joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001a43
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x140001aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001ac9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret

Function at 0x140001b30
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001b59
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x140001bc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x140001c1f
Function at 0x140001c10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.140001c10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x140001ca0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x140001cff
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001cf0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret

Function at 0x140001d80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x140001dda

Function at 0x140001dfa
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001dd0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret
Function at 0x140001e90
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x140001eea
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001ee0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x140018b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140018ca0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140018be0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140018be0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140018be0
Function at 0x14003c340
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1401164a0
cmp byte [rdi + 0x17], 0
jns 0x14003c381
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x14003c3a2
mov rcx, qword [rsp + 0x58]
call fcn.14013a6ac
test rsi, rsi
je 0x14003c44e
test edi, edi
je 0x14003c44e
mov ecx, edi
add rcx, rcx
call fcn.14013a834
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.1401164a0
cmp byte [r14 + 0x17], 0
jns 0x14003c3e5
mov r14, qword [rsp + 0x58]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x14003c405
mov rcx, qword [rsp + 0x58]
call fcn.14013a6ac
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x14003c46c
mov rcx, rbx
call fcn.14013ad74
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.1400b3b00
cmp byte [rsi + 0x17], 0
js 0x14003c470
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14003c44e
mov rcx, rbx
call fcn.14013b350
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14013d520
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x14003c417
mov rcx, qword [rsi]
call fcn.14013a6ac
jmp 0x14003c430
Function at 0x14003e8b0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [0x1402e3c70]
mov qword [rcx], rax
add rcx, 8
call fcn.1400bd360
lea rcx, [rsi + 0x10]
call fcn.1400bd360
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.1400bd360
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xd0], ebp
mov dword [rsi + 0xd8], ebx
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebp
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebp
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebp
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebp
mov qword [rsi + 0x198], rbx
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebx
mov dword [rsi + 0x1a0], 1
lea rcx, [rsi + 0x1a8]
call fcn.140126630
movups xmmword [rsi + 0x2e0], xmm6
movups xmmword [rsi + 0x2f0], xmm6
mov dword [rsi + 0x300], ebp
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
movups xmmword [rsi + 0x328], xmm6
mov byte [rsi + 0x338], bl
mov dword [rsi + 0x33c], edi
mov byte [rsi + 0x340], bl
movups xmmword [rsi + 0x348], xmm6
mov qword [rsi + 0x358], rbx
call fcn.14003ead0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov rcx, rsi
call fcn.1400e0b30
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14003eab8
mov rax, qword [0x14033ae48]
test rax, rax
jne 0x14003ea71
call fcn.1400c93e0
lea rcx, [rsp + 0x37]
mov byte [rcx], 1
mov qword [rsp + 0x20], rcx
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140067740
mov qword [0x14033ae40], rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14013d520
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x14017aab5.0]
jmp 0x14003ea60
Function at 0x140050180
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x80
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x2c]
mov dword [r9], 0x44
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov dword [r8 + 0x40], 0
xor esi, esi
mov ecx, 0x16
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x140050203
lea rsi, [rsp + 0x28]
mov dword [rsi], 0
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
setne al
cmp dword [rsi], 0
setne sil
and sil, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0x80
pop rsi
ret
Function at 0x140051820
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x177
call fcn.1400b5b90
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140062770
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov edx, 1
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov r8d, 2
cmove r8d, edx
test bl, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x140051a78
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov r8d, ebx
rol r8d, 0x1a
and r8d, 0x80000100
or r8d, ecx
bt ebx, 0x12
jae 0x14005191e
bt ebx, 0x15
jb 0x140051ad8
or r8d, 0x20000000
mov edx, ebx
shr edx, 4
and edx, 0x10000
or edx, r8d
mov ecx, ebx
shr ecx, 8
and ecx, 3
mov r8d, ebx
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r12d, ebx
and r12d, 0x400
mov ecx, r12d
shl ecx, 0x14
mov r9d, ebx
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, ebx
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r10d, ebx
shl r10d, 0xd
and r10d, 0x4000000
or r10d, ecx
mov r9d, ebx
shl r9d, 8
and r9d, 0xa000000
or r9d, r10d
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x1400519a0
mov rcx, qword [rdi]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp qword [rsi], rax
je 0x1400519fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140051a9b
mov rax, r14
inc rax
cmp rax, 2
jb 0x1400519ef
mov qword [rsi], r14
call fcn.1400a6030
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
inc r14
cmp r14, 2
jb 0x140051a4f
shr r12d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r12b
test bl, 4
jne 0x140051a61
test bl, 0xa
jne 0x140051a72
bt ebx, 0x15
jb 0x140051a91
lea rcx, [rsp + 0x60]
call fcn.140062a80
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14013d520
nop
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e3810
mov dword [rsi + 0x24], eax
jmp 0x140051a22
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x140051a1c
mov byte [rsi + 0x28], 1
jmp 0x140051a1c
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
call fcn.140185350
jmp 0x140051a22
mov rcx, rdi
call fcn.14017d980
jmp 0x140051a22
call fcn.1400a6030
mov r15, qword [rsi]
mov rcx, qword [0x14033c3e8]
test rcx, rcx
je 0x140051aca
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r15
call qword [case.0x14017aab5.0]
mov qword [rsi], 0
jmp 0x1400519db
call fcn.1400515d0
mov rcx, qword [0x14033c3e8]
jmp 0x140051aaf
int3
Function at 0x140052030
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
call fcn.14012ece0
lea rcx, [rsp + 0x30]
mov byte [rcx + 0x17], 0x15
lea rax, str.ExitCodeWatcherThread
cmp rcx, rax
ja 0x140052073
lea rcx, [rsp + 0x45]
cmp rcx, rax
ja 0x140052151
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x30]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.1400e25e0
cmp byte [rdi + 0x17], 0
js 0x140052124
mov dword [rsi + 0x98], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xa0], 0
test rax, rax
je 0x14005210c
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0xa0]
inc rax
cmp rax, 2
jae 0x140052133
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140052104
mov qword [rsi + 0xa0], rdi
call fcn.1400a6030
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14013d520
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x30]
call fcn.14013a6ac
jmp 0x1400520a6
call fcn.1400a6030
mov rcx, qword [rsi + 0xa0]
call fcn.1400ccd80
mov qword [rsi + 0xa0], 0
jmp 0x1400520ee
lea rax, str.char_traits::copy_overlapped_range
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
lea r9, str.__s2_____s1____s2_____s1__n
mov r8d, 0xf1
call fcn.140181600
int3

Function at 0x140052b70
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x14033b070]
test rax, rax
jne 0x140052be7
lea rcx, [0x1402f1600]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x140052c4c
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x140052c4c
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x140052c4c
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x140052c4c
xor eax, eax
lock cmpxchg qword [0x14033b070], rcx
mov rax, qword [0x14033b070]
test rax, rax
je 0x140052c4f
mov rcx, qword [0x14033b070]
lea rdx, str.NtSetInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140052c52
mov rdi, rax
lea rbx, [rsp + 0x24]
mov dword [rbx], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x6a
mov r8, rbx
mov r9d, 4
mov rax, rdi
call qword [case.0x14017aab5.0]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14013d520
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
int3
int3
int3
Function at 0x140058770
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140058830
mov eax, dword [rsi]
mov dword [0x14032a9b8], eax
test al, 1
jne 0x140058791
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x14033b1b0]
test rcx, rcx
jne 0x1400587ab
mov rcx, qword [0x14033b1a0]
test rcx, rcx
je 0x1400587cf
jmp 0x1400587f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14033b1b0], 0
mov rcx, qword [0x14033b1a0]
test rcx, rcx
jne 0x1400587f1
and byte [0x14032a9b8], 0xfe
mov ecx, 0x18
call fcn.14013a6b4
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x14033b1a0], rax
mov rdx, qword [rsi + 8]
call fcn.140109550
cmp dword [rsi + 0x14], 0
jne 0x140058816
mov rcx, qword [0x14033b1a0]
cmp byte [rcx + 0x17], 0
jns 0x140058810
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.1401fe3f0

Function at 0x14005925f
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x188], rax
cmp byte [rcx + 0x17], 0
jns 0x140059287
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140059398
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400592c6
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14013d520
mov rcx, rsi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
jmp fcn.1400593bc
cmp dword [0x14033b1a8], 2
jg 0x140059394
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x48]
mov r8d, 0x277
mov r9d, 2
call fcn.1401fea80
lea rcx, [rsp + 0x58]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401970a4
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
js 0x140059323
mov edx, eax
and edx, 0x7f
jmp 0x140059327
mov rdx, qword [rsi + 8]
test rdx, rdx
js 0x1400593b8
test al, al
cmovs rsi, qword [rsi]
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov rcx, rsi
mov r8, rbx
call fcn.140111960
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
jns 0x14005936a
mov r8, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jmp 0x14005936e
and r8d, 0x7f
mov rcx, rdi
mov rdx, rbx
call fcn.1401970a4
cmp byte [rsp + 0x47], 0
jns 0x14005938a
mov rcx, qword [rsp + 0x30]
call fcn.14013a6ac
lea rcx, [rsp + 0x48]
call fcn.1401feb00
xor esi, esi
jmp 0x14005939b
mov sil, 1
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
int3