joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a8d0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14009a7f0
test rax, rax
jne 0x14009a90f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14009a92b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140106490
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14004bc00
test al, al
je 0x14009a981
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.140157100
lea rcx, [rsp + 0x40]
lea rdx, [0x1402305e2]
mov r8d, ntohl
call fcn.1400e7690
mov rcx, rsi
call fcn.140157180
xor esi, esi
jmp 0x14009a90f

Function at 0x14009ad70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14009a4e8
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14009a4f1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140106490
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14009a4d1
int3
mov rcx, qword [rcx + 8]
jmp 0x14009a480

Function at 0x14009eb50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x14025ed58]
cmp rdi, 1
jbe 0x14009eb79
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400fb720
lea rcx, [0x14025ed58]
call fcn.14008c440
test al, al
je 0x14009ebbf
mov qword [0x14025ed60], 0
lea rbx, [0x14025ed58]
lea rdi, [0x14025ed60]
mov rcx, rdi
xor edx, edx
call fcn.14009f4a0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008c4e0
jmp 0x14009eb67
mov rdi, qword [0x14025ed58]
jmp 0x14009eb67

Function at 0x14009f1e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140252b08]
cmp ecx, 0xffffffff
je 0x14009f205
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14009f200
Function at 0x14009f210
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x140252b08]
cmp ecx, 0xffffffff
je 0x14009f2ee
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14009f2ee
mov eax, dword [0x1402605b8]
mov ecx, dword [0x140256f3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009f2f8
mov rbx, qword [0x1402605b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14009f33e
mov rax, qword [0x14025eda8]
inc rax
xor ecx, ecx
lea rdx, [0x14025edb0]
lea edi, [rax + rcx]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rdx + rsi*8], 0
jne 0x14009f34b
lea rax, [rdx + rsi*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x14025eda8], rdi
mov dword [r15], edi
mov eax, dword [rax + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x14009f360
cmp eax, 0x100
jge 0x14009f363
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14009f370
jmp 0x14009f23e
lea rcx, [0x1402605b8]
call fcn.140105cd0
cmp dword [0x1402605b8], 0xffffffff
jne 0x14009f263
mov ecx, 8
call fcn.140105b78
mov rbx, rax
mov rcx, rax
call fcn.1400f3dd0
mov qword [0x1402605b0], rbx
lea rcx, [0x1402605b8]
call fcn.140105d68
jmp 0x14009f263
mov rcx, rbx
call fcn.1400f3df0
jmp 0x14009f27b
inc rcx
cmp rcx, 0x100
jne 0x14009f28e
jmp 0x14009f2c2
int3
int3

Function at 0x14009f370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.140106420
sub rsp, rax
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140252b08]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14009f424
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14009f462
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140109290
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.140105bec
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140108e80
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140106490
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400ba0c0
test al, al
je 0x14009f465
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14009f468
mov eax, 0xffffffff
lock cmpxchg dword [0x140252b08], ecx
je 0x14009f3a8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140252b08]
mov dword [rsp + 0x2c], ecx
jmp 0x14009f3a8
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.1400ba0c0
test al, al
je 0x14009f48d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14009f48d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14009f43b
int3
Function at 0x1400a1540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x1400a155d
test rax, rax
jne 0x1400a1558
cmp dword [rcx + 0x50], 0
jne 0x1400a1558
jmp 0x1400fbcb0
jmp 0x1401b3880
mov rax, qword [rcx + 0x40]
jmp 0x1400a1548
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov byte [rcx + 0x54], 0
mov rax, qword [rcx + 0x10]
mov qword [rcx + 8], rax
cmp rax, qword [rcx + 0x18]
je 0x1400fbd3f
lea rdi, [rsi + 0x20]
movabs r14, 0x100003600
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
mov dl, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400eb410
cmp rax, 0xffffffffffffffff
je 0x1400fbd07
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400fbcdc
jmp 0x1400fbd3f
cmp dword [rsi + 0x58], 1
je 0x1400fbd62
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x1400fbd45
mov dl, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400eb410
cmp rax, 0xffffffffffffffff
jne 0x1400fbd45
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x1400fbd51
inc rax
mov qword [rsi + 0x10], rax
jmp 0x1400fbd13
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x1400fbd36
bt r14, rcx
jae 0x1400fbd36
jmp 0x1400fbd45
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x1400fbd0d
bt r14, rax
jb 0x1400fbcf7
jmp 0x1400fbd0d
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], 0
mov byte [rsp + 0x22], 0
mov rbx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
mov rcx, rax
cmp rbx, rax
je 0x1401b38eb
cmp dword [rsi + 0x58], 1
jne 0x1401b38e8
movabs rdx, 0x100003600
mov rcx, rbx
movzx ebx, byte [rcx]
cmp rbx, 0x20
ja 0x1401b38eb
bt rdx, rbx
jae 0x1401b38eb
inc rcx
mov qword [rsi + 0x10], rcx
cmp rcx, rax
jne 0x1401b38c8
mov rcx, rax
jmp 0x1401b38eb
mov rcx, rbx
cmp byte [rsi + 0x54], 0
sete dil
lea rbx, [rsp + 0x20]
test dil, 1
je 0x1401b3928
mov rdx, rax
mov rax, rcx
mov byte [rsi + 0x54], 1
mov qword [rsi + 8], rax
cmp rax, rdx
je 0x1401b3987
mov rcx, rax
inc rcx
mov qword [rsi + 0x10], rcx
xor edi, edi
test byte [rsi + 0x50], 1
mov rax, rdx
je 0x1401b38f8
jmp 0x1401b396d
mov byte [rsi + 0x54], 0
mov qword [rsi + 8], rcx
cmp rcx, rax
je 0x1401b3961
mov r8b, byte [rcx]
mov rcx, rsi
mov rdx, rbx
call fcn.1401b3990
mov rcx, qword [rsi + 0x10]
test al, al
je 0x1401b3958
inc rcx
mov qword [rsi + 0x10], rcx
cmp rcx, qword [rsi + 0x18]
jne 0x1401b3935
mov rax, rcx
cmp qword [rsi + 8], rcx
jne 0x1401b396d
test byte [rsi + 0x50], 2
jne 0x1401b396d
mov rdx, qword [rsi + 0x18]
jmp 0x1401b3904
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140106490
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1401b3970
Function at 0x1400a6190
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x1400a636f
mov rsi, rcx
mov byte [rsp + 0x3f], 0xaa
lea r15, [rcx + 0x2f8]
lea r14, [rcx + 0x48]
mov ebx, 1
xor ebp, ebp
mov rdi, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r14
call rdi
test al, al
je 0x1400a6336
mov rax, qword [r15]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400a62c8
mov byte [rsp + 0x3f], 0
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400a632f
mov ecx, dword [rsi + 0x310]
mov rdi, rdx
bswap rdi
test edi, 0x1fc000
je 0x1400a636a
mov rbp, rdi
xor rbp, rbx
cmp rbp, 0x1fffff
ja 0x1400a636a
not rdx
cmp qword [rbx + 8], rdx
jne 0x1400a636a
prefetcht0 byte [rdi]
mov qword [rax], rdi
inc word [rax + 0x18]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0xaa0]
mov qword [rsi + 0xaa0], rax
mov rcx, qword [rsi + 0xaa8]
cmp rcx, rax
cmovae rax, rcx
mov qword [rsi + 0xaa8], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rbx
mov rdx, rsi
call fcn.1400fe890
mov ecx, dword [0x1402612d0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140256f3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140106490
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov r9d, 0x2f8
mov rcx, r15
mov rdx, rsi
mov r8d, 2
call fcn.1400e67f0
test rax, rax
je 0x1400a6372
mov rbx, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x1400a6244
xor edi, edi
jmp 0x1400a623d
mov eax, ebx
test ebx, ebx
jle 0x1400a6344
pause
dec eax
jne 0x1400a633c
add ebp, ebx
add ebx, ebx
cmp ebx, 0x40
mov eax, 0x40
cmovge ebx, eax
cmp ebp, 0x3e8
jl 0x1400a61d5
mov rcx, r14
call fcn.1400a63f0
jmp 0x1400a61e2
call fcn.140136560
int3
xor ebx, ebx
jmp 0x1400a626e

Function at 0x1400a6600
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x1400a66a0]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x140261328]
lea rdx, [0x1400a64c0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400a6692
cmp dword [0x140261330], 0
jne 0x1400a668e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140261334]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400a668e
movsxd rax, esi
mov rsi, qword [rdi + rax*8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140106490
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400a6676
call fcn.140119940
int3
Function at 0x1400a66d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov ebx, ecx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x1400a66a0]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x140261328]
lea rdx, [0x1400a64c0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400a67c9
cmp dword [0x140261330], 0
jne 0x1400a67d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x140261334]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
jne 0x1400a677f
mov ecx, 0x20
call fcn.140096ce0
test rax, rax
je 0x1400a67d6
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov ecx, dword [0x140261334]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400a67ce
lea rbp, [0x140261338]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x140261340]
mov qword [rax + rbx*8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsi + rbx*8], r14
mov esi, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140106490
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140119940
mov rcx, rsi
call fcn.1400fab40
mov rcx, r14
call rdi
xor esi, esi
jmp 0x1400a67af
Function at 0x1400b7e90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x140261cf8]
mov ecx, dword [0x140256f3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400b7ef3
cmp rdi, rsi
je 0x1400b7ee9
mov eax, 0xffffffff
lea rcx, [0x1402618f8]
movzx edx, byte [rdi]
movzx ebx, al
xor ebx, edx
shr eax, 8
xor eax, dword [rcx + rbx*4]
inc rdi
cmp rdi, rsi
jne 0x1400b7ecf
not eax
jmp 0x1400b7eeb
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140261cf8]
call fcn.140105cd0
cmp dword [0x140261cf8], 0xffffffff
jne 0x1400b7ebe
lea rbx, [0x1402618f8]
mov r8d, 0x400
mov rcx, rbx
mov dl, 0xaa
call fcn.140109290
xor eax, eax
mov r8d, 0xedb88320
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
shr ecx, 1
and edx, 1
neg edx
and edx, r8d
xor edx, ecx
mov dword [rbx], edx
inc rax
add rbx, 4
cmp rax, 0x100
jne 0x1400b7f27
lea rcx, [0x140261cf8]
call fcn.140105d68
jmp 0x1400b7ebe

Function at 0x1400ba0c0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400ba0d5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x1400ba550
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140261d40]
cmp rdi, 1
jbe 0x1400ba579
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400fb720
lea rcx, [0x140261d40]
call fcn.14008c440
test al, al
je 0x1400ba5bf
mov qword [0x140261d48], 0
lea rbx, [0x140261d40]
lea rdi, [0x140261d48]
mov rcx, rdi
xor edx, edx
call fcn.14009f4a0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008c4e0
jmp 0x1400ba567
mov rdi, qword [0x140261d40]
jmp 0x1400ba567

Function at 0x1400bbfd0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140261da0], 0
jne 0x1400bc00d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400bc000
mov dword [rdi], eax
mov dword [0x140261da8], eax
mov qword [0x140261da0], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x1400bf7e0
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400bf880]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400bf839
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140106490
nop
add rsp, 0x40
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.14017bef0
mov rcx, rsi
call fcn.14017be20
lea rdx, [0x1402252c6]
mov r8d, ntohl
mov rcx, rax
call fcn.1400e7690
mov rcx, rsi
call fcn.14017be30
jmp 0x1400bf825

Function at 0x1400c5d30
Capabilities:
Decompress data using quicklz

Disassembly:
mov eax, ecx
or eax, edx
test al, 1
je 0x1400c5d3b
xor eax, eax
ret
mov r9d, dword [r8]
mov r10d, r9d
and r10d, 0xf800d000
xor eax, eax
cmp r10d, 0xf0008000
jne 0x1400c5d3a
mov r10d, r9d
and r10d, 0x3c00000
cmp r10d, 0x3c00000
je 0x1400c5d3a
sub edx, ecx
lea r10d, [rdx - 4]
and r10d, 1
lea r11d, [r10 + rdx]
add r11d, 0xfffffffc
mov ecx, r11d
and ecx, 1
jne 0x1400c5d3a
lea ecx, [r10 + rdx]
add ecx, 0xffffc
cmp ecx, 0x1fffff
ja 0x1400c5d3a
mov eax, r11d
shr eax, 1
and eax, 0x7ff
and r9d, 0xfbc0d000
mov ecx, r11d
shl ecx, 6
and ecx, 0x4000000
mov edx, r11d
shl edx, 4
and edx, 0x3f0000
or edx, ecx
mov ecx, r11d
shr ecx, 5
and ecx, 0x2000
or ecx, edx
shr r11d, 8
and r11d, 0x800
or r11d, ecx
or r11d, eax
or r11d, r9d
mov dword [r8], r11d
mov al, 1
ret
Function at 0x1400e7a00
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1400e7a49
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
add rax, 1
cmp rax, 2
jae 0x1400e7a52
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400e7a39
mov qword [rdi], rsi
call fcn.1400ed9a0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400ed9a0
mov rcx, qword [rdi]
call fcn.1400f1110
mov qword [rdi], 0
jmp 0x1400e7a27
Function at 0x1400e8f70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm4, r8d
pxor xmm4, xmm0
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1400e90a5
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x14021a0c0]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm4, xmmword [rcx]
pxor xmm4, xmm6
pxor xmm4, xmm0
movdqu xmm3, xmmword [rcx + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [rcx + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [rcx + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x1400e9000
movabs rax, 0x1751997d0
movq xmm0, rax
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x14021a0d0]
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm5, xmm4
pclmulqdq xmm5, xmm0, 0
pxor xmm5, xmm2
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm5
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
cmp rdx, 0x10
jb 0x1400e9134
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
pclmulqdq xmm4, xmm3, 0x11
pxor xmm4, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x1400e910a
movdqa xmm0, xmmword [0x14021a0d0]
pclmulqdq xmm0, xmm4, 1
psrldq xmm4, 8
pxor xmm4, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm4, 3
psrldq xmm4, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm4
pxor xmm1, xmm1
pblendw xmm1, xmm2, 3
pclmulqdq xmm1, xmmword [0x14021a0e0], 0x10
pblendw xmm1, xmm0, 0xfc
movabs rax, 0x1db710641
movq xmm0, rax
pclmulqdq xmm0, xmm1, 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x1400f0d30
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov esi, r9d
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x50], r13
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3e
call fcn.1400ed980
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f44c0
test esi, esi
js 0x1400f0e4e
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], 0
call fcn.1400f41f0
test al, al
jne 0x1400f0e55
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f0e71
mov esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.1400f4210
lea rcx, [rsp + 0x60]
call fcn.1400f4520
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140106490
mov eax, esi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x1400f0e1f
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.140174b50
jmp 0x1400f0ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400f0e15