joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401efe40
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x1c0
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
lea r9, [rsp + 0x16c]
mov dword [r9], 0x44
xorps xmm0, xmm0
lea r8, [rsp + 0x170]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov dword [r8 + 0x40], 0
mov ecx, ntohl
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1401efecb
lea r8, [rsp + 0x2c]
mov dword [r8], 0
lea rdx, [rsp + 0x170]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1401eff3e
cmp dword [rsp + 0x2c], 0
setne sil
jmp 0x1401eff23
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1401eff21
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x159
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x40]
lea rdx, str.Failed_to_create_well_known_SID
mov r8d, 0x1f
call fcn.1400fe0b0
mov rcx, rsi
call fcn.1401dd910
xor esi, esi
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.14016c920
mov eax, esi
add rsp, 0x1c0
pop rsi
ret
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1401eff21
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x15f
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x40]
lea rdx, str.Failed_to_check_token_membership_for_WinInteractiveSid
mov r8d, 0x36
jmp 0x1401eff14
Function at 0x1401f25a0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x238], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rbx
movaps xmm6, xmmword [0x1402faf80]
movups xmmword [rcx], xmm6
call fcn.140125da0
mov ecx, edi
mov rdx, rsi
call fcn.140068360
test al, al
je 0x1401f2619
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x1401f2604
mov rax, qword [rsi + 8]
test rax, rax
je 0x1401f2619
mov rcx, rsi
call fcn.140065500
test al, al
jne 0x1401f2706
mov rcx, rsi
call fcn.140125f40
mov ecx, 4
lea r14, [0x14031b0a0]
mov rax, rcx
jmp 0x1401f2648
not rax
add rax, rcx
lea r14, [r14 + rdx*8]
add r14, 0x18
mov rcx, rax
test rax, rax
je 0x1401f2657
shr rax, 1
lea rdx, [rax + rax*2]
cmp dword [r14 + rdx*8], edi
jge 0x1401f2640
jmp 0x1401f2632
lea rax, str.PROGRAMFILES
cmp r14, rax
je 0x1401f26fe
cmp dword [r14], edi
jg 0x1401f26fe
lea rdi, [rsp + 0x32]
mov r8d, 0x206
mov rcx, rdi
mov dl, 0xaa
call fcn.1401a5320
mov word [rdi - 2], 0
mov rcx, qword [r14 + 8]
lea rdi, [rsp + 0x30]
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x1401f26fe
mov qword [rsi + 0x10], rbx
movups xmmword [rsi], xmm6
lea rbx, [rsp + 0x20]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14018db74
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140125e00
mov rcx, rsi
call fcn.140078850
test al, al
je 0x1401f26f6
mov rcx, rsi
call fcn.140127610
test al, al
jne 0x1401f26f6
mov rcx, rsi
call fcn.140065500
test al, al
jne 0x1401f2706
mov rcx, rsi
call fcn.140125f40
mov rcx, rsi
call fcn.140125da0
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.14016c920
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401f50b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
lea rax, [0x1403926a0]
xor ecx, ecx
mov edx, 0xedb88320
mov r9d, ecx
shr r9d, 1
mov r8d, ecx
and r8d, 1
neg r8d
and r8d, edx
xor r8d, r9d
mov r10d, r8d
shr r10d, 1
mov r9d, ecx
shl r9d, 0x1e
sar r9d, 0x1f
and r9d, edx
xor r9d, r10d
mov r10d, r9d
shr r10d, 6
mov r11d, ecx
shl r11d, 0x1d
sar r11d, 0x1f
and r11d, 0x76dc419
mov esi, ecx
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, r11d
mov r11d, ecx
shl r11d, 0x1b
sar r11d, 0x1f
and r11d, 0x1db71064
xor r11d, esi
mov esi, ecx
shl esi, 0x1a
sar esi, 0x1f
and esi, 0x3b6e20c8
xor esi, r11d
xor esi, r10d
shl r8d, 0x1a
sar r8d, 0x1f
and r8d, 0x76dc4190
xor r8d, esi
shl r9d, 0x1a
sar r9d, 0x1f
and r9d, edx
xor r9d, r8d
mov dword [rax], r9d
inc rcx
add rax, 4
cmp rcx, 0x100
jne 0x1401f50c3
mov eax, 0x100
lea rcx, [0x1403926a0]
mov edx, dword [rcx + rax*4 - 0x400]
movzx r8d, dl
shr edx, 8
xor edx, dword [rcx + r8*4]
mov dword [rcx + rax*4], edx
inc rax
cmp rax, 0x800
jne 0x1401f5186
lea rax, [0x14016baf0]
mov qword [0x1403946a0], rax
mov qword [0x140392698], rax
lea rsi, [0x14016ba00]
mov qword [0x1403946a8], rsi
call fcn.14026d5d0
test eax, eax
jne 0x1401f51d9
mov qword [0x140392698], rsi
add rsp, 0x20
pop rsi
ret
Function at 0x1401f90d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [0x140394700]
test rax, rax
jne 0x1401f9114
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x140394700]
test rax, rax
je 0x1401f9101
cmp eax, 2
je 0x1401f91b2
mov eax, 1
lock xadd qword [0x140394738], rax
inc rax
cmp rax, 2
jl 0x1401f9141
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1403946c0], eax
mov qword [0x1403946b8], rsi
mov rcx, qword [0x140380c90]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1401f91ff
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, ILCreateFromPathW
mov r9d, 2
call fcn.140073d90
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
jmp 0x1401f91f2
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1401f91ff
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x90
mov r9d, 2
call fcn.140073d90
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
call fcn.1400fe0b0
mov rcx, rsi
call fcn.140074360
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14016c920
xor eax, eax
add rsp, 0x158
pop rdi
pop rsi
ret
Function at 0x140237d80
Capabilities:
Initialize winhttp library

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
mov r10d, r8d
mov rsi, rcx
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [0x14037e040]
xor rcx, rsp
mov qword [rsp + 0x150], rcx
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rcx
movaps xmm0, xmmword [0x1402faf80]
movups xmmword [rsi], xmm0
cmp qword [rax + 8], 0
je 0x140237f4e
mov rax, qword [rax]
cmp qword [r9 + 8], 0
je 0x140237f46
mov r8, qword [r9]
mov rcx, qword [rdx]
mov dword [rsp + 0x20], 0x10000000
mov edx, r10d
mov r9, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
lea rax, [0x1402ff358]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 0
test rdi, rdi
je 0x140237f26
lea rbx, [rsp + 0x40]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401a5320
mov dword [rbx - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x100000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x34]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140237f26
lea rbx, [rsp + 0x40]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401a5320
mov dword [rbx - 0xc], 0x11c
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x300000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x34]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140237f26
lea r8, [rsp + 0x34]
mov dword [r8], 0xa80
mov rcx, rdi
mov edx, 0x54
mov r9d, 4
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14016c920
mov rax, rsi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
ret
xor r8d, r8d
jmp 0x140237de0
xor eax, eax
jmp 0x140237dd2
Function at 0x140239950
Capabilities:
Prepare http request

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx ebp, byte [rcx + 0xd0]
movsx rax, byte [rcx + 0x10f]
test rax, rax
js 0x140239a2f
lea rcx, [rdi + 0xf8]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
test rax, rax
sete al
test rcx, rcx
setne cl
or cl, al
je 0x140239a50
shl ebp, 0x17
or ebp, 0x100
lea rbx, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400bfd40
cmp byte [rbx + 0x17], 0
jns 0x1402399d0
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rdi + 0x110]
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
lea rcx, [0x1402ff358]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
cmp byte [rsp + 0x5f], 0
jns 0x140239a16
mov rcx, qword [rsp + 0x48]
call fcn.14016b3e8
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14016c920
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0xf8]
mov rax, qword [rdi + 0x100]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
test rax, rax
jns 0x140239996
ud2

Function at 0x140239f20
Capabilities:
Receive http response

Disassembly:
push rsi
sub rsp, 0x20
cmp qword [rcx + 0x40], 0
je 0x140239fbc
mov rsi, rcx
mov rdx, qword [rcx + 0x160]
mov r8, qword [rcx + 0x168]
mov rax, r8
sub rax, rdx
cmp rax, 0x3fff
jbe 0x140239f75
cmp rax, 0x4000
je 0x140239f97
add rax, 0xffffffffffffc000
dec r8
cmp rax, r8
ja 0x140239fc9
lea r8, [rdx + 0x4000]
mov qword [rsi + 0x168], r8
jmp 0x140239f9c
lea rcx, [rsi + 0x160]
mov edx, 0x4000
sub rdx, rax
call fcn.14010a140
mov rdx, qword [rsi + 0x160]
mov r8, qword [rsi + 0x168]
cmp rdx, r8
je 0x140239fc9
sub r8d, edx
mov rcx, qword [rsi + 0x40]
xor esi, esi
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x140239fc1
add rsp, 0x20
pop rsi
jmp fcn.14027a520
mov esi, 0x800704c7
mov eax, esi
add rsp, 0x20
pop rsi
ret
ud2

Function at 0x14023c070
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rsi, rdx
mov edi, ecx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rbx, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401a5320
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x14023c0ff
lea r14, [rsp + 0x28]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14018db74
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, r14
call fcn.140125e00
mov rcx, rsi
mov rdx, rbx
call fcn.140076f50
mov rcx, rbx
call fcn.140125f40
test edi, edi
setns bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14016c920
mov eax, ebx
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14023c630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r15, qword [rcx + 0x58]
cmp rdi, r15
je 0x14023c686
mov rbx, rcx
lea r14, [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
call fcn.14023e120
test al, al
jne 0x14023c682
add rdi, 0x70
cmp rdi, r15
jne 0x14023c66a
mov r15, qword [rbx + 0x58]
cmp rdi, r15
je 0x14023c6bf
cmp byte [rdi + 0x27], 0
js 0x14023c697
lea rcx, [rdi + 0x10]
jmp 0x14023c69b
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x14023c6c4
mov qword [rsi], rdi
xor ebx, ebx
jmp 0x14023c6c4
mov ebx, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14016c920
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14023c840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r9
mov ebp, r8d
mov rdi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x50]
mov r15, qword [rcx + 0x58]
cmp rbx, r15
je 0x14023c89a
lea r14, [rsp + 0x20]
mov rcx, rbx
mov rdx, r14
call fcn.14023e120
test al, al
jne 0x14023c896
add rbx, 0x70
cmp rbx, r15
jne 0x14023c87e
mov r15, qword [rdi + 0x58]
mov r14d, 1
cmp rbx, r15
je 0x14023c8ed
mov eax, dword [rbx + 0x68]
cmp eax, ebp
jne 0x14023c8de
cmp byte [rbx + 0x27], 0
jns 0x14023c8b8
mov rcx, qword [rbx + 0x10]
jmp 0x14023c8bc
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14023c8ed
shr eax, 3
and eax, 2
mov r14d, eax
jne 0x14023c8ed
mov byte [rdi + 0x48], 1
mov qword [rsi], rbx
xor r14d, r14d
jmp 0x14023c8ed
xor ecx, ecx
cmp eax, 1
sete cl
lea r14d, [rcx + rcx*2]
inc r14d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14016c920
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14023ca60
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x190], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x48]
mov qword [rbx], r14
mov rdx, rbx
call fcn.140095430
mov r12, qword [rbx]
test r12, r12
je 0x14023cb46
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], r14
movaps xmm0, xmmword [0x1402faf80]
movaps xmmword [rcx], xmm0
call fcn.140125da0
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x50], xmm0
mov rbx, qword [r12 + 0x50]
mov r15, qword [r12 + 0x58]
cmp rbx, r15
je 0x14023cb02
lea r14, [rsp + 0x50]
mov rcx, rbx
mov rdx, r14
call fcn.14023e120
test al, al
jne 0x14023cafd
add rbx, 0x70
cmp rbx, r15
jne 0x14023cae5
mov r15, qword [r12 + 0x58]
cmp rbx, r15
jne 0x14023cb4d
mov esi, 1
lea rcx, [rsp + 0x30]
call fcn.140125f40
lea rcx, [rsp + 0x48]
call fcn.140095e80
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14016c920
mov eax, esi
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 3
jmp 0x14023cb16
lea rdx, [rbx + 0x10]
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.140125f50
mov r13, qword [r12 + 0x58]
cmp r13, rbx
je 0x14023ccb9
lea rcx, [r12 + 0x50]
lea rbp, [rbx + 0x70]
mov rdx, rbx
cmp rbp, r13
je 0x14023cb9b
mov qword [rsp + 0x28], rcx
xor r15d, r15d
jmp 0x14023cc22
add rbp, 0xffffffffffffff90
mov rdx, rbp
lea r14, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
sub rdx, rbx
add rdx, rbx
call fcn.14023db10
mov byte [r12 + 0x48], 1
cmp byte [rsp + 0x47], 0
jns 0x14023cbb8
mov r14, qword [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14023cc43
mov rcx, rdi
mov rdx, rsi
call fcn.14027ece0
xor esi, esi
jmp 0x14023cb0c
mov rcx, qword [r14]
call fcn.14016b3e8
mov rax, qword [rbp + 0x38]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rbp + 0x28]
movups xmmword [r14], xmm0
mov byte [rbp + 0x3f], r15b
mov byte [rbp + 0x28], r15b
movups xmm0, xmmword [rbp + 0x40]
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0x68]
mov dword [rbp - 8], eax
add rbp, 0x70
cmp rbp, r13
je 0x14023cb8a
movups xmm0, xmmword [rbp]
movups xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x10]
call fcn.140076f50
lea r14, [rbp - 0x48]
cmp byte [rbp - 0x31], 0
jns 0x14023cbdf
jmp 0x14023cbd7
mov esi, 2
mov ecx, 2
call fcn.140124e30
test al, al
je 0x14023cb0c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x50]
mov esi, 2
mov rcx, rdi
mov r8d, 0x36f
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.1400fe0b0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401deb10
mov rcx, rdi
call fcn.1401dd910
jmp 0x14023cb0c
ud2
Function at 0x140243270
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x1402432cf
xor r11d, r11d
mov rsi, qword [r8 + r11*8]
mov rdi, qword [rcx + r11*8]
mov rbx, rdi
xor rbx, rsi
lea r14, [rbx - 1]
mov r15, rdi
sub r15, rsi
xor r15, rdi
or r15, rbx
not rbx
and r14, rbx
sar r14, 0x3f
xor r15, rdi
sar r15, 0x3f
or r15, 1
xor rax, r15
and rax, r14
xor rax, r15
inc r11
cmp r10, r11
jne 0x14024328b
cmp rdx, r9
jb 0x1402432de
ja 0x140243302
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x1402432e0
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
not ecx
or eax, ecx
jmp 0x1402432d6
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140243305
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
xor eax, 1
and eax, r8d
xor eax, 1
jmp 0x1402432d6

Function at 0x1402433c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd rax, dword [rdx + 8]
cmp r9d, eax
jge 0x1402433e5
mov r10, qword [rdx]
xor r8d, r8d
mov r11, r9
or r8, qword [r10 + r11*8]
inc r11
cmp rax, r11
jne 0x1402433d7
jmp 0x1402433e8
xor r8d, r8d
cmp eax, r9d
jge 0x1402433ff
mov r10, qword [rcx]
mov r11, rax
or r8, qword [r10 + r11*8]
inc r11
cmp r9, r11
jne 0x1402433f3
cmp r9d, eax
cmovl eax, r9d
test eax, eax
jle 0x140243428
mov r9, qword [rcx]
mov r10, qword [rdx]
mov eax, eax
xor r11d, r11d
mov rsi, qword [r10 + r11*8]
xor rsi, qword [r9 + r11*8]
or r8, rsi
inc r11
cmp rax, r11
jne 0x140243415
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x140248d10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
movsxd rdx, dword [rcx + 8]
test rdx, rdx
jle 0x140248e8e
mov rcx, qword [rcx]
shl rdx, 6
xor r8d, r8d
xor eax, eax
xor r9d, r9d
mov rdi, qword [rcx]
mov r11, rdi
shl r11, 0x20
mov r10, r11
not r10
dec r11
and r11, r10
sar r11, 0x3f
mov r10, rdi
shr r10, 0x20
mov rbx, r11
and r10d, ebx
not rbx
and rbx, rdi
or rbx, r10
lea r10, [rdi - 1]
mov rsi, rbx
shl rsi, 0x30
mov r14, rsi
mov r15, rdi
not r14
dec rsi
and rsi, r14
sar rsi, 0x3f
mov rdi, rbx
shr rdi, 0x10
mov r14, rsi
xor rdi, rbx
and rdi, r14
xor rdi, rbx
not r15
mov rbx, rdi
shl rbx, 0x38
mov r14, rbx
and r10, r15
not r14
dec rbx
and rbx, r14
sar rbx, 0x3f
mov r15, rdi
shr r15, 8
mov r14, rbx
xor r15, rdi
and r15, r14
xor r15, rdi
sar r10, 0x3f
mov r14, r15
shl r14, 0x3c
mov r12, r14
mov rdi, r10
not r12
dec r14
and r14, r12
sar r14, 0x3f
mov r13, r15
shr r13, 4
mov r12, r14
xor r13, r15
and r13, r12
xor r13, r15
not rdi
mov r15, r13
shl r15, 0x3e
mov r12, r15
or rdi, r9
not r12
dec r15
and r15, r12
sar r15, 0x3f
mov rbp, r15
mov r12d, r13d
shr r12d, 2
xor r12d, r13d
and r12d, ebp
xor r12d, r13d
shl r12, 0x3f
mov r13, r12
dec r12
and r11d, 0x20
not r13
and esi, 0x10
or esi, r11d
and ebx, 8
and r12, r13
or ebx, esi
and r14d, 4
or r14d, ebx
shr r12, 0x3f
and r15d, 2
or r15d, r14d
or r12d, r15d
add r12d, r8d
or r9d, r10d
not r9d
and r9d, r12d
or eax, r9d
add r8, 0x40
add rcx, 8
mov r9, rdi
cmp rdx, r8
jne 0x140248d38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140248e81
Function at 0x14024ba00
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x1402faf80]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.14009d010
mov edx, dword [rdi + 0xd4]
mov rcx, rsi
mov r8, rdi
call fcn.1400a0390
mov edx, 0xd8
mov rcx, rdi
call fcn.140137d50
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14016c920
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x14024c880
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x14026f2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rax
jmp fcn.14026fda0