joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400830b0
Capabilities:
Get session user name

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x288
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdx, qword [rdx + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140005e00
lea rcx, [rsp + 0x80]
mov edx, ebx
call fcn.140087720
lea rcx, str.chrome.exe
mov qword [rsp + 0x50], rcx
cmp word [str.chrome.exe], 0
je 0x14008311a
xor eax, eax
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14008310c
jmp 0x14008311c
xor eax, eax
lea r8, [rsp + 0x50]
mov qword [r8 + 8], rax
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140051c50
mov rcx, rsi
call fcn.140050690
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
test bl, bl
jne 0x14008322d
lea rcx, [rsp + 0x20]
call fcn.14007a220
test al, al
je 0x140083186
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.140082ca0
test al, al
jne 0x14008322d
lea rdx, [rsp + 0x7c]
mov dword [rdx], 0x100
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400831f9
mov edx, dword [rsp + 0x7c]
test edx, edx
je 0x1400831f9
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.140037ff0
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.140038800
mov r8d, dword [rsp + 0x7c]
dec r8d
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.140038290
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.140082ca0
test al, al
jne 0x14008322d
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, 0xffffffffffffffff
call fcn.140038ba0
lea rcx, [rsp + 0x60]
mov rdx, rax
mov r8, rdi
xor r9d, r9d
call fcn.140082ca0
test al, al
jne 0x14008322d
lea rcx, [rsp + 0x20]
call fcn.14007a220
lea rcx, [rsp + 0x60]
call fcn.140050690
lea rsi, [rsp + 0x20]
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
cmovs r8, qword [rsi + 8]
mov rdx, qword [rsi]
cmovns rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140038290
mov rcx, r14
mov rdx, rax
call fcn.140037a70
cmp byte [rsi + 0x17], 0
jns 0x140083275
mov rcx, qword [rsp + 0x20]
call fcn.140180390
cmp byte [rsp + 0x4f], 0
jns 0x140083286
mov rcx, qword [rsp + 0x38]
call fcn.140180390
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140180700
mov rax, r14
add rsp, 0x288
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14008aa30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov edi, edx
mov r14, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp edx, 0x918
jg 0x14008aa70
cmp edi, 0x691
je 0x14008aa89
cmp edi, 0x7d5
jne 0x14008aaad
lea rsi, [0x1401c44b0]
jmp 0x14008aa99
cmp edi, 0x919
je 0x14008aa92
cmp edi, 0xdd8
jne 0x14008aaad
lea rsi, [0x1401c44e0]
jmp 0x14008aa99
lea rsi, [0x1401c44c0]
jmp 0x14008aa99
lea rsi, [0x1401c44d0]
call fcn.14006d090
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
movsxd rax, dword [rax + 8]
mov edi, dword [rsi + rax*4]
mov rcx, qword [0x1402126f8]
test rcx, rcx
je 0x14008aaca
mov rax, qword [rcx]
mov rdx, r14
mov r8d, edi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14008ac40
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
call fcn.14008ac60
add edi, dword [rax + 0x30]
mov r15, qword [0x1402176b8]
mov eax, edi
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14008ac2e
mov rsi, rax
mov rcx, r15
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008ac2e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14008ac2e
mov rbx, rax
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
je 0x14008ab78
and edi, 0xf
je 0x14008ab78
mov ecx, eax
mov rax, rbx
add rax, rcx
dec edi
movzx ecx, word [rbx]
lea rbx, [rbx + rcx*2]
add rbx, 2
add edi, 0xffffffff
setb dl
cmp rbx, rax
setb cl
jae 0x14008ab78
test dl, dl
jne 0x14008ab5b
test cl, cl
je 0x14008ac2e
movzx edi, word [rbx]
test rdi, rdi
je 0x14008ac2e
add rbx, 2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
cmp di, 0xb
jae 0x14008abb2
lea rsi, [rsp + 0x20]
mov byte [rsi + 0x17], dil
jmp 0x14008abda
lea r15d, [rdi + 8]
and r15d, 0xfffffff8
lea rcx, [r15 + r15]
call fcn.140180340
mov rsi, rax
mov qword [rsp + 0x20], rax
bts r15, 0x3f
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rdi
lea r8, [rdi + rdi]
mov rcx, rsi
mov rdx, rbx
call fcn.1401836f0
mov word [rsi + rdi*2], 0
cmp byte [rsp + 0x57], 0
js 0x14008ac04
mov word [rsp + 0x40], 0
mov byte [rsp + 0x57], 0
jmp 0x14008ac1a
mov rcx, qword [rsp + 0x40]
xor esi, esi
mov qword [rsp + 0x48], rsi
call fcn.140180390
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140180700
mov rax, r14
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14008d470
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x140212790]
test rax, rax
jne 0x14008d4b4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x140212790]
test rax, rax
je 0x14008d4a1
cmp eax, 2
jne 0x14008d502
mov ecx, 2
call fcn.140055330
test al, al
je 0x14008d55b
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x84
mov r9d, 2
call fcn.1400553e0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x14008d5bd
mov eax, 1
lock xadd qword [0x1402127c8], rax
test rax, rax
jle 0x14008d522
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140212748], eax
mov qword [0x140212740], rsi
mov rcx, qword [0x14020eaf8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14008d58b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140180700
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xb0
mov r9d, 2
call fcn.1400553e0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140006490
mov rcx, rsi
call fcn.140055870
jmp 0x14008d55b
Function at 0x14008dea0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x30
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmm0, xmmword [0x1401b86b0]
xor ecx, ecx
movdqa xmm1, xmmword [0x1401b86d0]
movdqa xmm2, xmmword [0x1401c5320]
lea r8, [0x1402127e0]
movdqa xmm3, xmmword [0x1401b86c0]
movdqa xmm4, xmm0
psrld xmm4, 1
movdqa xmm5, xmm0
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
movdqa xmmword [rcx + r8], xmm5
paddd xmm0, xmm3
add rcx, 0x10
cmp rcx, 0x400
jne 0x14008ded4
xor ecx, ecx
mov edx, dword [r8 + rcx*4]
mov esi, dword [r8 + rcx*4 + 4]
movzx eax, dl
shr edx, 8
xor edx, dword [r8 + rax*4]
mov dword [r8 + rcx*4 + 0x400], edx
movzx eax, sil
shr esi, 8
xor esi, dword [r8 + rax*4]
mov dword [r8 + rcx*4 + 0x404], esi
add rcx, 2
cmp rcx, 0x700
jne 0x14008dfc1
lea rax, [0x1400d1010]
mov qword [0x1402147e0], rax
mov qword [0x1402127d0], rax
lea rsi, [0x1400d1100]
mov qword [0x1402147e8], rsi
call fcn.1400d1220
test eax, eax
jne 0x14008e02f
mov qword [0x1402127d0], rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rsi
ret

Function at 0x14008e260
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rbx, [rsp + 0x50]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
mov edx, 5
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008e2f2
mov qword [rsp + 0x28], rbx
cmp word [rsp + 0x50], 0
je 0x14008e2c4
xor eax, eax
cmp word [rsp + rax*2 + 0x52], 0
lea rax, [rax + 1]
jne 0x14008e2b6
jmp 0x14008e2c6
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400505a0
mov rcx, rsi
mov rdx, rdi
call fcn.1400506c0
mov rcx, rdi
call fcn.140050690
mov dil, 1
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008e310
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rdi, [rsp + 0x60]
mov word [rdi], 0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 5
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008e371
mov qword [rsp + 0x38], rdi
cmp word [rsp + 0x60], 0
je 0x14008e375
xor eax, eax
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x14008e363
jmp 0x14008e377
xor esi, esi
jmp 0x14008e3dd
xor eax, eax
lea rdx, [rsp + 0x38]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1400505a0
mov rcx, rsi
mov rdx, rdi
call fcn.1400506c0
mov rcx, rdi
call fcn.140050690
lea rax, str.Downloads
lea r8, [rsp + 0x28]
mov qword [r8], rax
mov qword [r8 + 8], 9
lea rdi, [rsp + 0x60]
mov rcx, rsi
mov rdx, rdi
call fcn.140051c50
mov rcx, rsi
mov rdx, rdi
call fcn.1400506c0
mov rcx, rdi
call fcn.140050690
mov sil, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140180700
mov eax, esi
add rsp, 0x278
pop rdi
pop rsi
ret

Function at 0x14008e5a0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rbx, [rsp + 0x50]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
mov edx, ntohl
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008e632
mov qword [rsp + 0x28], rbx
cmp word [rsp + 0x50], 0
je 0x14008e604
xor eax, eax
cmp word [rsp + rax*2 + 0x52], 0
lea rax, [rax + 1]
jne 0x14008e5f6
jmp 0x14008e606
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400505a0
mov rcx, rsi
mov rdx, rdi
call fcn.1400506c0
mov rcx, rdi
call fcn.140050690
mov dil, 1
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret

Function at 0x14008e650
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rbx, [rsp + 0x50]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
mov edx, 0x27
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008e6e2
mov qword [rsp + 0x28], rbx
cmp word [rsp + 0x50], 0
je 0x14008e6b4
xor eax, eax
cmp word [rsp + rax*2 + 0x52], 0
lea rax, [rax + 1]
jne 0x14008e6a6
jmp 0x14008e6b6
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400505a0
mov rcx, rsi
mov rdx, rdi
call fcn.1400506c0
mov rcx, rdi
call fcn.140050690
mov dil, 1
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008e700
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rbx, [rsp + 0x50]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
mov edx, reloc.WS2_32.dll_ntohl
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008e792
mov qword [rsp + 0x28], rbx
cmp word [rsp + 0x50], 0
je 0x14008e764
xor eax, eax
cmp word [rsp + rax*2 + 0x52], 0
lea rax, [rax + 1]
jne 0x14008e756
jmp 0x14008e766
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400505a0
mov rcx, rsi
mov rdx, rdi
call fcn.1400506c0
mov rcx, rdi
call fcn.140050690
mov dil, 1
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret

Function at 0x14008e880
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14008e8a7
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14008e8f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14008e8e4
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov rcx, rsi
add rsp, 0x1a8
pop rdi
pop rsi
jmp fcn.14008e9c0
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14008e910
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x244
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14008e98f
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x57], 0
jns 0x14008e9ab
mov rcx, qword [rsp + 0x40]
call fcn.140180390
lea rcx, [rsp + 0x58]
call fcn.1400560d0
jmp 0x14008e8f2
Function at 0x14008e9c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
cmp byte [rcx + 0x17], 0
jns 0x14008e9e7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008eac6
mov dil, 1
test al, 0x10
jne 0x14008ead6
mov ecx, 2
call fcn.140055330
test al, al
je 0x14008ead4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x232
mov r9d, 2
call fcn.1400553e0
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14008ea89
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140006490
cmp byte [rsp + 0x67], 0
jns 0x14008eaba
mov rcx, qword [rsp + 0x50]
call fcn.140180390
lea rcx, [rsp + 0x68]
call fcn.140055870
jmp 0x14008ead4
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14008eaf2
xor edi, edi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1b8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x22e
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x40]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14008eb71
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x67], 0
jns 0x14008eb8d
mov rcx, qword [rsp + 0x50]
call fcn.140180390
lea rcx, [rsp + 0x68]
call fcn.1400560d0
jmp 0x14008ead4
Function at 0x140090380
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x40]
cmp rbx, rsi
je 0x140090425
mov r14, r8
mov ebp, edx
mov r15, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], ebp
jne 0x14009041c
cmp byte [rbx + 0x27], 0
jns 0x1400903ba
mov rcx, qword [rbx + 0x10]
jmp 0x1400903be
lea rcx, [rbx + 0x10]
call r15
test al, 0x10
jne 0x14009041c
mov rdi, qword [r14 + 8]
cmp rdi, qword [r14 + 0x10]
je 0x140090411
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
lea rcx, [rdi + 0x10]
lea rdx, [rbx + 0x10]
call fcn.140050570
lea rcx, [rdi + 0x28]
lea rdx, [rbx + 0x28]
call fcn.140036c30
movups xmm0, xmmword [rbx + 0x40]
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm1
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x60], rax
add rdi, 0x68
mov qword [r14 + 8], rdi
jmp 0x14009041c
mov rcx, r14
mov rdx, rbx
call fcn.140091110
add rbx, 0x70
cmp rsi, rbx
jne 0x1400903a9
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140091e20
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x140214890]
mov ecx, dword [0x140214838]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140091e82
lea rsi, [0x140214888]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140180700
mov rax, rsi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140214890]
call fcn.1401804b0
cmp dword [0x140214890], 0xffffffff
jne 0x140091e5d
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140183b00
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140180340
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1402148c8]
mov ecx, dword [0x140214838]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140091f42
lea r8, [0x140214898]
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r9d, edi
call fcn.1400920c0
mov qword [0x140214888], rsi
lea rcx, [0x140214890]
call fcn.140180548
jmp 0x140091e5d
lea rcx, [0x1402148c8]
call fcn.1401804b0
cmp dword [0x1402148c8], 0xffffffff
jne 0x140091f13
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x1402148b8], xmm2
movups xmmword [0x1402148a8], xmm1
movups xmmword [0x140214898], xmm0
lea rcx, [0x1402148c8]
call fcn.140180548
jmp 0x140091f13
Function at 0x140091fd0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1402148c8]
mov ecx, dword [0x140214838]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009202c
movzx eax, word [0x140214898]
cmp ax, 9
jne 0x14009208e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140180700
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1402148c8]
call fcn.1401804b0
cmp dword [0x1402148c8], 0xffffffff
jne 0x140092005
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x1402148b8], xmm2
movups xmmword [0x1402148a8], xmm1
movups xmmword [0x140214898], xmm0
lea rcx, [0x1402148c8]
call fcn.140180548
jmp 0x140092005
xor esi, esi
test ax, ax
je 0x140092017
cmp ax, 6
jne 0x1400920a5
mov esi, 2
jmp 0x140092017
cmp ax, 0xc
jne 0x1400920b5
mov esi, 3
jmp 0x140092017
mov esi, 4
jmp 0x140092017
Function at 0x1400929b0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r15, rdx
mov r14d, ecx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, str.CreateLocalWmiConnection
lea r8, str..._.._base_win_wmi.cc
lea rdi, [rsp + 0x68]
mov rcx, rdi
mov r9d, 0x1d
call fcn.140054e50
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.1400b1040
mov eax, dword [0x1402148cc]
mov ecx, dword [0x140214838]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140092a57
lea rcx, [0x1402148cc]
call fcn.1401804b0
cmp dword [0x1402148cc], 0xffffffff
jne 0x140092a57
lea rcx, [rsp + 0x88]
call fcn.1400b1160
lea rcx, [0x1402148cc]
call fcn.140180548
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x20], rdi
lea rcx, [0x1401cde78]
lea r9, [0x1401c5878]
xor edi, edi
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140092b58
xor edi, edi
lea rsi, [rsp + 0x60]
mov qword [rsi], rdi
mov rbx, qword [rsp + 0x68]
lea rax, [0x1401c5888]
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
mov qword [rdx + 8], 0xa
lea rbp, [rsp + 0x58]
mov rcx, rbp
call fcn.1400d2c80
mov rdx, qword [rbp]
mov rax, qword [rbx]
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
mov ebx, eax
mov rcx, rbp
call fcn.1400d2cd0
test ebx, ebx
js 0x140092ba9
test r14b, r14b
je 0x140092b3c
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
xor edi, edi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140092ba9
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [r15]
mov qword [r15], rax
mov dil, 1
test rcx, rcx
jne 0x140092ba0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140092b71
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0x88]
call fcn.1400b1210
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dil, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140092b58
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140092b58