joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140359fa0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1404700a0]
mov ecx, dword [0x14046184c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14035a237
mov rax, qword [0x140470098]
test rax, rax
jne 0x14035a088
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x1403db8a0]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.14035a280
test al, al
jne 0x14035a125
mov ecx, 2
call fcn.140209bc0
test al, al
jne 0x14035a13f
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14025a610
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [case.0x1402d5a00.0]
test eax, eax
jne 0x14035a102
mov ecx, 2
call fcn.140209bc0
test al, al
je 0x140359ffb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.1402dddc0
lea rcx, [rsp + 0x40]
lea rdx, [0x14042dabe]
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.14029aae0
mov rcx, rbx
call fcn.1402dde40
jmp 0x140359ffb
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x14035a002
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x14035a037
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
jne 0x14035a183
call fcn.14035ab30
jmp 0x14035a188
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.140110e20
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.14029aae0
mov rcx, rsi
call fcn.140111310
jmp 0x14035a069
call fcn.14035a4b0
test al, al
je 0x14035a1ee
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.140174db0
mov sil, 1
test al, al
jne 0x14035a06b
mov ecx, 2
call fcn.140209bc0
test al, al
je 0x14035a069
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.140110e20
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x14035a171
mov ecx, 2
call fcn.140209bc0
test al, al
je 0x14035a069
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.140110e20
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x14035a171
lea rcx, [0x1404700a0]
call fcn.140258f70
cmp dword [0x1404700a0], 0xffffffff
jne 0x140359feb
lea rcx, [0x1403e4098]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1401762a0
mov qword [0x140470098], rax
lea rcx, [0x1404700a0]
call fcn.140259008
jmp 0x140359feb
Function at 0x14035c730
Capabilities:
Read http header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov r14, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r12, [rsp + 0x54]
mov dword [r12], 0
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebp, 0x80004005
cmovne ebp, ecx
cmp ebp, 0x8007007a
jne 0x14035c82e
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x30]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1403db8a0]
movaps xmmword [r15], xmm0
mov edx, dword [rsp + 0x54]
shr rdx, 1
mov rcx, r15
call fcn.1401da7e0
mov r9, qword [r15]
cmp r9, qword [r15 + 8]
je 0x14035c89e
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
mov rcx, r14
mov edx, ebx
mov r8, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14035c84c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebp, 0x80004005
cmovne ebp, ecx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14035c82e
mov qword [rsp + 0x38], rcx
call fcn.140258e54
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14025a610
mov eax, ebp
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [rsp + 0x54]
shr rax, 1
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rcx, r8
sub rcx, rdx
sar rcx, 1
cmp rcx, rax
jae 0x14035c891
sub rax, rcx
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rax
call fcn.1400be1b0
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
call fcn.14035c8d0
xor ebp, ebp
jmp 0x14035c81a
jbe 0x14035c885
lea r8, [rdx + rax*2]
mov qword [rsp + 0x38], r8
jmp 0x14035c885
lea rax, str.front___called_on_an_empty_vector
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_vector
lea r9, str._empty__
mov r8d, 0x236
call fcn.14029ef60
int3

Function at 0x14035ca90
Capabilities:
Read http header

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x38], rax
or edx, 0x20000000
lea rax, [rsp + 0x34]
mov dword [rax], 4
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor esi, esi
test eax, eax
jne 0x14035caeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025a610
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x140361870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14036189a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1403618bc
mov edi, eax
test bl, bl
jne 0x1403618b4
mov eax, edi
and eax, 0x400
jne 0x1403618ca
and edi, 0x10
shr edi, 4
jmp 0x1403618cc
mov ecx, 2
call fcn.140209bc0
test al, al
jne 0x1403618e9
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14025a610
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x82
mov r9d, 2
call fcn.1402dddc0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14029aae0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.1401ff8f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140361968
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.14029aae0
cmp byte [rsp + 0x57], 0
jns 0x140361984
mov rcx, qword [rsp + 0x40]
call fcn.140258e54
lea rcx, [rsp + 0x58]
call fcn.1402dde40
jmp 0x1403618ca
Function at 0x1403619a0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
cmp byte [rcx + 0x17], 0
jns 0x1403619cb
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
je 0x1403619f7
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14025a610
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x140361a0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140361ad7
mov ecx, 2
call fcn.140209bc0
test al, al
jne 0x140361a1e
xor edi, edi
jmp 0x1403619da
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x62
mov r9d, 2
call fcn.1402dddc0
lea rcx, [rsp + 0x50]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14029aae0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.1401ff8f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140361aa6
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.14029aae0
cmp byte [rsp + 0x1a7], 0
jns 0x140361ac8
mov rcx, qword [rsp + 0x190]
call fcn.140258e54
lea rcx, [rsp + 0x40]
call fcn.1402dde40
jmp 0x140361a1a
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140361870
test al, al
jne 0x1403619da
mov ecx, 2
call fcn.140209bc0
test al, al
je 0x140361a1a
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x5d
mov r9d, 2
call fcn.140110e20
lea rdi, [rsp + 0x50]
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x180]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.1401ff8f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140361b6b
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.14029aae0
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.14029aae0
cmp byte [rsp + 0x1a7], 0
jns 0x140361ba2
mov rcx, qword [rsp + 0x190]
call fcn.140258e54
lea rcx, [rsp + 0x40]
call fcn.140111310
jmp 0x140361a1a
Function at 0x140361bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140361be7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140361c17
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14025a610
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140209bc0
test al, al
jne 0x140361c29
xor esi, esi
jmp 0x140361bfb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x75
mov r9d, 2
call fcn.1402dddc0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14029aae0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1401ff8f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140361ca8
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.14029aae0
cmp byte [rsp + 0x4f], 0
jns 0x140361cc4
mov rcx, qword [rsp + 0x38]
call fcn.140258e54
lea rcx, [rsp + 0x50]
call fcn.1402dde40
jmp 0x140361c25

Function at 0x140361ce0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140361d07
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140361d1e
and eax, 0x410
cmp eax, 0x410
je 0x140361d65
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140361d2a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x140361d53
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14025a610
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140209bc0
test al, al
jne 0x140361d86
xor edi, edi
jmp 0x140361d37
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14025a610
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140361e30
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x95
mov r9d, 2
call fcn.1402dddc0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.14029aae0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1401ff8f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140361e05
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.14029aae0
cmp byte [rsp + 0x4f], 0
jns 0x140361e21
mov rcx, qword [rsp + 0x38]
call fcn.140258e54
lea rcx, [rsp + 0x50]
call fcn.1402dde40
jmp 0x140361d61
Function at 0x140361e30
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140361e58
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x140361e72
mov ecx, 2
call fcn.140209bc0
test al, al
jne 0x140361e94
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14025a610
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x30
mov r9d, 2
call fcn.1402dddc0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.14029aae0
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1401ff8f0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x140361f13
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.14029aae0
cmp byte [rsp + 0x57], 0
jns 0x140361f2f
mov rcx, qword [rsp + 0x40]
call fcn.140258e54
lea rcx, [rsp + 0x58]
call fcn.1402dde40
jmp 0x140361e72

Function at 0x140364770
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x1403647ae
test rax, rax
je 0x140364877
mov rcx, qword [rbx]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
sub rax, qword [rsi]
mov r15, rax
sar r15, 3
lea rcx, [r15 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x1403648a3
movabs rdx, 0x1fffffffffffffff
lea rdi, [rsi + 0x18]
mov r14, rax
shr r14, 2
cmp r14, rcx
cmovbe r14, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r14, rdx
test r14, r14
jne 0x14036486a
xor eax, eax
shl r15, 3
add r15, rax
je 0x140364877
lea rax, [rax + r14*8]
mov rcx, qword [rbx]
mov qword [r15], rcx
lea rcx, [r15 + 8]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rdx
je 0x140364838
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r15 - 8], r9
add r15, 0xfffffffffffffff8
cmp r8, rdx
jne 0x140364820
mov rdx, qword [rsi]
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x1403647a2
sub r8, rdx
sar r8, 3
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140364de0
mov rcx, rdi
mov rdx, r14
call fcn.140365360
jmp 0x1403647fd
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.14029ef60
mov rcx, rsi
call fcn.14029aa80
int3
Function at 0x14036a140
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14036a17c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14036a186
add rdi, rbx
sub rsi, rbx
jne 0x14036a15a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1402735f0
int3

Function at 0x14036a240
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.14025c760
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x14036a282
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x14036a276

Function at 0x140378cd0
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x140378ceb
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1401740d0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140378d99
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140378d99
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140378dc4
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x140378ce1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x140378cdf
mov dword [rsi], 7
jmp 0x140378cdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140378cdf

Function at 0x14037f950
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x14037f9d8
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x14037f9d1
mov rdx, rcx
add rdi, rdx
cmp al, 1
jne 0x14037f992
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14025a610
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14038cca0
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x14038ccee
cmp byte [rcx], 0x4d
jne 0x14038ccee
cmp byte [rcx + 1], 0x5a
jne 0x14038ccee
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x14038ccf0
cmp r9, rdx
jae 0x14038ccf0
cmp r9d, 0x40
jb 0x14038ccf0
mov r10d, r9d
and r10d, 7
jne 0x14038ccf0
cmp byte [rcx + r9], 0x50
jne 0x14038ccee
cmp byte [rcx + r9 + 1], 0x45
jne 0x14038ccee
cmp byte [rcx + r9 + 2], 0
je 0x14038ccf1
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x14038ccee
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x14038ccf0
cmp rdx, 2
jb 0x14038ccf0
cmp word [rcx + r9], r8w
sete al
jmp 0x14038ccf0
Function at 0x140393ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140393f30
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14025a610
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1403a01c0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14044f038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1403db8a0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14029a710
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1403a4a30
test al, al
je 0x1403a0286
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1403a02bb
mov rcx, r14
call fcn.14029a710
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1403a4a30
test al, al
je 0x1403a0300
cmp dword [rbx], 0x4550
jne 0x1403a033c
mov sil, 1
test rdi, rdi
je 0x1403a029a
mov qword [rdi], r14
jmp 0x1403a029a
mov ecx, 1
call fcn.140209bc0
test al, al
jne 0x1403a0382
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14025a610
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.140209bc0
test al, al
je 0x1403a0298
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140110e20
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1403a03b4
mov ecx, 1
call fcn.140209bc0
test al, al
je 0x1403a0298
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140110e20
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1403a03ae
mov ecx, 1
call fcn.140209bc0
test al, al
je 0x1403a0298
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140110e20
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1403a03b4
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140110e20
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14029aae0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1403a03ca
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.14029aae0
mov rcx, rdi
call fcn.140111310
jmp 0x1403a0298