joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086ad0
Capabilities:
Create service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rdx + 0x30]
xor ebx, ebx
cmp rax, qword [rdx + 0x38]
cmovne rbx, rax
cmp qword [rdx + 0x28], 7
jbe 0x140086b13
mov r15, qword [rdx + 0x10]
jmp 0x140086b17
lea r15, [rdx + 0x10]
mov r13d, dword [rdx + 0xc]
mov r12d, dword [rdx + 4]
mov ebp, dword [rdx + 8]
lea rdi, [rsi + 0x20]
mov eax, 8
cmp qword [rsi + 0x38], rax
jb 0x140086b34
mov rdi, qword [rdi]
lea r14, [rsp + 0x70]
mov rcx, rsi
mov rdx, r14
call fcn.140086130
cmp qword [r14 + 0x18], 7
mov rdx, r14
jbe 0x140086b53
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsi + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
mov r8, rdi
mov r9d, 0x10003
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rdi, [rsp + 0x68]
mov qword [rdi], 0
mov rcx, rdi
mov rdx, rax
call fcn.140085d50
mov rcx, r14
call fcn.140006b40
mov rdi, qword [rdi]
test rdi, rdi
je 0x140086bf2
add rsi, 0x68
xor ebx, ebx
mov qword [rsp + 0x68], rbx
call fcn.14003b750
mov rcx, rsi
mov rdx, rdi
call fcn.140085d50
mov sil, 1
cmp qword [rsp + 0x68], rbx
je 0x140086bf4
call fcn.14003b750
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x68], 0
jmp 0x140086bf4
xor esi, esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140086c20
Capabilities:
Modify service

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [rdx + 0x30]
xor esi, esi
cmp rax, qword [rdx + 0x38]
cmovne rsi, rax
cmp qword [rdx + 0x28], 7
jbe 0x140086c40
mov r11, qword [rdx + 0x10]
jmp 0x140086c44
lea r11, [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov r10d, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [rcx + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rsi
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x50], 0
mov edx, r10d
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
setne al
add rsp, 0x60
pop rsi
ret
Function at 0x1400991f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test rdx, rdx
je 0x140099232
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14009923d
add rdi, rbx
sub rsi, rbx
jne 0x140099210
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
int3

Function at 0x1400a2cf0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400a2d09
mov dword [rsi], eax
mov al, 1
jmp 0x1400a2d0b
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400a8aa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov qword [rsp + 0x20], rdx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x1400a8ac6
mov rdi, qword [rdi]
movabs rdx, 0xcbf29ce484222325
test r15, r15
je 0x1400a8af4
movabs rax, 0x100000001b3
lea rbp, [r15 - 1]
mov r8d, r15d
and r8d, 3
cmp rbp, 3
jae 0x1400a8af9
xor ebp, ebp
jmp 0x1400a8b48
mov rbx, rdx
jmp 0x1400a8b78
mov rsi, r15
sub rsi, r8
xor ebp, ebp
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ebx, byte [rdi + rbp]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [rdi + rbp + 1]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [rdi + rbp + 2]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [rdi + rbp + 3]
xor rdx, rbx
imul rdx, rax
add rbp, 4
cmp rsi, rbp
jne 0x1400a8b10
mov rbx, rdx
test r8, r8
je 0x1400a8b78
add rbp, rdi
xor esi, esi
nop word cs:[rax + rax]
nop
movzx ebx, byte [rbp + rsi]
xor rbx, rdx
imul rbx, rax
add rsi, 1
mov rdx, rbx
cmp r8, rsi
jne 0x1400a8b60
and rbx, qword [rcx + 0x30]
mov r14, qword [rcx + 8]
mov r12, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
mov r13, qword [r12 + rax]
lea rbp, [rbx + rbx]
add rbp, 1
mov rsi, r13
cmp r13, r14
jne 0x1400a8bb8
jmp 0x1400a8be0
mov rsi, qword [rsi]
cmp r13, r14
je 0x1400a8be0
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rsi
je 0x1400a8c6d
cmp qword [rsi + 0x20], r15
jne 0x1400a8bb0
cmp qword [rsi + 0x28], 0xf
jbe 0x1400a8bf0
mov rcx, qword [rsi + 0x10]
jmp 0x1400a8bf4
mov rax, r14
cmp rax, rsi
jne 0x1400a8bc8
jmp 0x1400a8c6d
lea rcx, [rsi + 0x10]
mov rdx, rdi
mov r8, r15
call fcn.14016f170
test eax, eax
jne 0x1400a8bb0
mov rbx, rsi
cmp r13, r14
jne 0x1400a8c18
jmp 0x1400a8c60
mov rbx, qword [rbx]
cmp r13, r14
je 0x1400a8c60
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x1400a8c68
cmp r15, qword [rbx + 0x20]
jne 0x1400a8c68
cmp qword [rbx + 0x28], 0xf
jbe 0x1400a8c40
mov rdx, qword [rbx + 0x10]
jmp 0x1400a8c44
lea rdx, [rbx + 0x10]
mov rcx, rdi
mov r8, r15
call fcn.14016f170
test eax, eax
je 0x1400a8c10
jmp 0x1400a8c68
mov rax, r14
cmp rax, rbx
jne 0x1400a8c24
cmp rsi, rbx
jne 0x1400a8c73
mov rsi, r14
mov rbx, r14
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400abb10
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x1400abb67
mov r12, r8
mov ebx, edx
mov edi, ecx
bt edx, 8
jae 0x1400abb4c
mov eax, ebx
and eax, 0x200
jne 0x1400abb67
cmp edi, 2
lea rax, [0x1401eb560]
lea rcx, [0x1401eb760]
cmove rcx, rax
cmp word [rcx], 0
je 0x1400abb86
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014b5e0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400abb67
cmp byte [0x1401eb550], 0
setne al
bt ebx, 8
jb 0x1400abb67
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400abb67
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x1400abbe6
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
mov r13d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x1400abc82
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x1400abc1f
test dx, dx
jne 0x1400abca4
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x1400abc4d
cmp ebp, 2
jne 0x1400abc43
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x1400abc4d
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x1400abc65
dec r14
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x1400abc57
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x1400abcab
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x1400abca4
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.14017c1c0
test eax, eax
je 0x1400abc0c
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x1400abc82
cmp dword [rsp + 0x2c], 0
je 0x1400abb67
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x1400abcca
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140186640
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.14000e2c0
jmp 0x1400abb67
Function at 0x1400ac9b0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14004e1e0
cmp qword [rsp + 0x70], 7
jbe 0x1400ac9fb
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x1400aca53
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400aca4e
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400acc16
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14014b210
test ebp, ebp
je 0x1400acb1e
mov r14b, 1
test rsi, rsi
je 0x1400acbf8
mov ecx, ebp
add rcx, rcx
call fcn.14014b220
mov rbx, rax
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14004e1e0
cmp qword [rsp + 0x70], 7
jbe 0x1400aca9d
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x1400acaf4
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400acaef
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400acc16
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14014b210
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x1400acb26
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400acb10
jmp 0x1400acb28
xor r14d, r14d
jmp 0x1400acbf8
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14004e610
mov rax, qword [rsi + 0x18]
cmp rdi, rsi
je 0x1400acbaf
cmp rax, 0x10
jb 0x1400acb82
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400acb7d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x1400acc16
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14014b210
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
jmp 0x1400acbe7
cmp rax, 0x10
jb 0x1400acbe7
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400acbe2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x1400acc16
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14014b210
mov qword [rsp + 0x70], 0xf
mov rcx, rbx
call fcn.14014b210
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14014b5e0
mov eax, r14d
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140179190
ud2
Function at 0x1400b4110
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea rsi, [rcx + 0x48]
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x1400b413e
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rbx, [rdi + 0x40]
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1400b4158
mov qword [rbx], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x20], rbx
lea rcx, [0x1401b5e78]
lea r9, [0x1401aca60]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbx]
test eax, eax
js 0x1400b41c1
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x90]
test eax, eax
js 0x1400b41cf
cmp rdi, r15
je 0x1400b41ae
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x1400b41a3
mov r15, qword [r15]
mov rcx, rdi
mov rdx, r15
call fcn.1400060b0
add rdi, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.1400324d0
mov al, 1
jmp 0x1400b41e6
test rcx, rcx
je 0x1400b41e4
mov qword [rbx], 0
jmp 0x1400b41de
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400b41e4
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400bc380
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x60], rax
test dl, dl
je 0x1400bc3db
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x1400bc3db
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov dword [rax], 0x18
lea rcx, [0x1401adb04]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
jmp 0x1400bc3dd
xor eax, eax
movzx edx, bl
shl edx, 0x13
or edx, 3
cmp qword [rsi + 0x18], 7
jbe 0x1400bc3f0
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rax
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014b5e0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x1400bc440
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x1400bc513
and eax, 0xfeff
cmp eax, 6
je 0x1400bc513
mov eax, dword [0x1401ebc28]
mov ecx, dword [0x1401ea448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x1400bc53a
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x1401ebc20]
mov sil, 1
test eax, eax
jne 0x1400bc51f
mov ecx, 2
call fcn.14003be50
test al, al
je 0x1400bc50f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x40]
lea rdx, [0x1401adba3]
call fcn.140002b70
mov rcx, rsi
call fcn.14003ce70
xor esi, esi
jmp 0x1400bc51f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x150
pop rsi
ret
lea rcx, [0x1401ebc28]
call fcn.14014b390
mov eax, dword [0x1401ebc28]
cmp eax, 0xffffffff
jne 0x1400bc4a7
lea rcx, [0x14019a0d0]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.1400bcac0
mov qword [0x1401ebc20], rax
lea rcx, [0x1401ebc28]
call fcn.14014b400
jmp 0x1400bc4a7
Function at 0x1400bd2e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1401ebc38]
mov ecx, dword [0x1401ea448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x1400bd518
mov rax, qword [0x1401ebc30]
test rax, rax
je 0x1400bd3ae
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call rax
test eax, eax
je 0x1400bd35e
cmp dword [rsp + 0x2c], 0
setne byte [rsi + 0x89]
je 0x1400bd3b5
mov byte [rsi + 0x88], 0
mov dl, 1
jmp 0x1400bd3d8
mov ecx, 2
call fcn.14003be50
test al, al
je 0x1400bd3ae
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x40]
lea rdx, [0x14019a0ea]
call fcn.140002b70
mov rcx, rbx
call fcn.14003ce70
mov byte [rsi + 0x89], 0
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x88]
cmp byte [rsi + 0x89], 0
setne dl
lea rax, [rsi + 0x38]
lea r9, [rsi + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1400bd570
test al, al
je 0x1400bd40e
cmp byte [rsi + 0x88], 0
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
mov r8, rsi
je 0x1400bd451
call fcn.1400bd760
jmp 0x1400bd456
mov ecx, 2
call fcn.14003be50
test al, al
je 0x1400bd4f9
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x218
mov r9d, 2
call fcn.14003bf00
lea rcx, [rsp + 0x38]
lea rdx, str.GetProcessBasicInformation_failed
jmp 0x1400bd4ec
call fcn.1400bdce0
test al, al
je 0x1400bd4b2
mov dl, byte [rsi + 0x88]
mov rcx, rdi
mov r8, rsi
call fcn.1400bcb30
mov sil, 1
test al, al
jne 0x1400bd4fb
mov ecx, 2
call fcn.14003be50
test al, al
je 0x1400bd4f9
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x226
mov r9d, 2
call fcn.14003bf00
lea rcx, [rsp + 0x38]
lea rdx, str.ReadMemoryInfo_failed
jmp 0x1400bd4ec
mov ecx, 2
call fcn.14003be50
test al, al
je 0x1400bd4f9
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x221
mov r9d, 2
call fcn.14003bf00
lea rcx, [rsp + 0x38]
lea rdx, str.ReadProcessData_failed
call fcn.140002b70
mov rcx, rsi
call fcn.14003c3a0
xor esi, esi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401ebc38]
call fcn.14014b390
mov eax, dword [0x1401ebc38]
cmp eax, 0xffffffff
jne 0x1400bd32b
lea rcx, [0x14019a0d0]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400bcac0
mov qword [0x1401ebc30], rax
lea rcx, [0x1401ebc38]
call fcn.14014b400
jmp 0x1400bd32b
Function at 0x1400c4560
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0xc]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c45f2
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rbp - 0xc]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0xc]
test eax, eax
jne 0x1400c4606
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400c462b
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400c45c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400c460d
cmp eax, 0xffffffff
je 0x1400c4630
mov esi, eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
call fcn.14014b5e0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp - 0xc]
jmp 0x1400c460b
int3

Function at 0x1400c4c40
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rdi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400c4b80
test rax, rax
jne 0x1400c4cd1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400c4cd1
mov ecx, 2
call fcn.14003be50
test al, al
je 0x1400c4ccf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xf3
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x38]
lea rdx, [0x1401aee9e]
call fcn.140002b70
mov rcx, rsi
call fcn.14003ce70
xor esi, esi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x148
pop rdi
pop rsi
ret

Function at 0x1400cc080
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.14016f6e0
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x1400cc0b8
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x1400cc0c8
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400d7280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rdx]
mov rcx, rdi
call fcn.140186380
test rax, rax
je 0x1400d72c7
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs r8, 0x100000001b3
movzx esi, byte [rdi + rdx]
xor rcx, rsi
imul rcx, r8
inc rdx
cmp rax, rdx
jne 0x1400d72ac
and ecx, 0x7fffffff
jmp 0x1400d72cc
mov ecx, 0x4222325
mov edx, 0x1f31d
call fcn.140180d10
imul ecx, eax, 0xfffff4ec
shr rax, 0x20
imul eax, eax, 0x41a7
lea edx, [rax + rcx]
add edx, 0x7fffffff
add eax, ecx
cmovns edx, eax
movsxd rax, edx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400e75c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400e75e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400e75e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret