joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e4a0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005c5d31], 0
jne 0x41e58f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e585
lea rbx, [0x00598190]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41e567
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045ebe0
lea rax, [0x004ca829]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00434ce0
nop
int3

Function at 0x420ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420de1
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x420d20
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x420dd1
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.00421840
nop dword [rax]
test rax, rax
je 0x420dd1
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00420e20]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045c3a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x420dbf
xor eax, eax
jmp 0x420dc9
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x420d12
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045c4e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00420ce0
Function at 0x42e2c0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42e566
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1278]
mov rcx, qword [rax + 0x1268]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42e55a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x005c5d31], 0
jne 0x42e322
xor edx, edx
xor ebx, ebx
nop
jmp 0x42e36a
xor edx, edx
jmp 0x42e34d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041dcc0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42e326
add rax, 0x1268
call fcn.0042e140
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42e4f4
mov rsi, qword [rax + rdx*8 + 0x1278]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42e367
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411c60
test rax, rax
jne 0x42e3c2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42e367
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42e405
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42e367
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42e54d
lea r10, [0x00598190]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42e48b
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42e4c5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42e367
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42e545
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42e367
cmp rbx, 0x200
ja 0x42e538
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00423e40
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042e140
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.0045ec40
mov rax, r8
call fcn.0045ebc0
mov rax, r8
mov ecx, 0x40
call fcn.0045ebe0
mov edx, 0x200
nop
call fcn.0045ec20
nop
mov qword [rsp + 8], rax
call fcn.00460c20
mov rax, qword [rsp + 8]
jmp fcn.0042e2c0
Function at 0x443220
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44338f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x443238
cmp edx, ecx
jne 0x44337d
nop dword [rax]
test rsi, rsi
jne 0x44337d
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x443296
nop
call fcn.004604e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00443120
mov rcx, qword [0x00571e88]
mov rdx, qword [0x00571e80]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
test edi, edi
jl 0x443378
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x44336d
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x005728d0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x005728d0], rbx
mov edx, 1
lea rsi, [0x005728d8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x44335c
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1228], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004c9f80]
mov ebx, 0x28
call fcn.00434ce0
mov rcx, rax
mov rax, rsi
call fcn.0045ebc0
call fcn.00433200
lea rax, [0x004c9365]
mov ebx, 0x23
call fcn.00434ce0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c4e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00443220
Function at 0x45e600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40286f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408f00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c4e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402840
cmp byte [0x005c5d30], 0
je 0x45e615
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b5e0
jmp 0x402840

Function at 0x45e620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c6020]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005c5d30], 0
je 0x45e655
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c6340]
aesenc xmm0, xmmword [0x005c6350]
aesenc xmm0, xmmword [0x005c6360]
movq rax, xmm0
ret
jmp 0x409100

Function at 0x45e660
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c6020]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005c5d30], 0
je 0x45e696
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c6340]
aesenc xmm0, xmmword [0x005c6350]
aesenc xmm0, xmmword [0x005c6360]
movq rax, xmm0
ret
jmp 0x409160

Function at 0x460000
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005c62c0]
mov qword [rsp + 8], rdx
lea r8d, [0x005c5d48]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045e540
add rsp, 0x30
ret
Function at 0x140064e85
Capabilities:
Get common file path
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140185028]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400a0d50
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x140155bd0]
movaps xmmword [rdi], xmm0
mov rcx, rsi
call fcn.1400ba984
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.140057d6a
lea rdx, str.usp10.dll
mov r8d, 0xa
mov rcx, rdi
call fcn.140030f74
cmp byte [rax + 0x17], 0
jns 0x140064f1a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [rsp + 0x37], 0
jns 0x140064f36
mov rcx, qword [rsp + 0x20]
call fcn.14009d77c
cmp esi, 0xffffffff
setne bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14009ec00
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400e8db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400e8efe
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140185028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x1400e8f61
mov edi, dword [rsi + 0x5c]
test bl, bl
je 0x1400e8f3a
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009ec00
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 0xffffffff
jmp 0x1400e8f3a
cmp byte [rsi + 0x61], 0
je 0x1400e8f97
mov rcx, qword [rsi + 0x40]
call fcn.1400b9464
cmp eax, 0xffffffff
je 0x1400e8f5a
test bl, bl
je 0x1400e8f81
movzx edi, al
mov dword [rsi + 0x5c], edi
jmp 0x1400e8f3a
mov rdx, qword [rsi + 0x40]
movzx edi, al
mov ecx, edi
call fcn.1400badd8
cmp eax, 0xffffffff
cmove edi, eax
jmp 0x1400e8f3a
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r15d, 1
cmovge r15d, eax
xor r14d, r14d
mov rcx, qword [rsi + 0x40]
call fcn.1400b9464
cmp eax, 0xffffffff
je 0x1400e8f5a
mov byte [rsp + r14 + 0x58], al
inc r14
cmp r15, r14
jne 0x1400e8fb9
lea rax, [rsp + 0x58]
mov byte [rax - 1], 0xaa
lea rax, [rsp + 0x48]
mov qword [rax], rdi
lea rbp, [rsp + 0x40]
mov qword [rbp], rdi
mov edi, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r14d, dword [rdx]
movzx r12d, word [rdx + 4]
movzx r13d, word [rdx + 6]
lea r9, [rsp + r15 + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x57]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x58]
call qword [0x140177320]
cmp eax, 1
jne 0x1400e9081
mov rax, qword [rsi + 0x50]
mov dword [rax], r14d
mov word [rax + 4], r12w
mov word [rax + 6], r13w
cmp r15d, 8
je 0x1400e8f3a
mov rcx, qword [rsi + 0x40]
call fcn.1400b9464
cmp eax, 0xffffffff
je 0x1400e8f3a
mov byte [rsp + r15 + 0x58], al
inc r15
jmp 0x1400e8ff3
cmp eax, 2
je 0x1400e8f3a
cmp eax, 3
jne 0x1400e9097
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test bl, bl
je 0x1400e90af
movzx edi, byte [rsp + 0x57]
jmp 0x1400e8f7c
movzx edi, byte [rsp + 0x57]
jmp 0x1400e8f3a
test r15, r15
jle 0x1400e90a5
mov rdx, qword [rsi + 0x40]
movzx ecx, byte [rsp + r15 + 0x57]
dec r15
call fcn.1400badd8
cmp eax, 0xffffffff
jne 0x1400e90af
jmp 0x1400e8f3a

Function at 0x1400e99a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400e99d7
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1400e99b1
ret

Function at 0x1400e9a50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400e9a88
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1400e9a61
ret
Function at 0x1400ff3b0
Capabilities:
Clear file content

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140185028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x140155bd0]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.SetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0xbf
call fcn.1400374b0
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14003bcb0
mov qword [r14 + 8], r15
mov qword [r14], 0
call fcn.14003e420
test al, al
je 0x1400ff455
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
mov r9, rdi
call fcn.14011abd0
lea r8, [rsp + 0x28]
mov qword [r8], r15
mov rcx, qword [rsi]
xor ebx, ebx
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400ff4b2
mov rcx, qword [rsi]
xor ebx, ebx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400ff4b2
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400ff4e7
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea rcx, [rsp + 0x30]
call fcn.14003e4b0
lea rcx, [rsp + 0x50]
call fcn.14003bd10
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14009ec00
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x1400ff4b2

Function at 0x1400ff4f0
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x140185028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x140155bd0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x234
call fcn.1400374b0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14003bcb0
mov al, byte [rsi + 0x17]
test al, al
jns 0x1400ff56e
cmp qword [rsi + 8], 0x103
ja 0x1400ff58c
test al, al
jns 0x1400ff575
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.14003bd10
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14009ec00
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140104690
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1401046c0
cmp rbx, 2
jb 0x1401047a8
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x140161e10]
movdqa xmm7, xmmword [0x140161e20]
movdqa xmm8, xmmword [0x140161e30]
movdqa xmm9, xmmword [0x140161e40]
mov rcx, rsi
call fcn.140114db0
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x14010471e
mov rcx, rsi
call fcn.140115290
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010477c
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x140104714
mov rcx, rsi
call fcn.140114db0
xor eax, eax
movdqa xmm0, xmmword [0x140161e10]
movdqa xmm1, xmmword [0x140161e20]
movdqa xmm2, xmmword [0x140161e30]
movdqa xmm3, xmmword [0x140161e40]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x1401047d2
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010482d
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140104c50
Capabilities:
Encode data using xor

Disassembly:
movsxd r9, dword [rdx + 8]
mov r8, qword [rdx]
movsxd rdx, dword [rcx + 8]
mov rcx, qword [rcx]
jmp fcn.140066e90

Function at 0x140105e80
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd rax, dword [rdx + 8]
cmp r9d, eax
jge 0x140105ea5
mov r10, qword [rdx]
xor r8d, r8d
mov r11, r9
or r8, qword [r10 + r11*8]
inc r11
cmp rax, r11
jne 0x140105e97
jmp 0x140105ea8
xor r8d, r8d
cmp eax, r9d
jge 0x140105ebf
mov r10, qword [rcx]
mov r11, rax
or r8, qword [r10 + r11*8]
inc r11
cmp r9, r11
jne 0x140105eb3
cmp r9d, eax
cmovl eax, r9d
test eax, eax
jle 0x140105ee8
mov r9, qword [rcx]
mov r10, qword [rdx]
mov eax, eax
xor r11d, r11d
mov rsi, qword [r10 + r11*8]
xor rsi, qword [r9 + r11*8]
or r8, rsi
inc r11
cmp rax, r11
jne 0x140105ed5
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x14010aaa0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov edx, dword [rcx + 8]
test edx, edx
jle 0x14010ac1c
mov rcx, qword [rcx]
shl rdx, 6
xor r8d, r8d
xor eax, eax
xor r9d, r9d
mov rdi, qword [rcx]
mov r11, rdi
shl r11, 0x20
mov r10, r11
not r10
dec r11
and r11, r10
sar r11, 0x3f
mov r10, rdi
shr r10, 0x20
mov rbx, r11
and r10d, ebx
not rbx
and rbx, rdi
or rbx, r10
lea r10, [rdi - 1]
mov rsi, rbx
shl rsi, 0x30
mov r14, rsi
mov r15, rdi
not r14
dec rsi
and rsi, r14
sar rsi, 0x3f
mov rdi, rbx
shr rdi, 0x10
mov r14, rsi
xor rdi, rbx
and rdi, r14
xor rdi, rbx
not r15
mov rbx, rdi
shl rbx, 0x38
mov r14, rbx
and r10, r15
not r14
dec rbx
and rbx, r14
sar rbx, 0x3f
mov r15, rdi
shr r15, 8
mov r14, rbx
xor r15, rdi
and r15, r14
xor r15, rdi
sar r10, 0x3f
mov r14, r15
shl r14, 0x3c
mov r12, r14
mov rdi, r10
not r12
dec r14
and r14, r12
sar r14, 0x3f
mov r13, r15
shr r13, 4
mov r12, r14
xor r13, r15
and r13, r12
xor r13, r15
not rdi
mov r15, r13
shl r15, 0x3e
mov r12, r15
or rdi, r9
not r12
dec r15
and r15, r12
sar r15, 0x3f
mov rbp, r15
mov r12d, r13d
shr r12d, 2
xor r12d, r13d
and r12d, ebp
xor r12d, r13d
shl r12, 0x3f
mov r13, r12
dec r12
and r11d, 0x20
not r13
and esi, 0x10
or esi, r11d
and ebx, 8
and r12, r13
or ebx, esi
and r14d, 4
or r14d, ebx
shr r12, 0x3f
and r15d, 2
or r15d, r14d
or r12d, r15d
add r12d, r8d
or r9d, r10d
not r9d
and r9d, r12d
or eax, r9d
add r8, 0x40
add rcx, 8
mov r9, rdi
cmp rdx, r8
jne 0x14010aac6
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x14010ac0f

Function at 0x14010cba0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140185028]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x140155bd0]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.14006a7f0
mov edx, dword [rdi + 0xd4]
mov rcx, rsi
mov r8, rdi
call fcn.14006e500
mov edx, 0xd8
mov rcx, rdi
call fcn.1400413b0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14009ec00
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret