joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014b330
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov byte [rsp + 0x37], r8b
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x570], rax
lea r14, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1402e0d10
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14014b6a0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14047fb40]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14014b8b0
movzx eax, byte [rdi + 0x17]
test al, al
js 0x14014b3c8
and eax, 0x7f
jmp 0x14014b3cd
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14014b4a4
lea r14, [rsp + 0x58]
lea r15, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
xor r13d, r13d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1402e0d10
mov rcx, r15
mov rdx, r14
call fcn.14014b860
mov edx, dword [rsp + 0x58]
test dl, 1
jne 0x14014b4e8
mov rcx, r14
call fcn.14014b5b0
test al, al
jne 0x14014b538
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x14014b43b
mov rcx, qword [rsp + 0x40]
call r12
test eax, eax
jne 0x14014b4e1
call rbx
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, r14
call fcn.140024cf0
mov rcx, r15
mov rdx, r14
call fcn.14014b8b0
mov rcx, rdi
mov rdx, r14
call fcn.14026e210
mov rcx, r14
call fcn.14026e190
movzx eax, byte [rsp + 0x57]
test al, al
js 0x14014b493
and eax, 0x7f
jmp 0x14014b498
mov rax, qword [rsp + 0x48]
mov r13d, ebp
test rax, rax
jne 0x14014b3f4
lea rcx, [rsp + 0x40]
call fcn.14026e190
lea rcx, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
call fcn.14014b7f0
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x14014b458
cmp byte [rsp + 0x37], 0
je 0x14014b510
cmp byte [rsp + 0x57], 0
js 0x14014b4fd
lea rcx, [rsp + 0x40]
jmp 0x14014b502
mov rcx, qword [rsp + 0x40]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x14014b41c
lea rcx, [rsp + 0x58]
call fcn.14014b5b0
test al, al
jne 0x14014b524
mov edx, dword [rsp + 0x58]
jmp 0x14014b4ef
lea rcx, [rsp + 0x58]
call fcn.14014b5b0
test al, al
je 0x14014b42c
jmp 0x14014b4e1
xor ebp, ebp
cmp byte [rsp + 0x37], 0
je 0x14014b458
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov rdx, rsi
mov r8b, 1
call fcn.14014b330
mov ebp, eax
test eax, eax
jne 0x14014b458
cmp byte [rsp + 0x57], 0
jns 0x14014b575
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14014b458
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x14014b458
Function at 0x14014c300
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0x70
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [0x14047fb40]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14014423a
mov rsi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x70
pop rsi
ret
call fcn.1403815d0
xor esi, esi
jmp 0x140144224
sub rsp, 0x28
call fcn.140271210
lea rdx, str.enable_low_end_device_mode
mov rcx, rax
call fcn.140271220
test al, al
jne 0x14014c32e
cmp byte [0x14053dad8], 0
jne 0x14014c341
add rsp, 0x28
jmp 0x1401441e0
call 0x1401441e0
mov ecx, 0x20000000
cmp rax, rcx
cmovae rax, rcx
jmp 0x14014c34c
mov rax, qword [0x14053dad0]
shl rax, 0x14
add rsp, 0x28
ret
Function at 0x14014d1b0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x14014d360
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.1403008a0
movaps xmm6, xmmword [0x14047fb40]
lea r14, [rsp + 0x80]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, VarR8FromUI1
call fcn.14026d510
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14025d230
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.1402f4f90
mov ecx, eax
call fcn.1402f5d4c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14014d364
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [case.0x14012d181.0]
xor r12d, r12d
mov rcx, qword [rsp + 0x38]
add rcx, r12
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.140300520
test rax, rax
je 0x14014d303
mov r15, rax
mov rax, rdi
sub rax, r12
cmp rax, r15
jb 0x14014d36f
add r15, r12
mov rcx, rbx
call fcn.1402ffa0c
test eax, eax
je 0x14014d373
mov r12, r15
mov rcx, rbx
call fcn.1402ffa38
test eax, eax
sete bl
mov rdi, r12
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [case.0x14012d181.0]
lea rcx, [rsp + 0x80]
call fcn.14025d470
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14014d335
mov r14d, 0xffff
jmp 0x14014d2a1
xor ebx, ebx
jmp 0x14014d313
test r12, r12
mov eax, 0x10000
cmove r14, rax
lea r8, [r15 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [case.0x14012d181.0]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r12, r15
jmp 0x14014d2c6
Function at 0x14015a240
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14015a300
mov eax, dword [rsi]
mov dword [reloc.WS2_32.dll_accept], eax
test al, 1
jne 0x14015a261
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x14053dce0]
test rcx, rcx
jne 0x14015a27b
mov rcx, qword [0x14053dcb8]
test rcx, rcx
je 0x14015a29f
jmp 0x14015a2c1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14053dce0], 0
mov rcx, qword [0x14053dcb8]
test rcx, rcx
jne 0x14015a2c1
and byte [reloc.WS2_32.dll_accept], 0xfe
mov ecx, SafeArrayCopy
call fcn.1402dd130
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x14053dcb8], rax
mov rdx, qword [rsi + 8]
call fcn.14015b270
cmp dword [rsi + 0x14], 0
jne 0x14015a2e6
mov rcx, qword [0x14053dcb8]
cmp byte [rcx + 0x17], 0
jns 0x14015a2e0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.14037e7a0
Function at 0x14015ea60
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14015ea8f
call fcn.14026d530
cmp qword [rsi], r14
je 0x14015eabe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14015eafa
cmp r15, 2
jb 0x14015eab6
mov qword [rsi], r14
call fcn.14026d530
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.14024a5c0
lea rcx, [rsi + 0x20]
call fcn.1402860a0
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14015eb10
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14026d530
mov rcx, qword [rsi]
call fcn.140252540
mov qword [rsi], 0
jmp 0x14015eaa8
call fcn.14026d530
mov rcx, qword [rdi]
call fcn.140252540
mov qword [rdi], 0
jmp 0x14015eaea

Function at 0x14015f440
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x30], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
js 0x14015f472
and eax, 0x7f
jmp 0x14015f479
mov rax, qword [r8 + 8]
mov r8, qword [r8]
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], rax
test rax, rax
js 0x14015f53a
test r8, r8
jne 0x14015f49a
test rax, rax
jne 0x14015f566
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1402601b0
cmp byte [rsi + 0x17], 0
jns 0x14015f4bd
mov rsi, qword [rsp + 0x80]
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1402601b0
cmp byte [rdi + 0x17], 0
jns 0x14015f4e2
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x6f], 0
jns 0x14015f501
mov rcx, qword [rsp + 0x58]
call fcn.1402dd16c
cmp byte [rsp + 0x97], 0
jns 0x14015f518
mov rcx, qword [rsp + 0x80]
call fcn.1402dd16c
test esi, esi
setne bl
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.14032ac00
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.14032ac00
int3
Function at 0x14015f620
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x68]
mov rcx, rdi
call fcn.1402601b0
cmp byte [rdi + 0x17], 0
jns 0x14015f667
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x7f], 0
jns 0x14015f688
mov rcx, qword [rsp + 0x68]
call fcn.1402dd16c
test rsi, rsi
je 0x14015f72f
test edi, edi
je 0x14015f72f
mov ecx, edi
add rcx, rcx
call fcn.1402dd1ac
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x68]
mov rcx, r14
call fcn.1402601b0
cmp byte [r14 + 0x17], 0
jns 0x14015f6cb
mov r14, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x7f], 0
jns 0x14015f6eb
mov rcx, qword [rsp + 0x68]
call fcn.1402dd16c
mov qword [rsp + 0x30], rbx
test rbx, rbx
je 0x14015f75d
mov rcx, rbx
call fcn.140303804
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x68]
call fcn.140260610
cmp byte [rsi + 0x17], 0
js 0x14015f753
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1402dd1b4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.1402dd16c
jmp 0x14015f716
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.14032ac00
int3
Function at 0x14015fed0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14053dda0]
test rdi, rdi
jne 0x14015ff83
mov ecx, 0x50
call fcn.1402dd130
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, SafeArrayCopy
call fcn.1402dd130
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14015ffa5
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x14053dda0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14015ffd1
mov rcx, rax
call fcn.140303804
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140160000
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.14032ac00
int3
Function at 0x140160000
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1401446d0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x140160194
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x1404af3c4]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1401601cb
lea rdx, [0x1404af414]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401601b9
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x14012d181.0]
mov r14, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1401601c1
test r12d, r12d
js 0x140160236
shl r12, 3
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.1402dd130
mov rbx, rax
mov qword [rsp + 0x30], rax
add r15, rax
mov qword [rsp + 0x40], r15
xor r13d, r13d
xor r15d, r15d
mov rcx, rbx
add rcx, r13
je 0x1401601de
mov rdx, qword [r14 + r15]
call fcn.14031d9e0
add r15, 8
add r13, 0x18
cmp r12, r15
jne 0x140160102
mov r15, rbx
add r15, r13
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14015fb00
movups xmmword [rsi], xmm6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x140160156
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140160194
cmp r15, rbx
je 0x14016018c
add r15, 0xffffffffffffffe8
jmp 0x14016017a
mov rcx, qword [r15]
call fcn.1402dd16c
lea rax, [r15 - 0x18]
cmp r15, rbx
mov r15, rax
je 0x14016018c
test r15, r15
je 0x14016020a
cmp byte [r15 + 0x17], 0
jns 0x14016016e
jmp 0x140160166
mov rcx, rbx
call fcn.1402dd16c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402ddd70
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x1401600b4
xor r15d, r15d
xor ebx, ebx
jmp 0x14016012f
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1401600b1
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.14032ac00
lea rcx, [rsp + 0x30]
call fcn.14031dbc0
int3

Function at 0x140165010
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14016502a
test r8d, r8d
jne 0x140165023
call fcn.14019d770
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.140274300
Function at 0x1401660c0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [rdx], 0x10
jb 0x14016614a
mov eax, dword [rdx + 4]
cmp eax, 3
jne 0x140166148
mov rax, qword [rdx + 8]
mov rcx, rax
shl rcx, 0x20
mov qword [rsp + 0x20], 0
je 0x140166123
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14016611b
mov qword [rsp + 0x20], rbx
call fcn.14026d530
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140275110
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402ddd70
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
test eax, eax
mov dword [rsi], 0
mov qword [rsi + 8], 0
jmp 0x140166130
Function at 0x1401677f0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
sub rsp, 0x1c0
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov rax, qword [0x14053efc8]
cmp rax, 1
jbe 0x140167831
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x1c0
pop rsi
ret
lea rcx, [0x14053efc8]
call fcn.14015b750
test al, al
je 0x140167888
lea rsi, [rsp + 0x20]
mov r8d, 0x198
mov rcx, rsi
mov dl, 0xaa
call fcn.1402e0d10
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14016786d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x14053efd0]
lea rcx, [0x14053efc8]
xor r8d, r8d
mov r9, rcx
call fcn.14015b810
jmp 0x140167817
mov rax, qword [0x14053efc8]
jmp 0x140167817
Function at 0x140180420
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
lea rcx, [0x14053f1c0]
call sub.KERNEL32.dll_InitializeCriticalSection
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14052e6f8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14053f1e8], eax
add rsp, 0x28
ret
Function at 0x140189430
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r13, qword [rsp + 0xb0]
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xor r15d, r15d
test r13, r13
je 0x1401894a0
mov ecx, dword [r13 + 0x2c]
call fcn.140286340
test rax, rax
je 0x140189584
mov r12, rax
xor ecx, ecx
call fcn.140286410
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r15, r12
mov rax, qword [r13 + 0x10]
lea rcx, [0x1403d0e80]
cmp rax, rcx
jne 0x14018956e
xorps xmm0, xmm0
movups xmmword [r15 + 0x5c], xmm0
movups xmmword [r15 + 0x50], xmm0
movups xmmword [r15 + 0x40], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x20], xmm0
movaps xmm0, xmmword [0x1404eabc0]
movups xmmword [r15], xmm0
movaps xmm0, xmmword [0x1404eabd0]
movups xmmword [r15 + 0x10], xmm0
mov dword [r15 + 0x6c], 0x20
mov rax, qword [r13 + 0x18]
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call qword [case.0x14012d181.0]
mov rax, qword [r15]
mov rax, qword [rax + 0x20]
mov rcx, r15
mov rdx, rdi
call qword [case.0x14012d181.0]
mov rax, qword [r15]
test rsi, rsi
je 0x140189527
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x28]
call fcn.140286450
mov r15d, 1
mov rcx, qword [rsp + 0x28]
call fcn.140286410
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x140189588
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402ddd70
mov eax, r15d
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x20]
mov rcx, r15
call qword [case.0x14012d181.0]
mov r13, qword [r15]
jmp 0x1401894ef
xor ecx, ecx
jmp 0x14018953f
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
call qword [case.0x14012d181.0]
jmp 0x14018954e

Function at 0x1401895f0
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x140189622
mov ecx, dword [rdi + 0x2c]
call fcn.140286340
test rax, rax
je 0x140189681
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.140286410
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, qword [rdi + 0x10]
lea rcx, [0x1403d0e80]
cmp rax, rcx
jne 0x140189676
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1404eabc0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1404eabd0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [case.0x14012d181.0]
jmp 0x140189669
xor eax, eax
jmp 0x14018966e
Function at 0x140189720
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x140189757
mov rcx, qword [rsp + 0x80]
mov rdx, r9
call fcn.1401c17a0
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14018986a
mov ebp, dword [rsp + 0x88]
lea rcx, [0x14053f508]
lea rdx, [0x14018db30]
call fcn.14029bef0
lea rax, [0x14053f510]
mov qword [rdi + 0x18], rax
mov rcx, qword [rdi + 0x10]
cmp ebp, 1
jne 0x14018986e
call fcn.1401c1aa0
test eax, eax
je 0x14018986a
test rbx, rbx
je 0x1401897af
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.1401a0040
test eax, eax
je 0x14018986a
mov rax, qword [rdi + 0x10]
mov rax, qword [rax]
test ebp, ebp
je 0x140189878
add rax, 0x38
cmp qword [rax], 0
je 0x140189841
test rbx, rbx
je 0x140189881
cmp qword [rdi], rbx
je 0x1401897fa
mov ecx, dword [rbx + 0x2c]
call fcn.140286340
test rax, rax
je 0x14018986a
mov r14, rax
mov rcx, qword [rdi + 8]
call fcn.140286410
mov qword [rdi + 8], r14
mov qword [rdi], rbx
mov rax, qword [rbx + 0x10]
lea rcx, [0x1403d0e80]
cmp rax, rcx
jne 0x14018985f
mov rax, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1404eabc0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1404eabd0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov ebx, 1
test rsi, rsi
je 0x140189852
mov rax, qword [rdi + 0x10]
mov qword [rsi], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call qword [case.0x14012d181.0]
jmp 0x140189841
xor ebx, ebx
jmp 0x140189852
call fcn.140406980
jmp 0x14018978e
add rax, 0x28
jmp 0x1401897c2
mov dword [rsp + 0x20], WSACleanup
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestsigndigestsign.c
xor ebx, ebx
mov ecx, 6
xor edx, edx
mov r8d, 0x77
call fcn.140406810
jmp 0x140189852