsp + 0x57]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmovs rdi, rcx
test rdx, rdx
je 0x14005966f
lea r8, [rdi + rdx*2]
add rdx, rdx
mov r9, rdi
movzx r10d, word [r9]
cmp r10d, 0x2a
je 0x1400595ac
cmp r10d, 0x3f
je 0x1400595ac
add r9, 2
add rdx, 0xfffffffffffffffe
jne 0x14005958f
mov r9, r8
cmp r9, r8
sete dl
sub r9, rdi
cmp r9, 0xfffffffffffffffe
sete bl
or bl, dl
test al, al
jns 0x1400595c7
call fcn.14012cd4c
test bl, bl
je 0x140059692
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400595db
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140059620
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x140059652
lea rcx, [rsp + 0x60]
call fcn.1400ae4f0
mov dil, 1
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14012f6f0
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
mov edi, eax
test dil, 1
jne 0x1400596e9
cmp byte [rsi + 0x17], 0
jns 0x140059635
mov rsi, qword [rsi]
mov rcx, rsi
test dil, 0x10
je 0x14005964a
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400595f6
jmp 0x1400595e6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140059644
lea rcx, [rsp + 0x60]
call fcn.1400ae4f0
mov dil, 1
test esi, esi
je 0x140059603
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x140059603
test al, al
jns 0x1400595cf
call fcn.14012cd4c
jmp 0x1400595cf
lea rcx, [rsp + 0x60]
call fcn.1400ae4f0
mov esi, 0xa1
jmp 0x140059663
lea rdi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.1400fce40
lea rbx, [rsp + 0x28]
mov rcx, rsi
mov rdx, rbx
call fcn.1400fd590
mov rcx, rbx
mov rdx, rdi
call fcn.14001af60
mov esi, eax
cmp byte [rbx + 0x17], 0
jns 0x1400596cf
mov rcx, qword [rsp + 0x28]
call fcn.14012cd4c
cmp byte [rsp + 0x57], 0
jns 0x140059652
mov rcx, qword [rsp + 0x40]
call fcn.14012cd4c
jmp 0x140059652
mov edx, edi
and edx, 0xfffffffe
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400596fa
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14005962c
jmp 0x1400595e6
Function at 0x140059710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1401ee3a0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x20b
call fcn.1400bab70
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d8580
cmp byte [rdi + 0x17], 0
jns 0x140059782
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1400ae4f0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14012f6f0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400597c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rbx, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1401ee3a0]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x214
call fcn.1400bab70
xor esi, esi
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.1400d8580
cmp byte [rbx + 0x17], 0
jns 0x140059836
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400598e9
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor edi, edi
mov rcx, rbx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x1400598b3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x140059912
call fcn.1400b9400
mov rdi, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
setne sil
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400598e9
call fcn.1400b9400
cmp qword [0x140231c98], 0
je 0x140059916
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x140243008]
lea rcx, [rsp + 0x60]
call fcn.1400ae4f0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14012f6f0
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor edi, edi
jmp 0x1400598ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200159]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140059957
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140059951
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.14002cab0
jmp 0x1400598d3
xor ecx, ecx
mov dl, 1
jmp 0x14005994a
xor ecx, ecx
jmp 0x140059948
Function at 0x140059960
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2b8
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
movaps xmm0, xmmword [0x1401ee3a0]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x1401f98ae]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov r9d, 0x427
call fcn.1400bab70
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d8580
lea rbx, [rsp + 0xa0]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140131830
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x140059a6a
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14012d784
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400f4860
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140043270
cmp byte [rsi + 0x17], 0
js 0x140059a9c
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x140059a6a
mov rcx, qword [rsp + 0x30]
call fcn.14012cd4c
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x60]
call fcn.1400ae4f0
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14012f6f0
mov eax, ebx
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.14012cd4c
jmp 0x140059a3c

Function at 0x14005efc0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14004b5b0
mov rax, qword [rsi]
test rax, rax
je 0x14005f037
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14005f03e
lea rcx, [rsp + 0x28]
call fcn.14004acc0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14012f6f0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14005f010
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14005f07f
cmp byte [rbx + 0x27], 0
js 0x14005f057
lea rcx, [rbx + 0x10]
jmp 0x14005f05b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x14005f07f
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14005f08a
mov rcx, r14
mov rdx, rbx
call fcn.140090da0
add r14, 0x68
mov qword [rdi + 8], r14
add rbx, 0x70
cmp rbx, r15
je 0x14005f010
jmp 0x14005f045
mov rcx, rdi
mov rdx, rbx
call fcn.140090b90
mov r14, rax
jmp 0x14005f07b
Function at 0x140060920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140060940
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x140060980
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400609a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x1400609e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140060a03
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x140060a60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140060a83
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x140060ae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140060b09
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret