joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bb1a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 7
jbe 0x14002bb44
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002bb5c
test eax, 0x410
sete al
jmp 0x14002bc07
call fcn.1400078ab
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_base::FilePath__
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rdi, [rbp - 0x50]
mov rcx, rdi
mov r9d, 0x75
call fcn.1400078c2
lea rdx, str.GetFileAttributes
mov rcx, rdi
call fcn.1400035ea
mov rdi, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14002bbac
mov rax, qword [rsi]
lea rdx, [rbp + 0xb8]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rbp + 0xc8]
mov rcx, rsi
call fcn.14001d6fb
mov r8, qword [rbp + 0xd8]
cmp qword [rbp + 0xe0], 0xf
jbe 0x14002bbe5
mov rsi, qword [rbp + 0xc8]
mov rcx, rdi
mov rdx, rsi
call fcn.14000468b
lea rcx, [rbp + 0xc8]
call fcn.140005a44
lea rcx, [rbp - 0x50]
call fcn.1400078f2
xor eax, eax
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002bc78
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 7
jbe 0x14002bca2
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002bcc6
and eax, 0x410
cmp eax, 0x410
jne 0x14002bcc6
mov rcx, rsi
call fcn.14002be01
jmp 0x14002bd90
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14002bcd3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x14002bd90
call fcn.1400078ab
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_base::FilePath__
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rdi, [rbp - 0x50]
mov rcx, rdi
mov r9d, 0x95
call fcn.1400078c2
lea rdx, str.DeleteFile
mov rcx, rdi
call fcn.1400035ea
mov rdi, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14002bd35
mov rax, qword [rsi]
lea rdx, [rbp + 0xb8]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rbp + 0xc8]
mov rcx, rsi
call fcn.14001d6fb
mov r8, qword [rbp + 0xd8]
cmp qword [rbp + 0xe0], 0xf
jbe 0x14002bd6e
mov rsi, qword [rbp + 0xc8]
mov rcx, rdi
mov rdx, rsi
call fcn.14000468b
lea rcx, [rbp + 0xc8]
call fcn.140005a44
lea rcx, [rbp - 0x50]
call fcn.1400078f2
xor eax, eax
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002be01
Capabilities:
Delete directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov rdi, rcx
cmp qword [rcx + 0x18], 7
jbe 0x14002be2c
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x14002bee5
call fcn.1400078ab
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::LoggingRemoveDirectoryImpl_const_base::FilePath__
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rbx, [rbp - 0x48]
mov rcx, rbx
mov r9d, 0x30
call fcn.1400078c2
lea rdx, str.RemoveDirectory
mov rcx, rbx
call fcn.1400035ea
mov rbx, rax
cmp qword [rdi + 0x18], 7
mov rax, rdi
jbe 0x14002be8c
mov rax, qword [rdi]
lea rdx, [rbp + 0xc0]
mov qword [rdx], rax
mov rax, qword [rdi + 0x10]
mov qword [rdx + 8], rax
lea rdi, [rbp + 0xd0]
mov rcx, rdi
call fcn.14001d6fb
mov r8, qword [rbp + 0xe0]
cmp qword [rbp + 0xe8], 0xf
jbe 0x14002bec5
mov rdi, qword [rbp + 0xd0]
mov rcx, rbx
mov rdx, rdi
call fcn.14000468b
lea rcx, [rbp + 0xd0]
call fcn.140005a44
lea rcx, [rbp - 0x48]
call fcn.1400078f2
test esi, esi
setne al
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140030872
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov r14, r9
mov r15, rdx
mov r13, rcx
mov r12, qword [rbp + 0x70]
mov rax, qword [rcx]
mov rbx, qword [rax + 8]
cmp byte [rbx + 0x19], 0
je 0x1400308b2
mov qword [rbp - 0x10], rax
mov rsi, rax
jmp 0x1400308ee
mov ecx, dword [r14]
mov rsi, rbx
mov ebx, dword [rbx + 0x20]
xor edi, edi
cmp ebx, ecx
setae dil
xor edx, edx
cmp ecx, ebx
setb dl
test r8b, r8b
cmovne edx, edi
mov ebx, edx
xor bl, 1
movzx ebx, bl
shl rbx, 4
mov rbx, qword [rsi + rbx]
cmp byte [rbx + 0x19], 0
je 0x1400308b5
mov qword [rbp - 0x10], rsi
test dl, dl
je 0x140030929
cmp rsi, qword [rax]
je 0x140030907
lea rdi, [rbp - 0x10]
mov rcx, rdi
call fcn.140004370
mov r8b, 1
mov rax, qword [rdi]
jmp 0x14003092f
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 8]
mov rcx, r13
mov r8b, 1
mov r9, rsi
mov qword [rbp - 0x18], r13
call fcn.1400306f2
jmp 0x140030954
xor r8d, r8d
mov rax, rsi
mov eax, dword [rax + 0x20]
cmp eax, dword [r14]
jae 0x140030962
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 8]
mov rcx, r13
mov r9, rsi
mov qword [rbp - 0x18], r13
call fcn.1400306f2
mov rax, qword [rbp - 8]
mov qword [r15], rax
mov byte [r15 + 8], 1
jmp 0x14003097b
mov edx, 0x30
mov rcx, r12
call fcn.1400b72ac
mov rax, qword [rbp - 0x10]
mov qword [r15], rax
mov byte [r15 + 8], 0
mov rax, r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140030eec
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov r14, r9
mov r15, rdx
mov r13, rcx
mov r12, qword [rbp + 0x70]
mov rax, qword [rcx]
mov rbx, qword [rax + 8]
cmp byte [rbx + 0x19], 0
je 0x140030f2c
mov qword [rbp - 0x10], rax
mov rsi, rax
jmp 0x140030f68
mov ecx, dword [r14]
mov rsi, rbx
mov ebx, dword [rbx + 0x1c]
xor edi, edi
cmp ebx, ecx
setae dil
xor edx, edx
cmp ecx, ebx
setb dl
test r8b, r8b
cmovne edx, edi
mov ebx, edx
xor bl, 1
movzx ebx, bl
shl rbx, 4
mov rbx, qword [rsi + rbx]
cmp byte [rbx + 0x19], 0
je 0x140030f2f
mov qword [rbp - 0x10], rsi
test dl, dl
je 0x140030fa3
cmp rsi, qword [rax]
je 0x140030f81
lea rdi, [rbp - 0x10]
mov rcx, rdi
call fcn.140004370
mov r8b, 1
mov rax, qword [rdi]
jmp 0x140030fa9
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 8]
mov rcx, r13
mov r8b, 1
mov r9, rsi
mov qword [rbp - 0x18], r13
call fcn.14003103a
jmp 0x140030fce
xor r8d, r8d
mov rax, rsi
mov eax, dword [rax + 0x1c]
cmp eax, dword [r14]
jae 0x140030fdc
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 8]
mov rcx, r13
mov r9, rsi
mov qword [rbp - 0x18], r13
call fcn.14003103a
mov rax, qword [rbp - 8]
mov qword [r15], rax
mov byte [r15 + 8], 1
jmp 0x140030ff5
mov edx, 0x28
mov rcx, r12
call fcn.1400b72ac
mov rax, qword [rbp - 0x10]
mov qword [r15], rax
mov byte [r15 + 8], 0
mov rax, r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400311ee
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov r14, r9
mov r15, rdx
mov r13, rcx
mov r12, qword [rbp + 0x70]
mov rax, qword [rcx]
mov rbx, qword [rax + 8]
cmp byte [rbx + 0x19], 0
je 0x14003122e
mov qword [rbp - 0x10], rax
mov rsi, rax
jmp 0x14003126a
mov ecx, dword [r14]
mov rsi, rbx
mov ebx, dword [rbx + 0x20]
xor edi, edi
cmp ebx, ecx
setae dil
xor edx, edx
cmp ecx, ebx
setb dl
test r8b, r8b
cmovne edx, edi
mov ebx, edx
xor bl, 1
movzx ebx, bl
shl rbx, 4
mov rbx, qword [rsi + rbx]
cmp byte [rbx + 0x19], 0
je 0x140031231
mov qword [rbp - 0x10], rsi
test dl, dl
je 0x1400312a5
cmp rsi, qword [rax]
je 0x140031283
lea rdi, [rbp - 0x10]
mov rcx, rdi
call fcn.140004370
mov r8b, 1
mov rax, qword [rdi]
jmp 0x1400312ab
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 8]
mov rcx, r13
mov r8b, 1
mov r9, rsi
mov qword [rbp - 0x18], r13
call fcn.14003133a
jmp 0x1400312d0
xor r8d, r8d
mov rax, rsi
mov eax, dword [rax + 0x20]
cmp eax, dword [r14]
jae 0x1400312de
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 8]
mov rcx, r13
mov r9, rsi
mov qword [rbp - 0x18], r13
call fcn.14003133a
mov rax, qword [rbp - 8]
mov qword [r15], rax
mov byte [r15 + 8], 1
jmp 0x1400312f5
mov rcx, r13
mov rdx, r12
call fcn.14003149c
mov rax, qword [rbp - 0x10]
mov qword [r15], rax
mov byte [r15 + 8], 0
mov rax, r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14003c550
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r15, r9
mov r12, rdx
mov r14, rcx
mov r9, qword [rcx]
mov rdi, qword [r9 + 8]
cmp byte [rdi + 0x19], 0
je 0x14003c58a
mov qword [rbp - 0x18], r9
mov rbx, r9
jmp 0x14003c5c5
mov ecx, dword [r15]
mov rbx, rdi
mov edi, dword [rdi + 0x1c]
xor esi, esi
cmp edi, ecx
setae sil
xor edx, edx
cmp ecx, edi
setb dl
test r8b, r8b
cmovne edx, esi
mov eax, edx
xor al, 1
movzx eax, al
shl rax, 4
mov rdi, qword [rbx + rax]
cmp byte [rdi + 0x19], 0
je 0x14003c58d
mov qword [rbp - 0x18], rbx
test dl, dl
je 0x14003c5f7
cmp rbx, qword [r9]
je 0x14003c5de
lea rdi, [rbp - 0x18]
mov rcx, rdi
call fcn.140004370
mov r8b, 1
mov rax, qword [rdi]
jmp 0x14003c5fd
mov qword [rsp + 0x20], r15
lea rdx, [rbp - 0x10]
mov rcx, r14
mov r8b, 1
mov r9, rbx
call fcn.14003c668
jmp 0x14003c619
xor r8d, r8d
mov rax, rbx
mov ecx, dword [rax + 0x1c]
cmp ecx, dword [r15]
jae 0x14003c629
mov qword [rsp + 0x20], r15
lea rdx, [rbp - 0x10]
mov rcx, r14
mov r9, rbx
call fcn.14003c668
mov rax, qword [rbp - 0x10]
mov qword [r12], rax
mov byte [r12 + 8], 1
jmp 0x14003c633
mov qword [r12], rax
mov byte [r12 + 8], 0
mov rax, r12
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x14003cf8f
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], 0xfffffffffffffffe
test rdx, rdx
je 0x14003d042
mov rsi, rdx
mov rdi, rcx
mov r15d, 0xffffffff
lea rbx, [rbp - 0x50]
lea r12, str.Check_failed:_success
lea r13, [0x1401301f3]
cmp rsi, r15
mov r14d, 0xffffffff
cmovb r14, rsi
mov rcx, rdi
mov edx, r14d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14003d03a
mov dword [rsp + 0x20], 4
mov rcx, rbx
lea rdx, str.void___cdecl_base::RandBytes_void___size_t_
lea r8, str.xplat_third_partycrashpad_third_partymini_chromiummini_chromium_base_rand_util.cc
mov r9d, 0x7d
call fcn.1400067ee
mov rcx, rbx
mov rdx, r12
call fcn.1400035ea
mov rcx, rax
mov rdx, r13
call fcn.1400035ea
mov rcx, rbx
call fcn.140006ed2
add rdi, r14
sub rsi, r14
jne 0x14003cfdc
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14003d4d4
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
sub rsp, 0x148
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc0], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14003d5b8]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
jne 0x14003d588
call fcn.1400078ab
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 4
lea rdx, str.void___cdecl_crashpad::Thread::Start_void_
lea r8, str.xplat_third_partycrashpadutil_thread_thread_win.cc
lea rsi, [rbp - 0x48]
mov rcx, rsi
mov r9d, 0x1b
call fcn.1400078c2
lea rdx, str.Check_failed:_platform_thread_
mov rcx, rsi
call fcn.1400035ea
lea rdx, [0x1401301f3]
mov rcx, rax
call fcn.1400035ea
lea rdx, [0x140126a54]
mov rcx, rax
call fcn.1400035ea
lea rcx, [rbp - 0x48]
call fcn.1400078f2
nop
add rsp, 0x148
pop rsi
pop rbp
ret

Function at 0x140040544
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
test r8, r8
je 0x140040582
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x10], 0
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x14004058f
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400405c5
mov esi, eax
mov rcx, rbx
mov edx, eax
call fcn.140040f30
mov r15d, eax
bt esi, 0xa
jb 0x1400405d8
test sil, 0x10
jne 0x14004068b
mov dword [r14], 2
jmp 0x14004069b
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140040df5
jmp 0x14004069f
mov rcx, rbx
call fcn.140041190
test al, al
je 0x140040694
cmp qword [rbx + 0x18], 7
mov r13, rbx
jbe 0x1400405f5
mov r13, qword [rbx]
movaps xmm0, xmmword [0x1400fc010]
lea r12, [rbp - 0x40]
movups xmmword [r12 + 0x10], xmm0
mov word [r12], 0
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, r12
mov rdx, r13
mov r8, rax
call fcn.14000c3e8
cmp qword [r12 + 0x18], 7
jbe 0x14004062f
mov r12, qword [rbp - 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, r12
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
lea rcx, [rbp - 0x40]
call fcn.140005a80
cmp r12, 0xffffffffffffffff
mov qword [rbp - 8], r12
je 0x1400406b6
lea rdx, [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov r12d, eax
test eax, eax
je 0x1400406c6
mov esi, dword [rbp - 0x40]
jmp 0x1400406d4
mov dword [r14], 3
jmp 0x14004069b
mov dword [r14], 9
mov dword [r14 + 4], r15d
mov rax, r14
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140040df5
jmp 0x14004069f
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140040df5
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
jne 0x1400405af
jmp 0x14004069f
Function at 0x1400408f3
Capabilities:
Create directory

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rsi, r8
mov rdi, rcx
mov rax, qword [0x14017eea0]
xor rax, rbp
mov qword [rbp], rax
test r8, r8
je 0x14004092a
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov dword [rsi + 0x10], 0
cmp qword [rdi + 0x18], 7
mov rax, rdi
jbe 0x140040937
mov rax, qword [rdi]
test rdx, rdx
je 0x140040957
cmp qword [rdx + 0x18], 8
jb 0x140040946
mov rdx, qword [rdx]
mov rcx, rdx
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x140040962
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1400409ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
xorps xmm0, xmm0
lea r8, [rbp - 0x20]
movaps xmmword [r8], xmm0
mov dword [r8 + 0x10], 0
lea r15, [rbp - 8]
mov rcx, r15
mov rdx, rdi
call fcn.140040544
cmp dword [r15], 3
je 0x1400409ae
lea r9, str.boost::filesystem::create_directory
mov ecx, r14d
mov rdx, rdi
mov r8, rsi
call fcn.140071d40
test ebx, ebx
setne bl
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400b72d0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x140048e81
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rsi, r8
mov rax, qword [0x14017eea0]
xor rax, rbp
mov qword [rbp], rax
lea rax, [rbp - 0xc]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea rdi, [rbp - 4]
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140048ed8
mov eax, dword [rbp - 8]
mov dword [rsi], eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400b72d0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140048f8e
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
lea rsi, [rbp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsi + 0x20]
cmp ecx, 0x100
jb 0x14004900b
mov dword [rsp + 0x20], 1
lea rdx, str.virtual_uint8_t___cdecl_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea r8, str.xplat_third_partycrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rbp - 0x50]
mov rcx, rsi
mov r9d, 0x10a
call fcn.1400067ee
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov rcx, rsi
call fcn.1400035ea
lea rcx, [rbp - 0x50]
call fcn.140006ed2
mov ecx, dword [rbp + 0xd0]
cmp ecx, 0x100
mov eax, 0xff
cmovb eax, ecx
add rsp, 0x168
pop rsi
pop rbp
ret
Function at 0x14005d7b6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r12, r9
mov r15, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
mov rcx, r8
jbe 0x14005d7f0
mov rcx, qword [r15]
test rax, rax
je 0x14005d823
movabs rsi, 0xcbf29ce484222325
xor edx, edx
movabs rdi, 0x100000001b3
movzx ebx, byte [rcx + rdx]
xor rbx, rsi
imul rbx, rdi
inc rdx
mov rsi, rbx
cmp rax, rdx
jne 0x14005d80b
jmp 0x14005d82d
movabs rbx, 0xcbf29ce484222325
and rbx, qword [r13 + 0x30]
lea rdi, [rbx + rbx]
mov rsi, qword [r13 + 8]
mov rax, qword [r13 + 0x18]
mov rcx, rbx
shl rcx, 4
cmp qword [rax + rcx], rsi
je 0x14005d85d
lea rcx, [rdi*8]
or rcx, 8
mov rcx, qword [rax + rcx]
mov rsi, qword [rcx]
cmp rsi, qword [rax + rdi*8]
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r13
je 0x14005d889
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
mov rcx, r15
call fcn.1400473f2
test al, al
jne 0x14005d8de
mov rax, qword [r13 + 0x18]
cmp rsi, qword [rax + rdi*8]
jne 0x14005d86b
mov rax, qword [r12]
cmp rsi, rax
je 0x14005d8ba
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], r12
mov qword [rsi + 8], rcx
mov rcx, qword [r12 + 8]
mov qword [rax + 8], rcx
mov qword [r12 + 8], rdx
mov rcx, r13
mov rdx, r12
mov r8, rsi
mov r9, rbx
call fcn.14005da90
mov rcx, r13
call fcn.14005daf2
mov rax, qword [rbp - 8]
mov qword [r14], rax
mov al, 1
jmp 0x14005d907
mov rax, qword [r12]
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rax, qword [r12]
mov qword [rax + 8], rcx
lea rcx, [r13 + 8]
dec qword [r13 + 0x10]
mov rdx, r12
call fcn.14005d2c0
mov qword [r14], rsi
xor eax, eax
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14005dd60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [r8 + 0x20]
cmp qword [r8 + 0x28], 0xf
jbe 0x14005dd8b
mov rcx, qword [rdi + 0x10]
jmp 0x14005dd8f
lea rcx, [rdi + 0x10]
test rax, rax
je 0x14005ddc3
movabs rbx, 0xcbf29ce484222325
xor edx, edx
movabs rsi, 0x100000001b3
movzx r8d, byte [rcx + rdx]
xor r8, rbx
imul r8, rsi
inc rdx
mov rbx, r8
cmp rax, rdx
jne 0x14005ddaa
jmp 0x14005ddcd
movabs r8, 0xcbf29ce484222325
and r8, qword [r15 + 0x30]
mov rcx, r15
mov rdx, rdi
call fcn.14005de14
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rsi
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
dec qword [r15 + 0x10]
add r15, 8
mov rcx, r15
mov rdx, rdi
call fcn.14005d2c0
mov qword [r14], rsi
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x14005f10e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r12, r9
mov r15, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
mov rcx, r8
jbe 0x14005f148
mov rcx, qword [r15]
test rax, rax
je 0x14005f17b
movabs rsi, 0xcbf29ce484222325
xor edx, edx
movabs rdi, 0x100000001b3
movzx ebx, byte [rcx + rdx]
xor rbx, rsi
imul rbx, rdi
inc rdx
mov rsi, rbx
cmp rax, rdx
jne 0x14005f163
jmp 0x14005f185
movabs rbx, 0xcbf29ce484222325
and rbx, qword [r13 + 0x30]
lea rdi, [rbx + rbx]
mov rsi, qword [r13 + 8]
mov rax, qword [r13 + 0x18]
mov rcx, rbx
shl rcx, 4
cmp qword [rax + rcx], rsi
je 0x14005f1b5
lea rcx, [rdi*8]
or rcx, 8
mov rcx, qword [rax + rcx]
mov rsi, qword [rcx]
cmp rsi, qword [rax + rdi*8]
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r13
je 0x14005f1e1
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
mov rcx, r15
call fcn.1400473f2
test al, al
jne 0x14005f236
mov rax, qword [r13 + 0x18]
cmp rsi, qword [rax + rdi*8]
jne 0x14005f1c3
mov rax, qword [r12]
cmp rsi, rax
je 0x14005f212
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], r12
mov qword [rsi + 8], rcx
mov rcx, qword [r12 + 8]
mov qword [rax + 8], rcx
mov qword [r12 + 8], rdx
mov rcx, r13
mov rdx, r12
mov r8, rsi
mov r9, rbx
call fcn.14005da90
mov rcx, r13
call fcn.14005f48c
mov rax, qword [rbp - 8]
mov qword [r14], rax
mov al, 1
jmp 0x14005f25f
mov rax, qword [r12]
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rax, qword [r12]
mov qword [rax + 8], rcx
lea rcx, [r13 + 8]
dec qword [r13 + 0x10]
mov rdx, r12
call fcn.14005e1aa
mov qword [r14], rsi
xor eax, eax
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14005f5ca
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [r8 + 0x20]
cmp qword [r8 + 0x28], 0xf
jbe 0x14005f5f5
mov rcx, qword [rdi + 0x10]
jmp 0x14005f5f9
lea rcx, [rdi + 0x10]
test rax, rax
je 0x14005f62d
movabs rbx, 0xcbf29ce484222325
xor edx, edx
movabs rsi, 0x100000001b3
movzx r8d, byte [rcx + rdx]
xor r8, rbx
imul r8, rsi
inc rdx
mov rbx, r8
cmp rax, rdx
jne 0x14005f614
jmp 0x14005f637
movabs r8, 0xcbf29ce484222325
and r8, qword [r15 + 0x30]
mov rcx, r15
mov rdx, rdi
call fcn.14005de14
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rsi
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
dec qword [r15 + 0x10]
add r15, 8
mov rcx, r15
mov rdx, rdi
call fcn.14005e1aa
mov qword [r14], rsi
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret