joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140167f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1402ae190]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2a9
call fcn.1400c0870
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400c3400
cmp byte [rdi + 0x17], 0
jns 0x140167f94
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.1400c20a0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401698b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
test r8d, r8d
jne 0x1401698e0
movabs rax, 0x100000001
mov qword [rsi], rax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov edi, r8d
mov dword [rsi], 0
test dl, 1
jne 0x140169901
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov r14d, edx
test dl, 1
je 0x1401698f0
jmp 0x140169907
movzx r14d, dx
xor ebx, ebx
bsr eax, r14d
xor eax, 0x1f
mov ecx, 0x20
sub ecx, eax
imul ecx, edi
cmp ecx, 0xde3
jg 0x1401699d9
mov ecx, 1
mov ebp, ecx
lea ecx, [rbp + rbp]
cmp ebp, edi
jle 0x140169929
xor r8d, r8d
sar ebp, 2
movzx r9d, dx
jne 0x140169991
xor ebp, ebp
mov rdx, r9
mov dword [rsi], 0
test rdx, rdx
je 0x14016996c
xor eax, eax
mov ecx, edx
and ecx, 0xfffffff
mov dword [rsi + rax*4 + 4], ecx
shr rdx, 0x1c
inc rax
test rdx, rdx
jne 0x140169951
mov word [rsi], ax
test r8b, 1
jne 0x1401699fb
test ebp, ebp
jne 0x1401699de
imul ebx, edi
mov rcx, rsi
mov edx, ebx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.1401692dc
xor r8d, r8d
mov r10d, 1
mov rdx, r9
imul rdx, rdx
test ebp, edi
jne 0x1401699b4
sar ebp, 1
je 0x140169944
mov rcx, rdx
shr rcx, 0x20
jne 0x140169944
jmp 0x14016999d
mov ecx, eax
or cl, 0x20
mov r11, rdx
shr r11, cl
test r11, r11
mov ecx, 1
cmove rcx, r9
movzx r8d, r8b
cmovne r8d, r10d
imul rdx, rcx
jmp 0x1401699a5
call fcn.140157ee2
mov rcx, rsi
call fcn.140261a6c
test ebp, edi
je 0x1401699f5
mov rcx, rsi
mov edx, r14d
call fcn.14016959e
sar ebp, 1
je 0x14016997a
jmp 0x1401699de
mov rcx, rsi
mov edx, r14d
call fcn.14016959e
jmp 0x140169976
Function at 0x14016ada0
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov ebp, dword [rsp + 0xb0]
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.WriteValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x38]
mov r9d, 0x1d9
call fcn.1400c0870
mov rcx, qword [rbx]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
mov rdx, r14
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14016b2f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, r8
xor r8d, r8d
jmp fcn.1400e5813

Function at 0x14016b318
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, r8
mov r8d, 1
jmp fcn.1400e5813

Function at 0x14016b3bc
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x2c], 0
mov rsi, qword [0x14031e330]
test rsi, rsi
jne 0x14016b4c8
lea rsi, [0x14031e340]
xor ecx, ecx
mov edx, 0x5c
mov r8, rsi
mov r9d, 0x55
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x14016b4bc
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax], xmm0
mov qword [rax + 0x4d], 0
xor ecx, ecx
movzx edx, word [rcx + rsi]
cmp dx, 0x5f
je 0x14016b4e5
mov byte [rax], dl
test dl, dl
je 0x14016b465
inc rax
add rcx, 2
cmp rcx, 0xaa
jne 0x14016b439
mov byte [rsp + 0x84], 0
mov ecx, 0x41
call fcn.1400e7ed2
test rax, rax
je 0x14016b4bc
mov rsi, rax
lea rcx, [rsp + 0x30]
lea rdi, [rsp + 0x2c]
mov rdx, rax
mov r8d, 0x40
mov r9, rdi
call fcn.14016b507
cmp dword [rdi], 0
jg 0x14016b4ed
cdqe
mov byte [rsi + rax], 0
mov qword [0x14031e330], rsi
mov byte [0x14031e3ea], 1
lea rdx, [0x14026cb20]
mov ecx, 0x17
call fcn.14015e633
mov rsi, qword [0x14031e330]
test rsi, rsi
je 0x14016b4f7
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140115e50
mov rax, rsi
add rsp, 0x98
pop rdi
pop rsi
ret
mov byte [rax], 0x2d
jmp 0x14016b44d
mov rcx, rsi
call fcn.1400fde6a
jmp 0x14016b4bc
lea rsi, str.en_US
mov qword [0x14031e330], rsi
jmp 0x14016b4c8
Function at 0x14016b5b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14016b76f
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov r15, r8
mov r12, rdx
mov esi, ecx
cmp ecx, 0xd7ff
ja 0x14016b849
mov eax, esi
shr eax, 5
mov eax, eax
lea rcx, [0x1402ed5c0]
movzx eax, word [rcx + rax*2]
mov edx, esi
and edx, 0x1f
lea rax, [rdx + rax*4]
lea rax, [rcx + rax*2]
movzx ebx, word [rax]
test bl, 8
je 0x14016b871
mov rax, rbx
shr rax, 4
lea rcx, [0x1402ec8b0]
lea r13, [rcx + rax*2]
add r13, 2
movzx edi, word [r13 - 2]
bt edi, 0xe
jb 0x14016b887
test dil, dil
js 0x14016b8ec
test dil, 0x10
je 0x14016b801
and ebx, 3
cmp ebx, 1
je 0x14016b985
test dil, 4
je 0x14016b843
mov eax, edi
and eax, 3
bt edi, 8
lea rcx, [0x1402ec4b0]
movzx eax, byte [rax + rcx]
jb 0x14016b941
movzx ecx, word [r13 + rax*2]
xor eax, eax
cmp ecx, esi
sete al
neg eax
xor eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
not esi
mov eax, esi
jmp 0x14016b832
cmp esi, 0xffff
ja 0x14016b9c6
xor eax, eax
cmp esi, 0xdc00
mov ecx, 0x140
cmovge ecx, eax
mov eax, esi
shr eax, 5
add eax, ecx
jmp 0x14016b79b
mov eax, ebx
and eax, 3
mov ecx, esi
cmp eax, 1
jne 0x14016b827
movsx ecx, bx
sar ecx, 7
add ecx, esi
jmp 0x14016b827
mov ebp, dword [rsp + 0x90]
cmp ebp, 2
jne 0x14016b89d
mov eax, 0x130
cmp esi, 0x69
je 0x14016b832
cmp ebp, 3
jne 0x14016b957
cmp esi, 0x307
jne 0x14016b957
test r12, r12
je 0x14016b7ef
mov dl, 0xff
mov rcx, r15
call r12
test eax, eax
js 0x14016b957
mov ecx, eax
call fcn.14027151b
xor edx, edx
cmp eax, 0x60
je 0x14016b8bd
cmp eax, 0x20
jne 0x14016b957
mov qword [r14], 0
xor eax, eax
jmp 0x14016b832
mov eax, edi
and eax, 0x7f
bt edi, 8
lea rcx, [0x1402ec4b0]
movzx eax, byte [rax + rcx]
lea rdx, [r13 + rax*2]
lea rcx, [r13 + rax*4 + 2]
cmovae rcx, rdx
movzx edx, word [rcx]
mov eax, edx
shr eax, 8
and eax, 0xf
je 0x14016b7ef
movzx ebp, dx
mov edx, ebp
and edx, 0xf
lea rcx, [rcx + rdx*2]
shr rbp, 3
and ebp, 0x1e
add rcx, rbp
add rcx, 2
mov qword [r14], rcx
jmp 0x14016b832
movzx edx, word [r13 + rax*4]
shl edx, 0x10
movzx ecx, word [r13 + rax*4 + 2]
or ecx, edx
jmp 0x14016b827
cmp esi, 0x587
jne 0x14016b7ef
cmp ebp, 6
lea rax, [0x1402f3648]
lea rcx, [0x1402f364e]
cmove rcx, rax
mov qword [r14], rcx
mov eax, 2
jmp 0x14016b832
mov eax, edi
and eax, 0xf
bt edi, 8
lea rcx, [0x1402ec4b0]
movzx eax, byte [rax + rcx]
jb 0x14016b9a3
movzx ecx, word [r13 + rax*2]
jmp 0x14016b9b4
movzx edx, word [r13 + rax*4]
shl edx, 0x10
movzx ecx, word [r13 + rax*4 + 2]
or ecx, edx
mov eax, ecx
neg eax
bt edi, 0xa
cmovae eax, ecx
add eax, esi
jmp 0x14016b832
cmp esi, 0x110000
jb 0x14016b9da
lea rax, [0x1402ef070]
jmp 0x14016b7b5
cmp esi, 0xe0800
jl 0x14016b9ee
lea rax, [0x1402f3640]
jmp 0x14016b7b5
mov eax, esi
shr eax, 0xb
lea rcx, [0x1402ed5c0]
movzx ecx, word [rcx + rax*2 + 0x1040]
mov eax, esi
shr eax, 5
and eax, 0x3f
jmp 0x14016b86a
Function at 0x14016bdf9
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140117f60
xor ebx, ebx
lea r14, str.PROGRAMFILES
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r14]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call r15
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14016be74
mov edx, eax
mov rcx, rdi
mov r8, rsi
call fcn.14016bea6
test al, al
jne 0x14016bea1
add rbx, 8
cmp rbx, 0x18
jne 0x14016be41
xor esi, esi
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov sil, 1
jmp 0x14016be80

Function at 0x14016c0ea
Capabilities:
Get common file path
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x250], rax
movabs rbx, 0x7fffffffffffffef
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140117f60
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [0x1402ae190]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rsi
call fcn.1401124ec
cmp rax, rbx
ja 0x14016c21d
mov rsi, rax
cmp rax, 0xb
jae 0x14016c17f
lea rdi, [rsp + 0x20]
mov byte [rdi + 0x17], sil
test rsi, rsi
jne 0x14016c1a9
jmp 0x14016c1bc
lea r14, [rsi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
call fcn.140112048
mov rdi, rax
mov qword [rsp + 0x20], rax
add rbx, 0x11
or rbx, r14
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1401178b0
mov word [rdi + rsi*2], 0
lea rdx, str.usp10.dll
lea rcx, [rsp + 0x20]
call fcn.1400ebece
cmp byte [rax + 0x17], 0
jns 0x14016c1dc
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [rsp + 0x37], 0
jns 0x14016c1f8
mov rcx, qword [rsp + 0x20]
call fcn.140112038
cmp esi, 0xffffffff
setne bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x20]
call fcn.1401573b4
int3
Function at 0x14016ca06
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x14016ca3a
mov rax, qword [r12 + 8]
test rax, rax
je 0x14016cb32
mov eax, ebx
not eax
test eax, 0x300
je 0x14016cb32
cmp edi, 2
lea rax, [0x140317840]
lea rcx, [0x140317a40]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14016cb32
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14016cb32
cmp byte [0x140317830], 0
setne al
bt ebx, 8
jb 0x14016cb32
shr ebx, 9
and ebx, 1
or bl, al
je 0x14016cb32
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x14016cb8d
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x14016cb1f
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
call fcn.14011300c
test eax, eax
je 0x14016cb51
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x14016cb01
cmp dword [rsp + 0x2c], 0
jne 0x14016cb95
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140115e50
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [rbx + rdi*2]
cmp cx, 0x5c
je 0x14016cb60
test cx, cx
jne 0x14016cb1f
lea rax, [rbx + rdi*2]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x14016cbbd
cmp dword [rsp + 0x2c], 2
jne 0x14016cbce
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x14016cbce
mov rbx, r12
jmp 0x14016cae2
cmp byte [r12 + 0x17], 0
js 0x14016cbfd
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.140148d3c
jmp 0x14016cb32
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
cmp cx, 0x5c
jne 0x14016cbe7
lea rbx, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x14016cbd4
jmp 0x14016cbea
mov rbx, rax
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
xor r15d, r15d
mov r13, rbp
jmp 0x14016cb26
mov rax, qword [r12]
jmp 0x14016cba0
Function at 0x14016d6f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x14016d72a
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r15
jbe 0x14016d786
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x14016d775
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1401178b0
mov r14, qword [rsi + 8]
add rbx, r15
mov qword [rsi + 0x10], rbx
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x14016d70f
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14016d81c
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.140112048
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, r14
je 0x14016d7f0
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea r11, [rax + r12*8]
xor edx, edx
mov rcx, qword [r14 + rdx]
mov qword [r11 + rdx], rcx
add rdx, 8
cmp rbx, rdx
jne 0x14016d7df
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbx, r10
test r15, r15
je 0x14016d70f
mov rcx, r15
call fcn.140112038
mov rbx, qword [rsi + 0x10]
jmp 0x14016d70f
call fcn.140112370
int3

Function at 0x14016d822
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14016d85f
mov rdi, rbx
mov rax, qword [r14]
mov qword [rdi - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x14016d8b1
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea rdi, [r15 + r12*8]
mov r8, r15
sub r8, rbx
je 0x14016d8a3
sub rdi, r8
mov rcx, rdi
mov rdx, rbx
call fcn.1401178b0
mov r15, qword [rsi + 0x10]
mov qword [rsi + 8], rdi
lea rax, [r15 + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14016d843
sub rax, rbx
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14016d942
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.140112048
lea rdi, [rax + r12*8]
lea r8, [rax + r13*8]
mov r9, rdi
sub r15, rbx
je 0x14016d919
lea r9, [rdi + r15]
sar r15, 3
shl r15, 3
lea r10, [rax + r12*8]
xor edx, edx
mov rcx, qword [rbx + rdx]
mov qword [r10 + rdx], rcx
add rdx, 8
cmp r15, rdx
jne 0x14016d908
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rbx, rbx
je 0x14016d843
mov rcx, rbx
call fcn.140112038
mov rdi, qword [rsi + 8]
jmp 0x14016d843
call fcn.140112370
int3
Function at 0x14016de70
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
lea rax, [0x1402acd48]
mov qword [rcx], rax
add rcx, 8
call fcn.1400d7cd0
lea rcx, [rsi + 0x10]
call fcn.1400d7cd0
xor edi, edi
mov byte [rsi + 0x18], dil
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], edi
call fcn.1400d7cd0
mov byte [rsi + 0x48], dil
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rdi
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebx, 0x3f800000
mov dword [rsi + 0xd0], ebx
mov dword [rsi + 0xd8], edi
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebx
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebx
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebx
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebx
mov qword [rsi + 0x198], rdi
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], edi
mov dword [rsi + 0x1a0], 1
lea rcx, [rsi + 0x1a8]
call fcn.14016e130
lea rcx, [rsi + 0x2f0]
movups xmmword [rsi + 0x2d8], xmm6
mov qword [rsi + 0x2e8], rdi
xor edx, edx
call fcn.1400bc270
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.1400bc270
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.1400bc270
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
mov dword [rsi + 0x328], ebx
movups xmmword [rsi + 0x330], xmm6
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x359], xmm6
movups xmmword [rsi + 0x370], xmm6
movups xmmword [rsi + 0x380], xmm6
call fcn.14000b330
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov rcx, rsi
call fcn.14016e080
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14016e06e
call fcn.1400bd020
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400bd300
mov qword [0x140315278], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14016e03d
Function at 0x14016ed90
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r12, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test r8, r8
je 0x14016ede1
cmp byte [r12 + 0x17], 0
js 0x14016efb0
xor eax, eax
mov byte [r12], al
mov byte [r12 + 0x17], al
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.140113774
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x80]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x1402ae190]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadStreamToStringWithMaxSize
lea r8, str..._.._base_files_file_util.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0xd4
call fcn.1400c0870
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400c3400
xorps xmm6, xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov dword [rbx + 0x30], 0
mov rcx, r15
call fcn.14011379c
mov ecx, eax
call fcn.14011381c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14016efc5
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov edi, 0xffff
cmovg rdi, rax
cmp rdi, r14
cmova rdi, r14
lea rbx, [rsp + 0x20]
movaps xmmword [rbx], xmm6
mov qword [rbx + 0x10], 0
inc rdi
xor esi, esi
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.1400dafc8
cmp byte [rbx + 0x17], 0
jns 0x14016eed7
mov rbx, qword [rsp + 0x20]
mov edx, 1
mov rcx, rbx
mov r8, rdi
mov r9, r15
call fcn.14011377c
test rax, rax
je 0x14016ef1f
xor esi, esi
mov ebx, 0x10000
mov rcx, r14
sub rcx, rsi
cmp rcx, rax
jb 0x14016efcf
test rsi, rsi
cmove rdi, rbx
add rsi, rax
mov rcx, r15
call fcn.1401137c4
test eax, eax
je 0x14016efd6
mov rcx, r15
call fcn.1401137f0
test eax, eax
sete dil
mov r14, rsi
test r12, r12
je 0x14016ef6b
movups xmm0, xmmword [r12]
mov rax, qword [r12 + 0x10]
mov rcx, qword [rsp + 0x30]
mov qword [r12 + 0x10], rcx
movaps xmm1, xmmword [rsp + 0x20]
movups xmmword [r12], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, r12
mov rdx, r14
xor r8d, r8d
call fcn.1400dafc8
cmp byte [rsp + 0x37], 0
js 0x14016f01a
lea rcx, [rsp + 0x80]
call fcn.1400c20a0
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [r12]
mov byte [rax], 0
mov qword [r12 + 8], 0
jmp 0x14016ede1
mov edi, 0xffff
jmp 0x14016eea2
xor edi, edi
jmp 0x14016ef30
lea rdx, [rsi + rdi]
lea r13, [rsp + 0x20]
mov rcx, r13
xor r8d, r8d
call fcn.1400dafc8
cmp byte [r13 + 0x17], 0
jns 0x14016eff6
mov r13, qword [rsp + 0x20]
add r13, rsi
mov edx, 1
mov rcx, r13
mov r8, rdi
mov r9, r15
call fcn.14011377c
test rax, rax
jne 0x14016eef6
jmp 0x14016ef1f
mov rcx, qword [rsp + 0x20]
call fcn.140112038
jmp 0x14016ef76
Function at 0x14017b16e
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x168], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14017b24a
and eax, 0xfeff
cmp eax, 6
je 0x14017b24a
mov eax, dword [0x14031afe0]
mov ecx, dword [0x140311f48]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14017b211
lea rcx, [0x14031afe0]
call fcn.1401120e4
cmp dword [0x14031afe0], 0xffffffff
jne 0x14017b211
lea rcx, [0x1402b2b3a]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.14017b2b2
mov qword [0x14031afd8], rax
lea rcx, [0x14031afe0]
call fcn.140112084
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x14031afd8]
mov esi, eax
test eax, eax
je 0x14017b257
test esi, esi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
jmp 0x14017b22d
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14017b228
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x21
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x38]
lea rdx, [0x1402d6118]
mov r8d, 0x1b
call fcn.1400ff874
mov rcx, rdi
call fcn.140183e60
jmp 0x14017b228