joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400784cc
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov ebx, 8
inc rax
cmp rax, 1
ja 0x14007865f
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x14007865f
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rbx, rax
cmp qword [rdi + 8], rax
je 0x140078566
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x14007870e
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14007855a
mov qword [rdi + 8], rbx
call fcn.1400a6030
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rdi + 8]
inc rbx
cmp rbx, 2
jb 0x14007868a
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.1400787c1
mov r15, qword [rdi + 8]
mov ecx, 0x18
call fcn.14013a6b4
mov rbx, rax
mov rax, qword [r14]
mov rcx, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r15
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x38], rbx
test rax, rax
je 0x1400785c8
mov ecx, 1
lock xadd dword [rax], ecx
cmp ecx, 0x7fffffff
je 0x14007875b
mov rcx, qword [rdi + 0x18]
mov qword [rdi + 0x18], rax
test rcx, rcx
jne 0x140078691
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14007ea90]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp qword [rdi + 0x10], rax
je 0x140078641
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x1400786dd
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140078635
mov qword [rdi + 0x10], rbx
call fcn.1400a6030
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rdi + 0x10]
inc rbx
cmp rbx, 1
jbe 0x1400786b8
mov qword [rsp + 0x38], 0
xor ebx, ebx
lea rcx, [rsp + 0x38]
call fcn.140078760
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x1400786a4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14013d520
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebx, 0x3b
jmp 0x14007865f
lock dec dword [rcx]
jne 0x1400785d9
call fcn.140133cde
jmp 0x1400785d9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [case.0x14017aab5.0]
jmp 0x14007866e
mov rcx, qword [rdi + 0x18]
mov qword [rdi + 0x18], 0
mov ebx, 0x3b
test rcx, rcx
je 0x140078655
lock dec dword [rcx]
jne 0x140078655
call fcn.140133cde
jmp 0x140078655
call fcn.1400a6030
mov r14, qword [rdi + 0x10]
mov rcx, qword [0x14033c3e8]
test rcx, rcx
je 0x14007874d
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x14017aab5.0]
mov qword [rdi + 0x10], 0
jmp 0x140078620
call fcn.1400a6030
mov r14, qword [rdi + 8]
mov rcx, qword [0x14033c3e8]
test rcx, rcx
je 0x14007873f
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x14017aab5.0]
mov qword [rdi + 8], 0
jmp 0x140078545
call fcn.1400515d0
mov rcx, qword [0x14033c3e8]
jmp 0x140078723
call fcn.1400515d0
mov rcx, qword [0x14033c3e8]
jmp 0x1400786f2
int3
Function at 0x140078b66
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp rcx, rdx
jne 0x140078b86
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rsi, r9
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [r14 + 0x68], edi
jne 0x140078bb7
cmp byte [r14 + 0x27], 0
jns 0x140078bac
mov rcx, qword [r14 + 0x10]
jmp 0x140078bb0
lea rcx, [r14 + 0x10]
call r12
test al, 0x10
je 0x140078bc2
add r14, 0x70
cmp r14, rbx
je 0x140078b78
jmp 0x140078b99
mov r15, qword [rsi + 8]
cmp r15, qword [rsi + 0x10]
jne 0x140078bd9
mov rcx, rsi
mov rdx, r14
call fcn.14023c994
jmp 0x140078bb7
test r15, r15
je 0x140078bf3
mov rcx, r15
mov rdx, r14
call fcn.14023c8ec
add r15, 0x68
mov qword [rsi + 8], r15
jmp 0x140078bb7
int3

Function at 0x140079bc0
Capabilities:
Get file version info

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str....._base_file_version_info_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x62
call fcn.1400b5b90
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140062770
mov dword [rsp + 0x2c], 0xaaaaaaaa
cmp byte [rdi + 0x17], 0
jns 0x140079c4e
mov rdi, qword [rdi]
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
jne 0x140079c91
mov qword [rsi], 0
lea rcx, [rsp + 0x50]
call fcn.140062a80
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14013d520
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ebp, eax
mov r14d, eax
mov rcx, r14
call fcn.14013a6b4
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, r14
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov rdx, rbx
add rdx, rcx
je 0x140079d32
mov byte [rdx], 0
inc rcx
cmp r14, rcx
jne 0x140079cb0
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x2c]
mov rcx, rdi
mov r8d, ebp
mov r9, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140079d21
mov rcx, rbx
call fcn.1401976c0
mov ebx, eax
mov ebp, eax
shr ebp, 0x10
mov ecx, 0x38
call fcn.14013a6b4
mov rdi, rax
lea r14, [rsp + 0x30]
mov rcx, rax
mov rdx, r14
mov r8d, ebx
mov r9d, ebp
call fcn.140079d60
mov rbx, qword [r14]
mov qword [rsi], rdi
test rbx, rbx
je 0x140079c66
jmp 0x140079d25
xor edi, edi
jmp 0x140079d13
mov rcx, rbx
call fcn.14013a6ac
jmp 0x140079c66
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140181600
int3
Function at 0x14007a020
Capabilities:
Check if file exists
Copy file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x40], r12
movaps xmm6, xmmword [0x1402e6d80]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.DoLinkOrCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0xb8
call fcn.1400b5b90
xor ebp, ebp
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140062770
mov rcx, rsi
call fcn.1400b55f0
test al, al
jne 0x14007a17a
mov rcx, rdi
call fcn.1400b55f0
test al, al
jne 0x14007a1b0
cmp byte [rsi + 0x17], 0
jns 0x14007a0e6
cmp qword [rsi + 8], 0x103
ja 0x14007a1b0
cmp byte [rdi + 0x17], 0
jns 0x14007a0fa
cmp qword [rdi + 8], 0x103
ja 0x14007a1b0
lea r14, [rsp + 0x40]
mov qword [r14 + 0x10], r12
movaps xmmword [r14], xmm6
lea rdx, str.DoLinkOrCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0xcb
call fcn.1400b5b90
lea r8, [0x14033b024]
mov rcx, r14
mov rdx, r15
call fcn.140189160
cmp byte [rsi + 0x17], 0
jns 0x14007a143
mov rsi, qword [rsi]
cmp byte [rdi + 0x17], 0
mov r14, rdi
jns 0x14007a14f
mov r14, qword [rdi]
mov r15d, ebx
and r15d, 1
test bl, 2
jne 0x14007a1b4
mov rcx, rsi
mov rdx, r14
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14007a1d1
xor ebp, ebp
lea rcx, [rsp + 0x40]
call fcn.1400c9df0
lea rcx, [rsp + 0x60]
call fcn.140062a80
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14013d520
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x14007a17a
test r15d, r15d
jne 0x14007a200
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov bpl, 1
test eax, eax
jne 0x14007a170
jmp 0x14007a15b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bpl
je 0x14007a170
mov ecx, eax
and ecx, 1
je 0x14007a170
and eax, 0xfffffffe
mov rcx, r14
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bpl, 1
jmp 0x14007a170
mov rcx, rdi
call fcn.1400bb540
test al, al
jne 0x14007a16e
jmp 0x14007a1b9
Function at 0x14007caa0
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx ebp, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov r15, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r15
mov r14d, eax
movzx r13d, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call r15
mov word [rsp + 0x3e], ax
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.14013f660
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.14007cd40
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14007cba6
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14007cba6
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x14007cba6
dec r8d
mov rcx, rsi
call fcn.140106430
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.14013f660
movzx eax, r14w
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.14007cd40
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14007cc27
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14007cc27
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x14007cb72
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14013f660
mov qword [rsp + 0x30], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.14007cd40
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14007ccab
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14007ccab
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x14007cb72
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14013f660
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.14007cd40
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14007cd30
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14007cd30
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x14007cb72
xor esi, esi
jmp 0x14007cb80
Function at 0x14007ceb6
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14007cefe
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14007cf07
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14007ceee
mov qword [rdi], rsi
call fcn.1400a6030
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400a6030
mov rcx, qword [rdi]
call fcn.1400ccd80
mov qword [rdi], 0
jmp 0x14007cedc

