joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb9bd30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xb9bd3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xb9bd4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xb9bd35
lea eax, [rcx + 1]
jmp 0xb9bd5b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xb9bd6e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xb9bd54
sub eax, 3
jb 0xb9bd8e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xb9bddd
sar eax, 1
movsxd rbp, eax
jb 0xb9bdc4
jmp 0xb9bd9c
add ebx, ebx
jne 0xb9bd9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb9bdc4
inc ecx
add ebx, ebx
jne 0xb9bdaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb9bdc4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xb9bdbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xb9bdac
add ecx, 2
jmp 0xb9bdc9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00b9bcf2
jmp 0xb9bd3d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x37d800
mov dl, 0x35
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xb9be29
cmp rsi, rcx
jae 0xb9be31
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xb9be10
cmp al, 0x8f
ja 0xb9be10
cmp byte [rsi - 2], 0xf
je 0xb9be16
sub al, 0xe8
cmp al, 1
ja 0xb9bdfa
cmp rsi, rcx
jae 0xb9be31
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xb9be00
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xb9be31
lodsb al, byte [rsi]
jmp 0xb9be10
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x781000]
mov eax, dword [rdi]
or eax, eax
je 0xb9be8e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7a99f4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xb9be3e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xb9be88
mov qword [rbx], rax
add rbx, 8
jmp 0xb9be5e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xb9bec8
cmp al, 0xef
ja 0xb9beba
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xb9be9a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0xb9bea9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xb9bf1c
sub rsp, 0xffffffffffffff80
jmp 0x7678a0
Function at 0x1400082b0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1402e3fb8]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x1400082e5
jnp 0x140008309
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401ce5b0
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1402e3fc8]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000841e
mov eax, dword [0x1402e3fd8]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008458
rdtsc
mov rdi, rax
mov rbx, rdx
xor r15d, r15d
lea r14, [rsp + 0x20]
mov qword [r14], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r14], r15
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r12, qword [0x1402e3fd0]
xorps xmm0, xmm0
cvtsi2sd xmm0, r12
cvtsi2sd xmm1, qword [rsi]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x1402a8c88]
ucomisd xmm1, xmm0
ja 0x1400082e5
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1402e3fc0]
movq xmm6, rdi
punpckldq xmm6, xmmword [0x1402a28e0]
subpd xmm6, xmmword [0x1402a28f0]
haddpd xmm6, xmm6
divsd xmm6, xmm0
movsd qword [0x1402e3fb8], xmm6
jmp 0x1400082e5
lea rcx, [0x1402e3fc8]
call fcn.1401cc16c
cmp dword [0x1402e3fc8], 0xffffffff
jne 0x140008352
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1402e3fc0], rdx
lea rcx, [0x1402e3fc8]
call fcn.1401cc1d4
jmp 0x140008352
lea rcx, [0x1402e3fd8]
call fcn.1401cc16c
cmp dword [0x1402e3fd8], 0xffffffff
jne 0x140008377
lea rdi, [rsp + 0x20]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov qword [0x1402e3fd0], rax
lea rcx, [0x1402e3fd8]
call fcn.1401cc1d4
jmp 0x140008377
Function at 0x14000ae90
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x14000aeb6
call fcn.14017a3f0
cmp qword [rsi], rbx
je 0x14000aee5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14000aef2
cmp r14, 2
jb 0x14000aedd
mov qword [rsi], rbx
call fcn.14017a3f0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14017a3f0
mov rcx, qword [rsi]
call fcn.14017b060
mov qword [rsi], 0
jmp 0x14000aecf

Function at 0x14000bdd0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x14000bf6a
mov rbx, r9
mov edi, r8d
mov r15d, edx
mov rsi, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov r14, rax
cmp qword [rsi], rax
je 0x14000be56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14000bf47
mov rax, r14
inc rax
cmp rax, 2
jb 0x14000be4b
mov qword [rsi], r14
call fcn.14017a3f0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
lea rax, [r14 + 1]
cmp rax, 1
jbe 0x14000bf89
xor ebp, ebp
lea rcx, [rsp + 0x30]
mov r8d, 0x90
xor edx, edx
call fcn.1401d06e0
test r15d, r15d
jne 0x14000bf1f
mov ecx, 0xff
mov ebp, 0x408
mov dword [rsp + 0x58], 1
mov eax, ebp
mov dword [rsp + 0x2c], ecx
mov ebp, ecx
test rbx, rbx
je 0x14000bead
or eax, 0x100
mov qword [rsp + 0xa0], rbx
or eax, 0x2000
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x30]
mov rcx, r14
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14000bf60
not edi
and ebp, edi
lea r8, [rsp + 0x2c]
mov dword [r8], ebp
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x14000bf60
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec r15d
cmp r15d, 3
ja case.default.0x14000bf36
lea rax, [0x1402b96fc]
movsxd rcx, dword [rax + r15*4]
add rcx, rax
jmp rcx
mov ecx, 0xd8
mov ebp, 8
jmp 0x14000be8b
call fcn.14017a3f0
mov rcx, qword [rsi]
call fcn.14017b060
mov qword [rsi], 0
jmp 0x14000be37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000befd
mov esi, 0x4df
jmp 0x14000befd
mov esi, 0xa0
jmp 0x14000befd
xor eax, eax
jmp 0x14000be9b
mov ecx, 0xc8
jmp 0x14000be93
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x14000e760
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x1402cb038]
xor rdx, rsp
mov qword [rsp + 0x40], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x38]
mov qword [r8], rdx
or r9d, 8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14000e832
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14000e832
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14000e82e
call fcn.14017a3f0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
mov bpl, 1
test rbx, rbx
je 0x14000e811
cmp rbx, 0xffffffffffffffff
je 0x14000e839
call fcn.14017a3f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsi], rbx
call fcn.14017a3f0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x14000e7d7
mov byte [rsi], 0
xor ebp, ebp
jmp 0x14000e811
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000e809
Function at 0x140014eb0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140014efc
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140014f07
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140014eea
mov qword [rdi], rsi
call fcn.14017a3f0
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14017a3f0
mov r14, qword [rdi]
cmp qword [0x1402e5b90], 0
je 0x140014f38
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402f5008]
mov qword [rdi], 0
jmp 0x140014ed8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014f79
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140014f73
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x140014f19
xor ecx, ecx
mov dl, 1
jmp 0x140014f6c
xor ecx, ecx
jmp 0x140014f6a
Function at 0x1400157a0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x338
mov r13d, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x330], rax
lea r14, [rsp + 0x68]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1401d06e0
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.140015b70
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14029ca60]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.140180d40
movzx eax, byte [rdi + 0x17]
test al, al
js 0x14001583d
mov ecx, eax
and ecx, 0x7f
jmp 0x140015842
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140015904
lea r14, [rsp + 0x68]
lea r15, [rsp + 0x38]
xor r12d, r12d
cmp byte [rsp + 0x68], 0
je 0x140015985
mov ebx, dword [rsp + 0x6c]
test bl, 1
jne 0x14001598f
test bl, 0x10
jne 0x140015949
cmp byte [rsp + 0x67], 0
mov rcx, rdi
jns 0x140015888
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140015942
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
mov rdx, r15
call fcn.140180d40
cmp byte [rsp + 0x67], 0
jns 0x1400158cf
mov rcx, qword [rsp + 0x50]
call fcn.1401cbbbc
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x50], xmm0
movzx eax, byte [rsp + 0x67]
test al, al
js 0x1400158f3
mov ecx, eax
and ecx, 0x7f
jmp 0x1400158f8
mov rcx, qword [rsp + 0x58]
mov r12d, ebp
test rcx, rcx
jne 0x140015858
test al, al
jns 0x140015912
mov rcx, qword [rsp + 0x50]
call fcn.1401cbbbc
lea rcx, [rsp + 0x68]
call fcn.1400159e0
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebp
add rsp, 0x338
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x1400158ac
xor ebp, ebp
test r13b, r13b
je 0x1400158ac
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.1400157a0
test eax, eax
jne 0x1400159bf
cmp byte [rsp + 0x67], 0
mov rcx, rdi
jns 0x140015975
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400158ac
jmp 0x1400159c6
call fcn.1402074e0
jmp 0x140015879
test bl, 0x10
je 0x14001599f
xor ebp, ebp
test r13b, r13b
je 0x1400158ac
test al, al
js 0x1400159aa
lea rcx, [rsp + 0x50]
jmp 0x1400159af
mov rcx, qword [rsp + 0x50]
mov edx, ebx
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140015870
mov ebp, eax
jmp 0x1400158ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x1400158ac
Function at 0x140018090
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x14029ca60]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, [0x1402a9233]
lea r8, str.file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x4ea
call fcn.140158eb0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1401a26e0
test byte [0x1402d90d0], 0x19
jne 0x14001813f
cmp byte [rsi + 0x17], 0
jns 0x14001810a
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea rcx, [rsp + 0x40]
call fcn.140181760
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x80]
mov qword [rdx], rdi
lea rcx, str.ScopedBlockingCall
call fcn.1402380c0
jmp 0x140018101

Function at 0x140018160
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2b8
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
movaps xmm0, xmmword [0x14029ca60]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, [0x1402a921e]
lea r8, str.file_util_win.cc
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov r9d, 0x4da
call fcn.140158eb0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1401a26e0
test byte [0x1402d90d0], 0x19
jne 0x1400182b0
lea rbx, [rsp + 0xa0]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401d06e0
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x14001827e
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1401cc340
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1401b5140
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140027b20
cmp byte [rsi + 0x17], 0
jns 0x140018250
mov rcx, qword [rsi]
call fcn.1401cbbbc
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x14001827e
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x60]
call fcn.140181760
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, [rsp + 0x48]
mov qword [rdx], rdi
lea rcx, str.ScopedBlockingCall
call fcn.1402380c0
jmp 0x1400181da
Function at 0x1400194d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402dc600]
test rax, rax
jne 0x140019529
cmp byte [0x1402dc608], 0
jne 0x140019543
mov byte [0x1402dc608], 1
lea rcx, str.bcryptprimitives.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140019575
lea rdx, str.ProcessPrng
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402dc600], rax
test rax, rax
je 0x140019543
mov rcx, rdi
mov rdx, rsi
call qword [0x1402f5008]
test eax, eax
je 0x140019572
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
test rsi, rsi
je 0x140019539
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140019578
add rdi, rbx
sub rsi, rbx
jne 0x14001954e
jmp 0x140019539
int3
int3
int3
Function at 0x14001bdc0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x1402e4048]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001be6b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x20], rax
mov rax, qword [0x1402e4040]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x14001bebe
mov edx, 8
call qword [0x1402f5008]
test eax, eax
je 0x14001bed3
movabs rax, 0x1fffffffffffff
and rax, qword [rsp + 0x20]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401ce5b0
movapd xmm0, xmm6
mov edx, 0xffffffcb
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
jmp 0x1401ecbfc
lea rcx, [0x1402e4048]
call fcn.1401cc16c
cmp dword [0x1402e4048], 0xffffffff
jne 0x14001bdf9
lea rcx, str.bcryptprimitives.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14001bed6
lea rdx, str.ProcessPrng
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e4040], rax
lea rcx, [0x1402e4048]
call fcn.1401cc1d4
jmp 0x14001bdf9
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14001be30
int3
int3
int3
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
movsd qword [rax + 8], xmm0
push rdi
sub rsp, 0x40
mov ebx, edx
movaps xmmword [rax - 0x18], xmm6
mov esi, 0xffc0
mov ecx, 0x1f80
mov edx, esi
movaps xmm6, xmm0
call fcn.1401fd408
movzx ecx, word [rsp + 0x56]
mov rdi, rax
mov eax, 0x7ff0
and cx, ax
cmp cx, ax
jne 0x1401ecc8f
movaps xmm0, xmm6
call fcn.140202790
sub eax, 1
je 0x1401ecc7c
sub eax, 1
je 0x1401ecc7c
movaps xmm0, xmm6
cmp eax, 1
je 0x1401ecc6c
addsd xmm0, qword [0x140290688]
mov ecx, 8
jmp 0x1401ecd33
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
call fcn.140201fbc
movaps xmm6, xmm0
mov rdx, rsi
mov rcx, rdi
call fcn.1401fd408
movaps xmm0, xmm6
jmp 0x1401ecd53
ucomisd xmm6, qword [0x140290870]
jp 0x1401ecc9b
je 0x1401ecc7c
lea rdx, [rsp + 0x60]
movaps xmm0, xmm6
call fcn.140202808
mov ecx, dword [rsp + 0x60]
test ebx, ebx
jns 0x1401eccbd
mov eax, 0x80000000
sub eax, ebx
cmp ecx, eax
jl 0x1401eccf0
jmp 0x1401eccc8
mov eax, 0x7fffffff
sub eax, ebx
cmp ecx, eax
jg 0x1401ecd1e
lea edx, [rcx + rbx]
cmp edx, 0xa00
jg 0x1401ecd1e
cmp edx, 0x400
jle 0x1401ecce8
add edx, 0xfffffa00
call fcn.140202758
jmp 0x1401ecd2e
cmp edx, 0xfffff603
jge 0x1401eccff
mulsd xmm0, qword [0x140290870]
mov ecx, 0x12
jmp 0x1401ecd33
cmp edx, 0xfffffc03
jge 0x1401ecd14
add edx, 0x600
call fcn.140202758
jmp 0x1401eccf8
call fcn.140202758
jmp 0x1401ecc79
movaps xmm1, xmm0
movsd xmm0, qword [0x140296498]
call fcn.140202938
mov ecx, 0x11
movd xmm3, ebx
movaps xmm2, xmm6
cvtdq2pd xmm3, xmm3
mov qword [rsp + 0x28], rdi
mov edx, 0x19
movsd qword [rsp + 0x20], xmm0
call fcn.140201eb4
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x14001ecd0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14001ed19
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14001ed35
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001ed11
mov qword [rsi], rdi
call fcn.14017a3f0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14001eda7
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14017a3f0
mov r14, qword [rsi]
cmp qword [0x1402e5b90], 0
je 0x14001ed66
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402f5008]
mov qword [rsi], 0
jmp 0x14001ecff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001edaa
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14001eda1
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14001ed47
xor ecx, ecx
mov dl, 1
jmp 0x14001ed9a
int3
xor ecx, ecx
jmp 0x14001ed98

Function at 0x1400207e0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1402e5ab0]
test rdi, rdi
jne 0x140020893
mov ecx, 0x50
call fcn.1401cbbc4
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1401cbbc4
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x1400208b5
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x1402e5ab0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400208b8
mov rcx, rax
call fcn.1401cc340
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14019f770
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
int3