joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a2c0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xfffffffc00000000
shl ebp, 0x10
mov ecx, Ordinal_26
call fcn.14018f5a8
mov rsi, rax
mov rax, r15
and rax, r12
cmp rax, qword [0x1402b5708]
jne 0x14001a32d
mov rcx, r15
call fcn.1400fd430
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14001ecd0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14001a3a1
test r14, r14
je 0x14001a396
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140191d70
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001a370
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x27a
jle 0x14001a3eb
cmp ebp, 0x5af
je 0x14001a3c0
cmp ebp, 0x27b
jne 0x14001a3f5
mov rcx, rbx
call fcn.1401fc3e0
test rsi, rsi
je 0x14001a370
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x1402b5708]
jne 0x14001a3e1
call fcn.1400fd6f0
mov rcx, rsi
call fcn.14018f5a0
jmp 0x14001a370
cmp ebp, 8
je 0x14001a3c0
cmp ebp, 0xe
je 0x14001a3c0
mov eax, dword [0x1402c5a38]
mov ecx, dword [0x1402c2670]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001a4aa
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.14009de70
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x14001a43d
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
test rax, rax
js 0x14001a484
sete al
test rbx, rbx
setne cl
or cl, al
je 0x14001a497
mov rcx, qword [0x1402c5a30]
lea rdx, [rsp + 0x50]
call fcn.140007930
cmp byte [rsp + 0x4f], 0
jns 0x14001a3c8
mov rcx, qword [rsp + 0x38]
call fcn.14018f5a0
jmp 0x14001a3c8
lea rcx, [0x1402742d5]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.1401ceaf0
lea rcx, [0x1402742d5]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.1401ceaf0
lea rcx, [0x1402c5a38]
call fcn.14018f720
cmp dword [0x1402c5a38], 0xffffffff
jne 0x14001a41a
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.14000be50
mov qword [0x1402c5a30], rax
lea rcx, [0x1402c5a38]
call fcn.14018f6b4
jmp 0x14001a41a
Function at 0x1400213d0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov byte [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
lea rax, [0x1402719a8]
mov qword [rcx], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x140021442
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14002144f
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002143a
mov qword [rsi + 0x18], rdi
call fcn.140118d60
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140118d60
mov r14, qword [rsi + 0x18]
cmp qword [0x1402c5c40], 0
je 0x140021482
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402a3ee8]
mov qword [rsi + 0x18], 0
jmp 0x140021427
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288f4f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400214c3
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400214bd
call qword [0x1402a3ee8]
mov rcx, rax
xor edx, edx
call fcn.1400440e0
jmp 0x140021462
xor ecx, ecx
mov dl, 1
jmp 0x1400214b6
xor ecx, ecx
jmp 0x1400214b4
Function at 0x140023d90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1402cc8e8]
mov ecx, dword [0x1402c2670]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140023ec5
mov ecx, dword [0x1402c1858]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140023df1
mov rcx, qword [0x1402cc8d8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402cc8e0]
jne 0x140023df1
add rax, rcx
cmp qword [rax], 0
jne 0x140023e84
mov ecx, 4
call fcn.14018f5a8
mov rsi, rax
mov dword [rax], 0
mov ecx, dword [0x1402c1858]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140023ebe
mov rcx, qword [0x1402cc8d8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402cc8e0]
jne 0x140023ebe
add rax, rcx
mov rdi, qword [rax]
mov ecx, dword [0x1402c1858]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x140023e57
test rsi, rsi
je 0x140023e7b
call fcn.1400136a0
mov rcx, qword [0x1402cc8d8]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1402cc8e0]
mov rdx, qword [0x1402cc8d8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
test rdi, rdi
jne 0x140023f18
mov ecx, dword [0x1402c1858]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140023eba
mov rcx, qword [0x1402cc8d8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402cc8e0]
jne 0x140023eba
add rax, rcx
mov rax, qword [rax]
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140023eb3
xor edi, edi
jmp 0x140023e3b
lea rcx, [0x1402cc8e8]
call fcn.14018f720
cmp dword [0x1402cc8e8], 0xffffffff
jne 0x140023dbb
mov qword [0x1402cc8e0], 0
lea rcx, [0x1402cc8d8]
mov qword [0x1402cc8d8], 0xffffffffffffffff
lea rdx, [0x140066660]
call fcn.14002d040
lea rcx, [0x1402cc8e8]
call fcn.14018f6b4
jmp 0x140023dbb
mov rcx, rdi
call fcn.14018f5a0
jmp 0x140023e84
Function at 0x140028b40
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x338
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x330], rax
lea rbx, [rsp + 0x68]
mov r8d, 0x2c8
mov rcx, rbx
mov dl, 0xaa
call fcn.1401cdd80
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14002ea10
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x14026f080]
movaps xmmword [rsi], xmm0
mov rcx, rbx
mov rdx, rsi
call fcn.140028ec0
movsx rax, byte [rsi + 0x17]
mov rcx, rax
test rax, rax
jns 0x140028bdd
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140028ca4
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [rsp + 0x68]
lea rbx, [rsp + 0x38]
xor r13d, r13d
cmp byte [rsp + 0x68], 0
je 0x140028ce9
mov edx, dword [rsp + 0x6c]
test dl, 1
jne 0x140028cf3
test dl, 0x10
jne 0x140028ce2
cmp byte [rsp + 0x67], 0
mov rcx, rsi
jns 0x140028c34
mov rcx, qword [rsp + 0x50]
call r15
test eax, eax
jne 0x140028ce2
call r12
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
cmove ebp, r14d
test r13d, r13d
cmovne ebp, r13d
mov rcx, rdi
mov rdx, rbx
call fcn.140028ec0
cmp byte [rsp + 0x67], 0
jns 0x140028c71
mov rcx, qword [rsp + 0x50]
call fcn.14018f5a0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x50], xmm0
movsx rax, byte [rsp + 0x67]
mov rcx, rax
test rax, rax
jns 0x140028c98
mov rcx, qword [rsp + 0x58]
mov r13d, ebp
test rcx, rcx
jne 0x140028c04
test al, al
jns 0x140028cb2
mov rcx, qword [rsp + 0x50]
call fcn.14018f5a0
lea rcx, [rsp + 0x68]
call fcn.140028d20
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.140191d70
mov eax, ebp
add rsp, 0x338
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x140028c4e
call fcn.1401d1140
jmp 0x140028c25
xor ebp, ebp
test dl, 0x10
jne 0x140028c4e
test al, al
jns 0x140028d09
mov rcx, qword [rsp + 0x50]
jmp 0x140028d0e
lea rcx, [rsp + 0x50]
and edx, 0xffffffee
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140028c25
Function at 0x14002c380
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14002c3af
test r8d, r8d
jne 0x14002c3a8
lea rcx, [0x1402c86c8]
lea rdx, [0x1400a2f10]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.140178500

Function at 0x14002cf30
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x14002cf5c
call fcn.140118d60
mov qword [rsi], 0
test r15, r15
je 0x14002cf92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002cfbd
cmp r12, 2
jb 0x14002cf8a
mov qword [rsi], r15
call fcn.140118d60
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14002d02f
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140118d60
mov r14, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x14002cfee
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402a3ee8]
mov qword [rsi], 0
jmp 0x14002cf7c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288f4f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002d03c
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14002d029
call qword [0x1402a3ee8]
mov rcx, rax
xor edx, edx
call fcn.1400440e0
jmp 0x14002cfcf
xor ecx, ecx
mov dl, 1
jmp 0x14002d022
mov rcx, rdi
call fcn.140182ca0
jmp 0x14002cfac
xor ecx, ecx
jmp 0x14002d020
Function at 0x14002d040
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402c1858]
cmp ecx, 0xffffffff
je 0x14002d11a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14002d11a
mov eax, dword [0x1402cbbc0]
mov ecx, dword [0x1402c2670]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002d124
mov rbx, qword [0x1402cbbb8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14002d169
mov rax, qword [0x1402ca3a8]
inc rax
xor ecx, ecx
lea rdx, [0x1402ca3b0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14002d176
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1402cbbb0]
inc ecx
mov dword [0x1402cbbb0], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1402ca3a8], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14002d166
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400136a0
jmp 0x14002d06a
lea rcx, [0x1402cbbc0]
call fcn.14018f720
cmp dword [0x1402cbbc0], 0xffffffff
jne 0x14002d08f
mov ecx, 8
call fcn.14018f5a8
mov qword [rax], 0
mov qword [0x1402cbbb8], rax
lea rcx, [0x1402cbbc0]
call fcn.14018f6b4
jmp 0x14002d08f
int3
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14002d0a7
inc rcx
cmp rcx, 0x100
jne 0x14002d0ba
jmp 0x14002d100
Function at 0x14002d970
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140191d10
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401cdd80
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002da23
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14002da27
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.14002da80
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140191d70
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14002da04
cmp eax, 2
jne 0x14002da6f
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401cdd80
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14002da76
lea rdx, [rsp + 0x40]
jmp 0x14002d9fa
mov edi, 0x3f4
jmp 0x14002da04
mov edi, 0xea
jmp 0x14002da04

Function at 0x140032c60
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x10040
call fcn.140191d10
sub rsp, rax
mov rsi, rdx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x10038], rax
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rax
mov r8, rdi
call fcn.1401457b0
test rsi, rsi
je 0x140032d2d
lea rbx, [rsp + 0x3a]
mov r8d, 0xfffe
mov rcx, rbx
mov dl, 0xaa
call fcn.1401cdd80
cmp byte [rsp + 0x37], 0
jns 0x140032cd0
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x140032cff
cmp eax, 0x7fff
jae 0x140032d52
mov edx, eax
lea rcx, [rsp + 0x3a]
mov r8, rsi
call fcn.140049d10
cmp byte [rsp + 0x37], 0
jns 0x140032d10
mov rcx, qword [rsp + 0x20]
call fcn.14018f5a0
mov rcx, qword [rsp + 0x10038]
xor rcx, rsp
call fcn.140191d70
mov eax, ebx
add rsp, 0x10040
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsp + 0x37], 0
js 0x140032d3b
lea rcx, [rsp + 0x20]
jmp 0x140032d40
mov rcx, qword [rsp + 0x20]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x140032cff
int3
Function at 0x1400350a0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140035168
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140035130
cmp eax, 0xffffffff
je 0x140035141
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140191d70
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x140035144
mov eax, dword [rsp + 0x2c]
jmp 0x140035110
int3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x140035103
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140035112

Function at 0x140035c00
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140035d39
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x40]
mov qword [rbx], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov r14, rax
call r15
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne bl
je 0x140035d40
mov r15, qword [rsp + 0x40]
cmp qword [rsi], r15
je 0x140035cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140035cc7
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140035ca4
mov qword [rsi], r15
call fcn.140118d60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140191d70
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140118d60
mov r14, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x140035cf8
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402a3ee8]
mov qword [rsi], 0
jmp 0x140035c92
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288f4f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035d4d
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140035d33
call qword [0x1402a3ee8]
mov rcx, rax
xor edx, edx
call fcn.1400440e0
jmp 0x140035cd9
xor ecx, ecx
mov dl, 1
jmp 0x140035d2c
mov bl, 1
jmp 0x140035cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140035ca4
xor ecx, ecx
jmp 0x140035d2a
Function at 0x1400365b0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400365d8
call fcn.140118d60
cmp qword [rsi], r14
je 0x140036607
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140036616
cmp r15, 2
jb 0x1400365ff
mov qword [rsi], r14
call fcn.140118d60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140118d60
mov rbx, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x140036647
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402a3ee8]
mov qword [rsi], 0
jmp 0x1400365f1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288f4f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140036688
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140036682
call qword [0x1402a3ee8]
mov rcx, rax
xor edx, edx
call fcn.1400440e0
jmp 0x140036628
xor ecx, ecx
mov dl, 1
jmp 0x14003667b
xor ecx, ecx
jmp 0x140036679
Function at 0x140037b00
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x140037cfc
mov rbx, r9
mov edi, r8d
mov ebp, edx
mov rsi, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov r15, qword [rsi]
cmp r15, rax
je 0x140037b8a
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140037c76
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140037b7e
mov qword [rsi], r14
call fcn.140118d60
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsi]
lea rax, [r15 + 1]
cmp rax, 1
jbe 0x140037d06
xor r14d, r14d
lea rcx, [rsp + 0x28]
mov r8d, Ordinal_145
xor edx, edx
call fcn.1401cdd80
test ebp, ebp
jne 0x140037c5d
mov ecx, 0xff
mov r14d, 0x408
mov dword [rsp + 0x50], 1
mov eax, r14d
mov dword [rsp + 0x24], ecx
mov r14d, ecx
test rbx, rbx
je 0x140037be4
or eax, 0x100
mov qword [rsp + 0x98], rbx
or eax, 0x2000
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x28]
mov rcx, r15
mov edx, 9
mov r9d, Ordinal_145
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x140037cef
not edi
and r14d, edi
lea r8, [rsp + 0x24]
mov dword [r8], r14d
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x140037cef
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140191d70
mov eax, esi
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp ebp, 1
jne 0x140037d2f
mov ecx, reloc.WLDAP32.dll_Ordinal_216
mov r14d, 8
jmp 0x140037bc0
call fcn.140118d60
mov r12, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x140037caa
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r12
call qword [0x1402a3ee8]
mov qword [rsi], 0
jmp 0x140037b6c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288f4f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037d50
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140037ce9
call qword [0x1402a3ee8]
mov rcx, rax
xor edx, edx
call fcn.1400440e0
jmp 0x140037c88
xor ecx, ecx
mov dl, 1
jmp 0x140037ce2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140037c39
mov esi, 0x4df
jmp 0x140037c39
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140191d70
nop
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xc8
cmp ebp, 2
je 0x140037bc8
mov eax, 0
cmp ebp, 3
je 0x140037bd2
jmp 0x140037bed
xor ecx, ecx
jmp 0x140037ce0
Function at 0x1400399d0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x1402b3040]
xor rdx, rsp
mov qword [rsp + 0x40], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x38]
mov qword [r8], rdx
or r9d, 8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140039aa2
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140039aa2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140039a9e
call fcn.140118d60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
mov bpl, 1
test rbx, rbx
je 0x140039a81
cmp rbx, 0xffffffffffffffff
je 0x140039aa9
call fcn.140118d60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsi], rbx
call fcn.140118d60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140191d70
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x140039a47
mov byte [rsi], 0
xor ebp, ebp
jmp 0x140039a81
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140039a79
Function at 0x14003c3f0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
or r8d, 8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14003c4bf
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14003c4bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14003c4bb
call fcn.140118d60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
mov bpl, 1
test rbx, rbx
je 0x14003c49e
cmp rbx, 0xffffffffffffffff
je 0x14003c4c6
call fcn.140118d60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsi], rbx
call fcn.140118d60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140191d70
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x14003c464
mov byte [rsi], 0
xor ebp, ebp
jmp 0x14003c49e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14003c496