joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400585e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140058667
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140058651
cmp dword [rsp + 0x38], 4
jne 0x140058651
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008db90
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x140058651

Function at 0x140058670
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rsi
push rdi
mov eax, 0x1048
call fcn.14008db20
sub rsp, rax
mov rsi, r8
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140058704
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140058708
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.140028e40
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14008db90
mov eax, edi
add rsp, 0x1048
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x1400586e8
cmp eax, 2
jne 0x14005873a
lea rcx, [rsp + 0x840]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x140058741
lea rdx, [rsp + 0x40]
jmp 0x1400586de
mov edi, 0x3f4
jmp 0x1400586e8
mov edi, 0xea
jmp 0x1400586e8

Function at 0x140059ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x140059b4c
cmp r8, 1
jne 0x140059ae2
xor ecx, ecx
jmp 0x140059b2e
mov r9, r8
and r9, 0xfffffffffffffffe
xor ecx, ecx
lea r10, [0x1400c2b10]
nop word cs:[rax + rax]
nop dword [rax]
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r9, rcx
jne 0x140059b00
test r8b, 1
je 0x140059b4c
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x1400c2b10]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret
Function at 0x14005b010
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [0x1400c4298]
mov qword [rcx], rax
add rcx, 8
call fcn.14003dec0
lea rcx, [rsi + 0x10]
call fcn.14003dec0
xor edi, edi
mov byte [rsi + 0x18], dil
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], edi
call fcn.14003dec0
mov byte [rsi + 0x48], dil
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rdi
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebx, 0x3f800000
mov dword [rsi + 0xd0], ebx
mov dword [rsi + 0xd8], edi
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebx
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebx
mov qword [rsi + 0x150], rdi
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x158], ebx
movups xmmword [rsi + 0x160], xmm6
movups xmmword [rsi + 0x170], xmm6
mov dword [rsi + 0x180], ebx
mov qword [rsi + 0x1a0], rdi
movups xmmword [rsi + 0x188], xmm6
mov dword [rsi + 0x198], edi
mov eax, dword [0x1400c5e78]
mov qword [rsi + 0x1a8], rax
lea rcx, [rsi + 0x1b0]
call fcn.14006a510
lea rcx, [rsi + 0x2f8]
movups xmmword [rsi + 0x2e0], xmm6
mov qword [rsi + 0x2f0], rdi
xor edx, edx
call fcn.1400633c0
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.1400633c0
lea rcx, [rsi + 0x308]
xor edx, edx
call fcn.1400633c0
movups xmmword [rsi + 0x310], xmm6
movups xmmword [rsi + 0x320], xmm6
mov dword [rsi + 0x330], ebx
movups xmmword [rsi + 0x338], xmm6
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
movups xmmword [rsi + 0x361], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
call fcn.1400030a0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x198], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x190], rax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140036530
lea rbx, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
call fcn.140036580
mov rax, qword [rbx]
mov qword [rsi + 0x130], rax
mov rcx, rdi
call fcn.140036500
mov rcx, rsi
call fcn.14005b280
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14005b26c
call fcn.140068340
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
call fcn.1400684a0
mov qword [0x1400e9a40], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008db90
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14005b225
Function at 0x140061460
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14006149c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400614a6
add rdi, rbx
sub rsi, rbx
jne 0x14006147a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140062fb0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e591c]
cmp ecx, 0xffffffff
je 0x140062fd5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x140062fd0

Function at 0x140062fe0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov ecx, dword [0x1400e591c]
cmp ecx, 0xffffffff
je 0x1400630b4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x1400630b4
mov eax, dword [0x1400eb318]
mov ecx, dword [0x1400e8628]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400630be
mov rbx, qword [0x1400eb310]
mov rcx, rbx
call fcn.14003ded0
mov rcx, qword [0x1400e9b00]
inc rcx
mov r8d, 0x100
lea rax, [0x1400e9b10]
movzx edi, cl
lea rdx, [rdi + rdi*2]
cmp dword [rax + rdx*8], 0
jne 0x140063104
lea rcx, [rax + rdx*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1400e9b00], rdi
mov dword [rsi], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
je 0x14006312b
cmp eax, 0x100
jge 0x14006312e
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140063140
jmp 0x14006300c
lea rcx, [0x1400eb318]
call fcn.14008d940
cmp dword [0x1400eb318], 0xffffffff
jne 0x140063031
mov ecx, 8
call fcn.14008d7cc
mov rbx, rax
mov rcx, rax
call fcn.14003dec0
mov qword [0x1400eb310], rbx
lea rcx, [0x1400eb318]
call fcn.14008d9d8
jmp 0x140063031
lea edx, [rcx + 1]
movzx edi, dl
lea rdx, [rdi + rdi*2]
cmp dword [rax + rdx*8], 0
je 0x140063068
add rcx, 2
add r8, 0xfffffffffffffffe
jne 0x140063057
jmp 0x14006308b
int3
int3
Function at 0x140063140
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14008db20
sub rsp, rax
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov ecx, dword [0x1400e591c]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400631ec
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006322e
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140090f50
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14008d85c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140090b40
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14008db90
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.14006f690
test al, al
je 0x140063231
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140063234
mov eax, 0xffffffff
lock cmpxchg dword [0x1400e591c], ecx
mov ecx, dword [rsp + 0x2c]
je 0x140063170
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1400e591c]
mov dword [rsp + 0x2c], ecx
jmp 0x140063170
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.14006f690
test al, al
je 0x140063259
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140063259
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140063203
int3

Function at 0x140063330
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400e591c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140063364
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140063364
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14006335e

Function at 0x140063370
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400e591c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400633ae
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400633a7
call fcn.140063140
jmp 0x14006338e
Function at 0x140064da0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140064dca
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140064de9
mov edi, eax
bt eax, 0xa
jae 0x140064de1
test bl, bl
je 0x140064df7
and edi, 0x10
shr edi, 4
jmp 0x140064df9
mov ecx, 2
call fcn.1400485b0
test al, al
jne 0x140064e16
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14008db90
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x81
mov r9d, 2
call fcn.140049240
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140002b20
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140034940
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140064e95
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140002b20
cmp byte [rsp + 0x4f], 0
jns 0x140064eb1
mov rcx, qword [rsp + 0x38]
call fcn.14008d81c
lea rcx, [rsp + 0x50]
call fcn.140049330
jmp 0x140064df7

Function at 0x140064ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140064ee8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140064f0f
test eax, 0x410
sete bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14008db90
mov eax, ebx
jmp 0x140064f2f
mov ecx, 2
call fcn.1400485b0
test al, al
jne 0x140064f3a
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14008db90
xor eax, eax
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x74
mov r9d, 2
call fcn.140049240
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140002b20
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140034940
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140064fb9
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140002b20
cmp byte [rsp + 0x4f], 0
jns 0x140064fd5
mov rcx, qword [rsp + 0x38]
call fcn.14008d81c
lea rcx, [rsp + 0x50]
call fcn.140049330
jmp 0x140064f1d
Function at 0x140064ff0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140065017
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006504f
and eax, 0x410
cmp eax, 0x410
jne 0x14006504f
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14008db90
mov rcx, rsi
add rsp, 0x1a8
pop rdi
pop rsi
jmp fcn.140065140
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14006505b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140065078
mov ecx, 2
call fcn.1400485b0
test al, al
jne 0x140065094
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14008db90
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x94
mov r9d, 2
call fcn.140049240
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140002b20
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140034940
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140065113
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140002b20
cmp byte [rsp + 0x57], 0
jns 0x14006512f
mov rcx, qword [rsp + 0x40]
call fcn.14008d81c
lea rcx, [rsp + 0x58]
call fcn.140049330
jmp 0x140065076

Function at 0x140065140
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140065168
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x140065182
mov ecx, 2
call fcn.1400485b0
test al, al
jne 0x1400651a4
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14008db90
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x2f
mov r9d, 2
call fcn.140049240
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140002b20
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.140034940
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x140065223
mov r8, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
mov rdx, rdi
call fcn.140002b20
cmp byte [rsp + 0x4f], 0
jns 0x14006523f
mov rcx, qword [rsp + 0x38]
call fcn.14008d81c
lea rcx, [rsp + 0x50]
call fcn.140049330
jmp 0x140065182
Function at 0x140066820
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400668de
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1400668ae
cmp eax, 0xffffffff
je 0x1400668bf
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008db90
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x1400668c2
mov eax, dword [rsp + 0x2c]
jmp 0x14006688e
int3
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x140066881
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140066890

Function at 0x140066fa0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.140066ed0
test rax, rax
jne 0x140066fef
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x140066fef
mov ecx, 2
call fcn.1400485b0
test al, al
jne 0x14006700b
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14008db90
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xf4
mov r9d, 2
call fcn.140049240
lea rcx, [rsp + 0x38]
lea rdx, [0x1400c487f]
mov r8d, 0xc
call fcn.140002b20
mov rcx, rsi
call fcn.140049330
jmp 0x140066fed

Function at 0x14006f690
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14006f6a5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14006fc60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006fc80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret
Function at 0x14006fcc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006fce0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x14006fd20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006fd43
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14006fda0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006fdc3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x14006fe20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006fe49
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret