joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010df90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x14010dfb7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010dfcd
test eax, 0x410
sete sil
jmp 0x14010e02c
cmp dword [0x1401d3120], 2
jg 0x14010e02a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.140073fd0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140027941
mov rcx, rax
mov rdx, rsi
call fcn.140065fe0
mov rcx, rdi
call fcn.140074160
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x14010e048
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x14010e06f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010e0a7
and eax, 0x410
cmp eax, 0x410
jne 0x14010e0a7
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14014c9b0
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.14010e13b
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14010e0b3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14010e11f
cmp dword [0x1401d3120], 2
jg 0x14010e11d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.140073fd0
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140027941
mov rcx, rax
mov rdx, rsi
call fcn.140065fe0
mov rcx, rdi
call fcn.140074160
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14014c9b0
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x14010e13b
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14010e163
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x14010e1cc
cmp dword [0x1401d3120], 2
jg 0x14010e1cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.140073fd0
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140027941
mov rcx, rax
mov rdx, rsi
call fcn.140065fe0
mov rcx, rbx
call fcn.140074160
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x14010ea3c
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14010ea88
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
jne 0x14010ea8f
int3
mov rsi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14010eaa6
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14010eb40
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14010eb54
mov rcx, rdi
call r15
cmp eax, 3
jne 0x14010eb79
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x14010eb09
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14010eb5b
cmp eax, 0xffffffff
je 0x14010eb7f
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [rsp + 0x2c]
jmp 0x14010eb59
int3

Function at 0x14010f1d7
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14010f100
test rax, rax
jne 0x14010f26a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x14010f26a
cmp dword [0x1401d3120], 2
jg 0x14010f268
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.140073fd0
lea rcx, [rsp + 0x40]
lea rdx, [0x1401ad64f]
mov r8d, 0xc
call fcn.140027941
mov rcx, rsi
call fcn.140074160
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
Function at 0x140115e4a
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x140115f9d
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.14014ead0
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x140115fa4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x18
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x140116037
mov eax, dword [0x1401d9d10]
mov ecx, dword [0x1401d0348]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140116001
mov rax, qword [0x1401d9d08]
test rax, rax
lea rcx, [0x1401ade5c]
cmovne rcx, rax
lea rbx, [rsp + 0x40]
mov qword [rbx + 8], rcx
mov dword [rbx + 0x10], 1
jmp 0x140115fa4
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x140115fad
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401d9d10]
call fcn.14014b600
cmp dword [0x1401d9d10], 0xffffffff
jne 0x140115f76
call fcn.14011603b
mov qword [0x1401d9d08], rax
lea rcx, [0x1401d9d10]
call fcn.14014b698
jmp 0x140115f76
int3

Function at 0x14011627c
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140116340]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1401162d7
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014c9b0
nop
add rsp, 0x68
pop rdi
pop rsi
ret
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, 0x1b
call fcn.1400763c0
lea rdx, [0x14019970c]
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov r8, rsi
call fcn.140081390
mov rcx, qword [rdi]
add rcx, 0x10
lea rdx, [0x1401ab490]
mov r8d, 0xc
call fcn.140027941
mov rcx, rdi
call fcn.140081450
jmp 0x1401162c2
Function at 0x14011e9a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x1401d9dc0]
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14011e9d7
cmp byte [0x1401d9dc8], 0
je 0x14011e9ec
mov rax, qword [0x1401d9dd8]
jmp 0x14011ea4c
lea rcx, [0x1401d9dc0]
call fcn.1400b5960
cmp byte [0x1401d9dc8], 0
jne 0x14011e9ce
movabs rsi, 0xaaaaaaaaaaaaaaaa
xorps xmm0, xmm0
movups xmmword [0x1401d9dd0], xmm0
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14011eaa8
mov rax, qword [rsp + 0x20]
mov qword [0x1401d9dd0], rax
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14011eaab
mov rax, qword [rsp + 0x20]
mov byte [0x1401d9dc8], 1
lea rcx, [0x1401d9dc0]
mov rdx, qword [0x1401d9dd0]
mov qword [0x1401d9dd0], rax
mov rsi, rdx
shl rsi, 0x17
xor rsi, rdx
mov rdx, rax
shr rdx, 0x1a
xor rdx, rax
xor rdx, rsi
shr rsi, 0x11
xor rsi, rdx
mov qword [0x1401d9dd8], rsi
add rsi, rax
shr rsi, 0x20
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0x30
pop rsi
ret
int3
int3
Function at 0x140126190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r9
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r13, qword [rsp + 0x90]
lea rsi, [rcx + 0x978]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x1401261d1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rbp, qword [rdi + 0x968]
test rbp, rbp
je 0x140126275
lea rax, [rdi + 0x30]
xor ecx, ecx
mov rdx, rbx
shr rdx, 0x20
jmp 0x14012620c
test dl, dl
setne r9b
xor r9b, r8b
je 0x140126258
nop dword [rax + rax]
inc rcx
add rax, 0x30
cmp rbp, rcx
je 0x140126275
cmp rcx, 0x32
je 0x14012638e
cmp qword [rax - 0x20], r15
jne 0x140126200
movzx r8d, byte [rax - 0x10]
movzx r9d, byte [r14 + 8]
test r8b, r8b
je 0x140126240
test r9b, r9b
je 0x140126240
mov r8, qword [rax - 0x18]
cmp r8, qword [r14]
jne 0x140126200
jmp 0x140126245
cmp r8b, r9b
jne 0x140126200
movzx r8d, byte [rax - 4]
test dl, dl
je 0x1401261f0
test r8b, r8b
je 0x1401261f0
cmp dword [rax - 8], ebx
jne 0x140126200
mov qword [rax], r13
mov cl, 1
xchg byte [rax - 0x28], cl
test cl, 1
jne 0x140126374
dec qword [rdi + 0x970]
jmp 0x140126374
mov rax, qword [rdi + 0x970]
test rax, rax
je 0x140126335
mov ecx, 0x32
sub rcx, rbp
cmp rax, rcx
jb 0x140126335
lea r12, [rdi + 0x980]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140126335
mov rax, rbp
dec rax
je 0x140126320
lea rcx, [rdi + 8]
xor edx, edx
jmp 0x1401262c8
inc rdx
cmp rdx, rax
jae 0x140126325
cmp rax, 0x32
jae 0x140126391
lea r8, [rdx + rdx*2]
shl r8, 4
add r8, rcx
movzx r9d, byte [r8]
test r9b, 1
jne 0x1401262c0
lea r9, [rax + rax*2]
shl r9, 4
add r9, rcx
movzx r10d, byte [r9]
test r10b, 1
je 0x140126313
mov r10, qword [r9 + 8]
mov qword [r8 + 8], r10
mov r9, qword [r9 + 0x28]
mov qword [r8 + 0x28], r9
mov byte [r8], 1
inc rdx
dec rax
dec rbp
cmp rdx, rax
jb 0x1401262c8
jmp 0x140126325
mov ebp, 1
mov qword [rdi + 0x968], rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rax, [rdi + 8]
cmp rbp, 0x32
je 0x140126374
jae 0x140126394
lea rcx, [rbp*2]
add rcx, rbp
shl rcx, 4
mov qword [rax + rcx + 8], r15
movups xmm0, xmmword [r14]
movups xmmword [rax + rcx + 0x10], xmm0
mov qword [rax + rcx + 0x20], rbx
mov qword [rax + rcx + 0x28], r13
mov byte [rax + rcx], 1
lock inc qword [rdi + 0x968]
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
int3
int3
int3
Function at 0x140129a12
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140129a72
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x140129b30
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1401940a0]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x20]
cmp eax, 0x100
jb 0x140129bcf
cmp dword [0x1401d3120], 1
jg 0x140129bcf
cmp dword [0x1401c3550], 0
je 0x140129bcf
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x10a
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.140027941
mov rcx, rsi
call fcn.140073340
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
Function at 0x140140302
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401940a0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140026734
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1401492f0
test al, al
je 0x1401403d3
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140140423
mov rcx, r14
call fcn.140026734
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rdi
call fcn.1401492f0
test al, al
je 0x1401404b5
cmp dword [rdi], 0x4550
jne 0x1401404fa
mov dil, 1
test rbx, rbx
je 0x140140494
mov qword [rbx], r14
jmp 0x140140494
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x140140494
cmp dword [0x1401c3550], 0
je 0x140140494
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x140140469
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x140140494
cmp dword [0x1401c3550], 0
je 0x140140494
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
call fcn.140027941
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14014047f
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140027941
mov rcx, rdi
call fcn.140073340
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14014c9b0
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x140140494
cmp dword [0x1401c3550], 0
je 0x140140494
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14014041b
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x140140494
cmp dword [0x1401c3550], 0
je 0x140140494
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140140469
Function at 0x140140546
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401940a0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140026734
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1401492f0
test al, al
je 0x140140617
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140140667
mov rcx, r14
call fcn.140026734
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rdi
call fcn.1401492f0
test al, al
je 0x1401406f9
cmp dword [rdi], 0x4550
jne 0x14014073e
mov dil, 1
test rbx, rbx
je 0x1401406d8
mov qword [rbx], r14
jmp 0x1401406d8
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x1401406d8
cmp dword [0x1401c3550], 0
je 0x1401406d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x1401406ad
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x1401406d8
cmp dword [0x1401c3550], 0
je 0x1401406d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
call fcn.140027941
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401406c3
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140027941
mov rcx, rdi
call fcn.140073340
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14014c9b0
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x1401406d8
cmp dword [0x1401c3550], 0
je 0x1401406d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14014065f
xor edi, edi
cmp dword [0x1401d3120], 1
jg 0x1401406d8
cmp dword [0x1401c3550], 0
je 0x1401406d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140072e00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1401406ad
Function at 0x140148dea
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x98]
mov edx, dword [rsp + 0x90]
mov rcx, qword [0x1401c1028]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.14002873e
mov rbx, qword [rbx]
lea rax, [rbx + 1]
cmp rax, 1
ja 0x140148e66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140148e9d
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea esi, [rcx + rcx*4]
lea rcx, [rsp + 0x38]
call fcn.140028790
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14015edf8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14015ee2f
call fcn.140161e54
mov dword [rax], 0x16
call fcn.140173fe4
xor eax, eax
jmp 0x14015eebd
mov rdx, r9
mov rcx, r8
call fcn.14015eee0
mov rbx, rax
test rax, rax
je 0x14015eeba
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14015ef50]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14015eea7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140161e94
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14015ee8e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14015ee9d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140086530
jmp 0x14015eeba
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14015eeb7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14015f024
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14015f16c
Function at 0x1401621b8
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x140189df8]
mov rbp, rcx
call fcn.140176920
xor edi, edi
test rax, rax
je 0x14016229e
mov ebx, edi
call fcn.140161e54
mov r14d, dword [rax]
call fcn.140161e54
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.140167ac0
mov rsi, rax
test rax, rax
je 0x14016222f
call fcn.140161e54
mov dword [rax], r14d
jmp 0x140162259
call fcn.140161e54
cmp dword [rax], 0x22
jne 0x140162296
call fcn.140161e54
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140167ac0
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140162296
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x14016225d
cmp rax, 3
je 0x140162278
mov rcx, rsi
call fcn.140162114
test al, al
je 0x140162289
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140162289
mov dil, 1
mov rcx, rbx
call fcn.140086530
mov al, dil
jmp 0x1401622a0
mov rcx, rbx
call fcn.140086530
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14014c9b0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret