joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aafa0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x40], r14
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xb2
call fcn.140077960
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14006d330
mov qword [rbx + 8], r14
mov qword [rbx], 0
call fcn.14007d590
test al, al
jne 0x1400ab080
lea rdi, [rsp + 0x28]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.14007d620
lea rcx, [rsp + 0x50]
call fcn.14006e440
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400ecd30
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.1401855d0
jmp 0x1400ab02d

Function at 0x1400ab0a0
Capabilities:
Clear file content

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x40], r15
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.SetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0xbf
call fcn.140077960
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14006d330
mov qword [r14 + 8], r15
mov qword [r14], 0
call fcn.14007d590
test al, al
jne 0x1400ab1c8
lea r8, [rsp + 0x28]
mov qword [r8], r15
mov rcx, qword [rsi]
xor ebx, ebx
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400ab193
mov rcx, qword [rsi]
xor ebx, ebx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400ab193
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400ab1e4
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea rcx, [rsp + 0x30]
call fcn.14007d620
lea rcx, [rsp + 0x50]
call fcn.14006e440
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
mov r9, rdi
call fcn.1401855d0
jmp 0x1400ab136
xor ebx, ebx
jmp 0x1400ab193
Function at 0x1400ab880
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edx, 1
jmp 0x1400ab590

Function at 0x1400ab890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x40], rax
movaps xmm6, xmmword [0x1401d39f0]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2a0
call fcn.140077960
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14006d330
call fcn.1400c69e0
test al, al
jne 0x1400ab95f
cmp byte [rsi + 0x17], 0
jns 0x1400ab921
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x50]
call fcn.14006e440
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x40], 0xaaaaaaaa
cmp byte [rsi + 0x17], 0
jns 0x1400ab97a
mov rsi, qword [rsi]
lea r8, [rsp + 0x20]
mov rcx, rsi
xor edx, edx
call fcn.140185850
test eax, eax
jmp 0x1400ab92d

Function at 0x1400ab990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2cf
call fcn.140077960
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14006d330
cmp byte [rdi + 0x17], 0
jns 0x1400aba10
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.14006e440
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400ecd30
mov eax, edi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400aba50
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400eee80
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x1400abaef
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140113994
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.140077d50
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1400b1d20
mov rcx, rsi
mov rdx, r14
call fcn.140077fe0
mov rcx, r14
call fcn.140077ee0
mov rcx, rbx
call fcn.140077ee0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400abb20
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400eee80
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400abbb5
cmp word [rsp + 0x70], 0
je 0x1400abbb5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.140113994
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140077d50
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400ecd30
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.140077c20
mov rcx, rdi
call fcn.1400aba50
test al, al
je 0x1400abbf5
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140077d30
jmp 0x1400abc14
lea rax, [0x1401e08d2]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.140077d50
lea rcx, [rsp + 0x40]
call fcn.140077ee0
jmp 0x1400abb97
Function at 0x1400abd80
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2c8
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x270]
mov qword [rdi + 0x40], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x1401e0928]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov r9d, 0x4bb
call fcn.140077960
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14006d330
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400eee80
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x1400abe7f
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140113994
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.140077d50
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1400b1d20
mov rcx, rsi
mov rdx, r14
call fcn.140077fe0
mov rcx, r14
call fcn.140077ee0
mov rcx, rbx
call fcn.140077ee0
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x270]
call fcn.14006e440
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
add rsp, 0x2c8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400abec0
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x1401e093d]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x4cb
call fcn.140077960
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14006d330
cmp byte [rdi + 0x17], 0
jns 0x1400abf40
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rsi
call fcn.14006e440
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400abf80
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea r14, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1400eee80
mov qword [rsp + 0x20], rdi
xor ebp, ebp
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9d, 3
call fcn.1400ac330
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rbx], xmm0
mov rcx, r14
mov rdx, rbx
call fcn.1400e5aa0
movzx eax, byte [rbx + 0x17]
test al, al
jns 0x1400ac016
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x1400ac058
lea rcx, [rsp + 0x30]
call fcn.140077ee0
lea rcx, [rsp + 0x298]
call fcn.1400ac480
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1400eee80
mov rcx, r15
mov rdx, r14
call fcn.1400ac4f0
mov edx, dword [rsp + 0x48]
test dl, 1
jne 0x1400ac119
mov rcx, r14
call fcn.1400ac2b0
test al, al
jne 0x1400ac14b
test sil, 2
jne 0x1400ac19c
cmp byte [rsp + 0x47], 0
mov rcx, rbx
jns 0x1400ac0c0
mov rcx, qword [rsp + 0x30]
call r13
xor ebp, ebp
test eax, eax
je 0x1400ac1c3
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
call fcn.140088ad0
mov rcx, r15
mov rdx, r14
call fcn.1400e5aa0
mov rcx, rbx
mov rdx, r14
call fcn.140077fe0
mov rcx, r14
call fcn.140077ee0
movzx eax, byte [rsp + 0x47]
test al, al
jns 0x1400ac108
mov rax, qword [rsp + 0x38]
mov r12d, ebp
test rax, rax
je 0x1400ac01b
jmp 0x1400ac06f
test sil, 1
jne 0x1400ac1df
lea rcx, [rsp + 0x48]
call fcn.1400ac2b0
test al, al
je 0x1400ac1db
lea rcx, [rsp + 0x48]
call fcn.1400ac2b0
test al, al
je 0x1400ac0a7
xor ebp, ebp
jmp 0x1400ac0cd
xor ebp, ebp
test sil, 1
je 0x1400ac0cd
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rdx, rdi
mov r8d, esi
call fcn.1400abf80
mov ebp, eax
test eax, eax
jne 0x1400ac0cd
cmp byte [rsp + 0x47], 0
jns 0x1400ac187
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
jmp 0x1400ac0c5
call fcn.140068be0
xor edx, edx
cmp eax, 0xd
setge dl
shl edx, 4
or edx, 2
lea rcx, [rsp + 0x30]
call fcn.140166e30
xor ebp, ebp
test al, al
jne 0x1400ac0cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x1400ac0cd
mov edx, dword [rsp + 0x48]
and edx, 0xfffffffe
cmp byte [rsp + 0x47], 0
jns 0x1400ac1f0
mov rcx, qword [rsp + 0x30]
jmp 0x1400ac1f5
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400ac097
Function at 0x1400b0b30
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400b0bf0
mov eax, dword [rsi]
mov dword [0x1402070d8], eax
test al, 1
jne 0x1400b0b51
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x140218e18]
test rcx, rcx
jne 0x1400b0b6b
mov rcx, qword [0x140218df0]
test rcx, rcx
je 0x1400b0b8f
jmp 0x1400b0bb1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140218e18], 0
mov rcx, qword [0x140218df0]
test rcx, rcx
jne 0x1400b0bb1
and byte [0x1402070d8], 0xfe
mov ecx, 0x18
call fcn.1400eb670
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140218df0], rax
mov rdx, qword [rsi + 8]
call fcn.1400a8d30
cmp dword [rsi + 0x14], 0
jne 0x1400b0bd6
mov rcx, qword [0x140218df0]
cmp byte [rcx + 0x17], 0
jns 0x1400b0bd0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.14012d8e0
Function at 0x1400b29a0
Capabilities:
Accept command line arguments

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 3
call fcn.1400a9bf0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x1400b2aad
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x3c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1400b2ac5
lea rdx, [0x1401e1e4a]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b2ad8
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [case.0x140166830.0]
mov rbx, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x20]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [r14], xmm0
movsxd rax, dword [rsp + 0x3c]
lea r8, [rbx + rax*8]
mov rcx, r14
mov rdx, rbx
call fcn.1400b3510
mov rcx, rsi
mov rdx, r14
call fcn.1400b2490
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400b2aa0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x58]
mov qword [rcx], r14
call fcn.14006015e
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ecd30
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1400b2a43
xor ebx, ebx
jmp 0x1400b2a46

Function at 0x1400b4dc7
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400eee80
xor ebx, ebx
lea r14, str.PROGRAMFILES
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r14]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call r15
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400b4e42
mov edx, eax
mov rcx, rdi
mov r8, rsi
call fcn.1400b4d58
test al, al
jne 0x1400b4e6f
add rbx, 8
cmp rbx, 0x18
jne 0x1400b4e0f
xor esi, esi
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.1400ecd30
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov sil, 1
jmp 0x1400b4e4e
Function at 0x1400b5154
Capabilities:
Get common file path
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400eee80
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401d39f0]
movaps xmmword [rdi], xmm0
mov rcx, rsi
call fcn.140113994
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14006635e
lea rdx, str.usp10.dll
mov r8d, 0xa
mov rcx, rdi
call fcn.14006652c
cmp byte [rax + 0x17], 0
jns 0x1400b51e9
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [rsp + 0x37], 0
jns 0x1400b5205
mov rcx, qword [rsp + 0x20]
call fcn.1400eb6ac
cmp esi, 0xffffffff
setne bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400ecd30
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400bc270
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x1400bc36b
mov rsi, rcx
mov rcx, qword [rdx]
xor r8d, r8d
xor r9d, r9d
or r9, qword [rcx + r8*8]
inc r8
cmp rax, r8
jne 0x1400bc28f
test r9, r9
je 0x1400bc36b
test eax, eax
jle 0x1400bc390
mov rcx, qword [rdx]
test byte [rcx], 1
je 0x1400bc390
cmp dword [rdx + 0x10], 0
jne 0x1400bc3c7
cmp eax, 0x401
jae 0x1400bc3e7
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.1400ba110
test rax, rax
je 0x1400bc428
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x1400bc3b0
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
mov rax, rcx
je 0x1400bc2e5
inc ecx
mov dword [rsi + 0x20], ecx
mov rax, qword [rdi]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x1400bc321
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rsp + 0x20], 0xa4
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1400ce610
jmp 0x1400bc362
mov dword [rsp + 0x20], 0xa8
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x1400bc389
mov dword [rsi + 0x20], eax
test eax, eax
jne 0x1400bc304
mov dword [rsi + 0x28], 0
jmp 0x1400bc304
mov dword [rsp + 0x20], 0xac
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x1400bc389
mov r9d, 0x400
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rax, r9
jne 0x1400bc3f0
test r8, r8
je 0x1400bc2cd
mov dword [rsp + 0x20], 0xb0
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x1400bc389
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x1400bc389
Function at 0x1400bd270
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x1400bd2a2
mov ecx, dword [rdi + 0x2c]
call fcn.14007d7f0
test rax, rax
je 0x1400bd301
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.14007d850
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, qword [rdi + 0x10]
lea rcx, [0x140183cc0]
cmp rax, rcx
jne 0x1400bd2f6
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1401e7ca0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1401e7cb0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [case.0x140166830.0]
jmp 0x1400bd2e9
xor eax, eax
jmp 0x1400bd2ee
Function at 0x1400be660
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret

Function at 0x1400c1120
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp r9, 0x30
ja 0x1400c11d4
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
test r9, r9
jne 0x1400c11d8
xor eax, eax
lea rcx, [0x1401e83a0]
mov dl, byte [rax + rcx]
xor byte [rsp + rax + 0x30], dl
inc rax
cmp rax, 0x30
jne 0x1400c116a
lea r8, [rsi + 0xf8]
mov qword [rsp + 0x20], 0x20
lea rdi, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r9, rdi
call fcn.1400bce00
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov esi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ecd30
mov eax, esi
add rsp, 0x68
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400c11be
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r9, rax
je 0x1400c1161
jmp 0x1400c11da
Function at 0x1400c11f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [0x140203038]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp r8, 0x30
ja 0x1400c132d
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x1401d39f0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r13, [rsp + 0x40]
lea rbx, [rcx + 0x108]
lea r12, [rcx + 0xf8]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r8, rsi
call qword [case.0x140166830.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r13
mov r8, rsi
call qword [case.0x140166830.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [case.0x140166830.0]
test r14, r14
je 0x1400c12e1
xor eax, eax
nop dword [rax]
movzx ecx, byte [r15 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r14, rax
jne 0x1400c12d0
mov qword [rsp + 0x20], 0x20
lea r9, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r8, r12
call fcn.1400bce00
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ecd30
mov eax, esi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
jmp 0x1400c130e