Function at 0x14007dc40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14033aea8]
mov ecx, dword [0x140337e40]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007dc6a
add rsp, 0x28
ret
lea rcx, [0x14033aea8]
call fcn.14013b388
cmp dword [0x14033aea8], 0xffffffff
jne 0x14007dc65
xorps xmm0, xmm0
movups xmmword [0x14033ae98], xmm0
movups xmmword [0x14033ae88], xmm0
movups xmmword [0x14033ae78], xmm0
lea rcx, [0x14033ae78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14033aea8]
add rsp, 0x28
jmp fcn.14013a7d4
Function at 0x14007ef7a
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x14007f0b1
mov rbx, r9
mov edi, r8d
mov ebp, edx
mov rsi, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov r14, rax
cmp qword [rsi], rax
je 0x14007f001
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14007f0ca
mov rax, r14
inc rax
cmp rax, 2
jb 0x14007eff5
mov qword [rsi], r14
call fcn.1400a6030
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
lea rax, [r14 + 1]
cmp rax, 1
jbe 0x14007f132
xor r15d, r15d
lea rcx, [rsp + 0x30]
mov r8d, 0x90
xor edx, edx
call fcn.14013f660
cmp ebp, 3
jne 0x14007f0e3
xor eax, eax
test rbx, rbx
jne 0x14007f0b8
or eax, 0x2000
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x30]
mov rcx, r14
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14007f0a7
not edi
and r15d, edi
lea r8, [rsp + 0x2c]
mov dword [r8], r15d
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x14007f0a7
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14007f085
mov esi, 0x4df
jmp 0x14007f085
or eax, 0x100
mov qword [rsp + 0xa0], rbx
jmp 0x14007f038
call fcn.1400a6030
mov rcx, qword [rsi]
call fcn.1400ccd80
mov qword [rsi], 0
jmp 0x14007efe1
mov ecx, 0xc8
cmp ebp, 2
je 0x14007f127
mov eax, 8
cmp ebp, 1
je 0x14007f10a
test ebp, ebp
jne 0x14007f041
mov r15d, 0x27
mov eax, 0x408
mov ecx, r15d
or r15d, 0x10
mov dword [rsp + 0x2c], r15d
mov dword [rsp + 0x58], 1
or ecx, 0xd8
mov r15d, eax
mov eax, r15d
mov r15d, ecx
jmp 0x14007f02f
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14013d520
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x14008ed40
Capabilities:
Get file size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], r15
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xb2
call fcn.1400b5b90
xor ebx, ebx
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140062770
mov qword [r14], r15
mov rcx, qword [rdi]
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rbx, rbx
or rbx, qword [rdi]
mov rcx, rsi
call fcn.140062a80
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14013d520
mov rax, rbx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140098480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
je 0x1400984c3
mov r8, rdx
shr r8, 2
xor r9d, r9d
lea r10, [0x1402fc7e0]
movzx r11d, r8b
movzx esi, byte [rax + r9]
xor esi, r11d
shr r8d, 8
xor r8d, dword [r10 + rsi*4]
inc r9
cmp rdx, r9
jne 0x14009849e
cmp r8d, dword [rcx + 0x18]
sete al
pop rsi
ret
xor r8d, r8d
jmp 0x1400984ba

Function at 0x1400986f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov rdi, rdx
lea rcx, [rsp + 0x20]
mov qword [rcx], r14
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140098782
mov r15, 0xfffffffffffffffe
sub r15, rdi
lea rdi, [rsp + 0x20]
mov rax, qword [rsp + 0x20]
cmp rax, r15
ja 0x140098785
xor edx, edx
div rbx
add esi, edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
int3
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140098756
jmp 0x140098782

Function at 0x140098a30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x50]
mov qword [r15 + 0x40], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r12, [rsp + 0x30]
mov rcx, r12
mov r9d, 0x9d
call fcn.1400b5b90
xor esi, esi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.140062770
test edi, edi
js 0x140098b19
lea r15, [rsp + 0x30]
mov dword [r15], 0xaaaaaaaa
mov rcx, qword [r14]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, edi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [r15]
lea rcx, [rsp + 0x50]
call fcn.140062a80
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x140098aec
Function at 0x14009c2a0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x50]
mov qword [r12 + 0x40], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, str.Read
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x48
call fcn.1400b5b90
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call fcn.140062770
mov ebp, 0xffffffff
test r14, r14
js 0x14009c37c
test esi, esi
js 0x14009c37c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009c3af
mov ebp, dword [rsp + 0x2c]
test ebp, ebp
js 0x14009c3aa
lea rcx, [rsp + 0x50]
call fcn.140062a80
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14013d520
mov eax, ebp
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
cmp eax, 0x26
setne bpl
neg ebp
jmp 0x14009c37c
Function at 0x14009f970
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x50]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x65
call fcn.1400b5b90
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140062770
test esi, esi
js 0x14009fa54
lea r9, [rsp + 0x30]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009fa60
mov esi, dword [rsp + 0x30]
test esi, esi
js 0x14009fa5b
lea rcx, [rsp + 0x50]
call fcn.140062a80
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14009fa29
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x14009fa29
Function at 0x1400a0ac0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
lea rcx, [rsp + 0x28]
mov qword [rcx], rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400a0b3a
lea rcx, [rsp + 0x28]
mov rax, qword [rcx]
mov qword [rsi], rax
mov qword [rcx], rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400a0b3d
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14013d520
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
int3
int3