joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ad250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
mov esi, dword [eax + 4]
xor edx, edx
cmp edi, esi
jge 0x6ad279
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
xor edx, edx
mov ebx, edi
or edx, dword [eax + ebx*4]
inc ebx
cmp esi, ebx
jne 0x6ad271
cmp esi, edi
jge 0x6ad289
mov eax, dword [ecx]
mov ebx, esi
or edx, dword [eax + ebx*4]
inc ebx
cmp edi, ebx
jne 0x6ad281
cmp edi, esi
cmovl esi, edi
test esi, esi
jle 0x6ad2a8
mov edi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
xor eax, eax
mov ecx, dword [ebx + eax*4]
xor ecx, dword [edi + eax*4]
or edx, ecx
inc eax
cmp esi, eax
jne 0x6ad29b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b6ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edx, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x7aa024]
xor ecx, ebp
mov dword [esp + 0x58], ecx
lea ecx, [eax + 4]
mov ebx, ecx
shr ebx, 5
mov dword [esp + 4], edx
mov esi, dword [edx + 0xc]
mov edi, 0
cmp ebx, esi
jae 0x6b6f07
mov edx, dword [ebp + 0xc]
mov edi, dword [edx + ebx*4]
shr edi, cl
shl edi, 5
and edi, 0x20
lea ecx, [eax + 3]
mov edx, ecx
shr edx, 5
mov dword [esp], esi
cmp edx, esi
mov esi, 0
jae 0x6b6f29
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + edx*4]
shr esi, cl
shl esi, 4
and esi, 0x10
or esi, edi
lea edx, [eax + 2]
mov ecx, edx
shr ecx, 5
xor edi, edi
mov ebx, 0
cmp ecx, dword [esp]
jae 0x6b6f4f
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx + ecx*4]
mov ecx, edx
shr ebx, cl
shl ebx, 3
and ebx, 8
or esi, ebx
mov ebx, esi
lea ecx, [eax + 1]
mov edx, ecx
shr edx, 5
mov esi, dword [esp]
cmp edx, esi
jae 0x6b6f73
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + edx*4]
mov esi, dword [esp]
shr edi, cl
shl edi, 2
and edi, 4
or ebx, edi
mov ecx, eax
shr ecx, 5
xor edi, edi
cmp ecx, esi
jae 0x6b6f8f
mov edx, dword [ebp + 0xc]
mov edi, dword [edx + ecx*4]
mov ecx, eax
shr edi, cl
add edi, edi
and edi, 2
or ebx, edi
test eax, eax
je 0x6b6fb4
dec eax
mov edx, eax
shr edx, 5
xor ecx, ecx
cmp edx, esi
jae 0x6b6faf
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
bt edx, eax
setb cl
and ebx, 0xfffffffe
or ebx, ecx
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 5
lea eax, [ecx - 1]
neg ecx
and eax, ebx
xor ebx, 0x3f
mov dword [esp + 8], ecx
and ebx, ecx
or ebx, eax
mov eax, ebx
shr eax, 1
and ebx, 1
add ebx, eax
mov dword [esp], ebx
push 0xcc
push 0
mov esi, dword [esp + 0x14]
push esi
call fcn.00650600
add esp, 0xc
xor ebx, ebx
mov eax, ebx
xor eax, dword [esp]
dec eax
sar eax, 0x1f
push esi
push edi
push eax
push esi
push dword [esp + 0x14]
call fcn.006b4370
add esp, 0x14
inc ebx
add edi, 0xcc
cmp ebx, 0x11
jne 0x6b6ff0
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x10]
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
mov dword [eax + 0x40], 0xffffffff
lea ecx, [esi + 0x44]
push ecx
push eax
mov edi, dword [esp + 0xc]
push edi
call fcn.006b6140
add esp, 0xc
mov edi, dword [edi + 0x28]
test edi, edi
mov ecx, dword [esp + 8]
je 0x6b707b
mov eax, ecx
mov dword [esp + 4], eax
not ecx
xor edx, edx
mov eax, edi
mov edi, dword [esp + edx*4 + 0x10]
and edi, dword [esp + 4]
mov ebx, dword [esi + edx*4 + 0x44]
and ebx, ecx
or ebx, edi
mov edi, eax
mov dword [esi + edx*4 + 0x44], ebx
inc edx
cmp eax, edx
jne 0x6b705e
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0064d372
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6c2520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
add eax, 0x20
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], eax
xor esi, esi
mov edi, esi
xor edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov edx, edi
push ecx
push ebx
call fcn.006c2460
add esp, 8
lea eax, [ebx + 0x20]
mov ecx, dword [ebp - 0x18]
mov edx, edi
push ecx
push eax
call fcn.006c2460
add esp, 8
inc esi
add ebx, 0x40
cmp esi, 0xf
jne 0x6c2559
mov ecx, dword [ebp + 8]
add ecx, 0x40
mov edx, dword [ebp - 0x10]
push 0x75e73c
push ecx
call fcn.006c2460
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6dcba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp edx, 0x33ff
jg 0x6dcbcb
add edx, edx
movzx eax, dx
movzx edx, word [ecx]
cmp eax, edx
jbe 0x6dcc18
and edx, 1
lea ecx, [ecx + edx*2]
add ecx, 4
jmp 0x6dcbb9
mov esi, edx
shr esi, 9
add esi, 0x3400
and esi, 0xfffe
shl edx, 6
xor eax, eax
dec eax
movzx ebx, word [ecx]
cmp esi, ebx
jbe 0x6dcbf6
and ebx, 1
or ebx, 2
mov edi, ebx
lea ecx, [ecx + edi*2]
jmp 0x6dcbe2
mov edi, ebx
and edi, 0x7ffe
cmp esi, edi
jne 0x6dcc3d
movzx edi, word [ecx + 2]
cmp di, dx
jae 0x6dcc42
mov edi, 3
bt ebx, 0xf
jae 0x6dcbf1
jmp 0x6dcc3d
mov ebx, edx
and ebx, 0x7ffe
cmp eax, ebx
jne 0x6dcc3a
movzx eax, word [ecx + 2]
test dl, 1
je 0x6dcc3d
shl eax, 0x10
mov edi, eax
movzx eax, word [ecx + 4]
or eax, edi
jmp 0x6dcc3d
xor eax, eax
dec eax
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edi
test edx, 0xffc0
jne 0x6dcc3d
and edi, 0x3f
shl edi, 0x10
jmp 0x6dcc32

Function at 0x6e3250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x6e32a2
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.006e2ba0
test al, al
jne 0x6e328f
add esi, 0x58
cmp esi, ebx
jne 0x6e327a
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x6e32a2
cmp byte [esi + 0x1b], 0
jns 0x6e32b9
mov eax, dword [esi + 0x10]
jmp 0x6e32bc
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x6e32a5
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x6e32a5
Function at 0x6e3410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x6e346d
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.006e2ba0
test al, al
jne 0x6e344f
add edi, 0x58
cmp edi, ebx
jne 0x6e343a
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x6e3470
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x6e3484
cmp byte [edi + 0x1b], 0
jns 0x6e3492
mov eax, dword [edi + 0x10]
jmp 0x6e3495
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x6e3470
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6e3470
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x6e3470
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x6e3470
Function at 0x6f3410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6f3433
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6f3458
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x6f3450
mov eax, ebx
and eax, 0x400
jne 0x6f3466
and ebx, 0x10
shr ebx, 4
jmp 0x6f3468
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x6f347f
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.006a2ff0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a3120
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0067fe70
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x6f34c1
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x6f34e6
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x6f3508
push dword [ebp - 0xc4]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.006a3180
jmp 0x6f3466
Function at 0x6f3520
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6f3543
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x6f3569
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x6f3580
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x6f3619
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x6f3592
xor ebx, ebx
jmp 0x6f3552
call fcn.006a2ff0
lea ecx, [ebp - 0xc4]
push eax
push 2
push 0x62
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a3120
lea eax, [ebp - 0xbc]
push 0x10
push str.CreateDirectory
push eax
call fcn.0067fe70
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x6f35d1
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x6f35ed
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x6f3609
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.006a3180
jmp 0x6f358e
push 1
push edi
call fcn.006f3410
add esp, 8
test al, al
jne 0x6f3552
push 2
call fcn.005e42f0
add esp, 4
test al, al
je 0x6f358e
lea ecx, [ebp - 0xc4]
push 2
push 0x5d
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.005417e0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x6f365f
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea esi, [ebp - 0xbc]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x6f3681
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.0067fe70
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x6f36ad
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.00541c20
jmp 0x6f358e
Function at 0x6f36c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6f36e3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6f370e
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x6f3720
xor ebx, ebx
jmp 0x6f36f7
call fcn.006a2ff0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a3120
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0067fe70
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x6f375f
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x6f3784
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x6f37a6
push dword [ebp - 0xc4]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.006a3180
jmp 0x6f371c

Function at 0x6f37c0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6f37e3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6f37fb
and eax, 0x410
cmp eax, 0x410
je 0x6f383b
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6f3805
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x6f3829
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x6f3856
xor ebx, ebx
jmp 0x6f3812
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.006f38f0
call fcn.006a2ff0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a3120
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.0067fe70
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x6f3898
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x6f38bd
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x6f38df
push dword [ebp - 0xc4]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.006a3180
jmp 0x6f3837
Function at 0x6f38f0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x6f3912
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x6f392d
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x6f3949
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.006a2ff0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a3120
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.0067fe70
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x6f398c
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x6f39b1
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push dword [ebp - 0xc8]
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x6f39d8
push dword [ebp - 0xc4]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.006a3180
jmp 0x6f392d

Function at 0x703280
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0xe8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xa0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push esi
push 0x20
push dword [ebp + 0x10]
call fcn.006b2c20
add esp, 0xc
and byte [esi], 0xf8
mov al, byte [esi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
mov edi, esp
push 0xa0
push 0xff
push edi
call fcn.00650600
add esp, 0xc
push 0x79da20
push esi
push edi
call fcn.0063dc90
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, edi
call fcn.00706a50
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [ebx + 0x10], xmm1
movups xmmword [ebx], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm1
mov ecx, dword [esp + 0xe8]
xor ecx, ebp
call fcn.0064d372
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x706fd0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.006f37c0
Function at 0x70d970
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x70d9ba
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x70da60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x70dab5
push 1
call fcn.005e42f0
add esp, 4
test al, al
jne 0x70dae0
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea esi, [esp + 0xc]
mov ecx, esi
push 1
push 0x114
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.005417e0
lea eax, [esp + 0x14]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.0067fe70
add esp, 0xc
mov ecx, esi
call fcn.00541c20
jmp 0x70dab5
Function at 0x7171b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.0067fcc0
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.00719e60
test al, al
je 0x71726f
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x71729d
mov ecx, edi
call fcn.0067fcc0
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.00719e60
test al, al
je 0x7172d2
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x717304
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x717283
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x717283
push 1
call fcn.005e42f0
add esp, 4
test al, al
jne 0x71733a
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.005e42f0
add esp, 4
test al, al
je 0x717281
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.005417e0
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x71735c
push 1
call fcn.005e42f0
add esp, 4
test al, al
je 0x717281
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.005417e0
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x71735c
push 1
call fcn.005e42f0
add esp, 4
test al, al
je 0x717281
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.005417e0
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x71735c
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.005417e0
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.0067fe70
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x717372
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.0067fe70
add esp, 0xc
mov ecx, edi
call fcn.00541c20
jmp 0x717281