joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000aee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.140013860
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000af8c
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000af8c
call fcn.140003d10
mov ebx, eax
jmp 0x14000b0b4
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000afad
call fcn.140003d10
jmp 0x14000b0a3
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14000afd0
call fcn.140003d10
jmp 0x14000b0a3
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14000aff2
mov ebx, 0x8007000e
jmp 0x14000b0a5
mov ecx, eax
test eax, eax
je 0x14000b02a
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000b020
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000b02a
lea rcx, [rsp + 0x70]
call fcn.1400033a0
jmp 0x14000b034
mov ecx, 0x80070216
call fcn.140004950
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000b047
cmp qword [rsp + 0x70], 0
jne 0x14000b056
mov ebx, 0x8007000e
jmp 0x14000b0a5
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000b080
call fcn.140003d10
jmp 0x14000b0a3
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14000ac00
mov ebx, eax
test rdi, rdi
je 0x14000b0b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000b0cb
lea rcx, [rsp + 0x70]
call fcn.1400068a0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140013750
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000bf80
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140013750
add rsp, 0x48
ret

Function at 0x14000c090
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x14000c0a8
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000c0b4
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x14000c0b0
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x14000c7b0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x14000c7f4
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140013750
add rsp, 0x40
pop rbx
ret
lea rax, [rsp + 0x30]
lea r8, [0x140008670]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14000c835
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140013750
add rsp, 0x40
pop rbx
ret

Function at 0x14000d200
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14003ae59], 0
mov esi, edx
mov rdi, rcx
je 0x14000d226
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x14000d268
cmp eax, 0x80010106
jne 0x14000d2a4
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14000d26c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rax
call fcn.1400093f0
cmp al, 1
jne 0x14000d294
mov edx, esi
mov rcx, rdi
call fcn.14000be00
mov ebx, eax
jmp 0x14000d298
mov ebx, dword [rsp + 0x40]
cmp byte [rdi + 0x62], 0
je 0x14000d2a4
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000dff0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
xor ebx, ebx
lea r8, str.GSDBFB22DB52F7
lea edx, [rbx + 1]
xor ecx, ecx
mov edi, r9d
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e08b
xor ecx, ecx
mov qword [0x14003c8f0], rbp
call fcn.140008270
test al, al
je 0x14000e050
lea rcx, [0x14003af70]
mov edx, edi
call fcn.14000d200
mov ebx, eax
mov rdi, qword [0x14003c8f0]
lea rdx, str._profile
mov rcx, rdi
call fcn.140012850
test rax, rax
jne 0x14000e07f
lea rdx, str._import
mov rcx, rdi
call fcn.140012850
test rax, rax
je 0x14000e08b
mov rcx, qword [0x14003c8f0]
call fcn.140007730
test rsi, rsi
je 0x14000e099
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000e5d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea rax, [rsp + 0x30]
mov rbx, rdx
mov rdx, rcx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x3c], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x38], 4
test eax, eax
jne 0x14000e699
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Install
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x30]
lea rdx, str.Release
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000e69b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000e69b
mov dword [rbx], edi
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140013750
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000f470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, qword [0x14003cab0]
mov r14, rcx
movzx edx, dx
mov r8d, 0xf0
mov rcx, rbx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000f69d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000f69d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000f69d
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
mov r13d, 0x403
mov r12d, 0x1234
xor r15d, r15d
mov qword [rsp + 0x2f0], rbp
nop dword [rax]
movzx esi, word [rbx]
cmp r15w, si
je 0x14000f657
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r13w, ax
jne 0x14000f5cb
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.140013860
lea rax, [rsp + 0x188]
lea rcx, [rsp + 0x180]
mov r8d, 3
mov rdx, rbx
mov qword [rsp + 0x180], rax
call fcn.14000fa40
mov rax, qword [rsp + 0x180]
mov rcx, qword [r14 + 8]
movzx edx, si
xor r9d, r9d
mov r8d, 0x143
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rsp + 0x180]
cmp rax, 0xffffffffffffffff
lea rax, [rsp + 0x188]
cmove edi, r15d
cmp rcx, rax
je 0x14000f64c
call fcn.140012450
jmp 0x14000f64c
cmp r12w, ax
jne 0x14000f64c
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov r8d, 3
mov rdx, rbx
mov dword [rsp + 0x140], 1
mov qword [rsp + 0x148], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
call fcn.14000fa40
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x150], rcx
cmp rcx, rax
je 0x14000f621
call fcn.140012450
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x140]
movzx edx, si
xor r9d, r9d
mov r8d, 0x40b
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
add rbx, rbp
test edi, edi
jne 0x14000f520
mov rbp, qword [rsp + 0x2f0]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140013750
add rsp, 0x2c0
pop r14
pop rdi
pop rbx
ret
mov eax, edi
jmp 0x14000f681
Function at 0x14000f7e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x830], rax
lea rdx, [rsp + 0x20]
lea rcx, str.SOFTWAREWow6432NodeMicrosoftNET_Framework_SetupNDP_v4Full
mov dword [rsp + 0x20], 0
call fcn.14000e5d0
lea rdx, [rsp + 0x20]
lea rcx, str.SOFTWAREWow6432NodeMicrosoftNET_Framework_SetupNDP_v4Client
call fcn.14000e5d0
xor edi, edi
cmp dword [rsp + 0x20], 0x5c615
lea rcx, [rsp + 0x30]
mov edx, 0x800
setae dil
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rbx, qword [0x14003c8f0]
lea rdx, str.customApp
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbx + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x14000f8dc
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000f8dc
add rcx, 2
cmp rcx, 0xa
jne 0x14000f860
lea rbx, [0x14003c080]
lea r8, [rsp + 0x30]
mov edx, 0x400
mov rcx, rbx
call fcn.140012718
lea r8, [0x140028944]
lea rcx, [0x14003b810]
mov edx, 0x432
call fcn.140012718
mov edx, 0x432
mov rcx, rbx
lea r8, str.CustomModeApp.exe
test edi, edi
jne 0x14000f8cb
lea r8, str.CustomModeAppv2_0.exe
call fcn.140012690
mov qword [0x14003c8e8], rbx
jmp 0x14000fa1c
xor ecx, ecx
lea rdx, str.dpApp
nop word [rax + rax]
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14000f960
cmp rcx, 6
jne 0x14000f8f0
lea rbx, [0x14003c080]
lea r8, [rsp + 0x30]
mov edx, 0x400
mov rcx, rbx
call fcn.140012718
lea r8, [0x140028944]
lea rcx, [0x14003b810]
mov edx, 0x432
call fcn.140012718
mov edx, 0x432
mov rcx, rbx
lea r8, str.DPTopologyApp.exe
test edi, edi
jne 0x14000f94f
lea r8, str.DPTopologyAppv2_0.exe
call fcn.140012690
mov qword [0x14003c8e8], rbx
jmp 0x14000fa1c
lea rdx, str._profile
mov rcx, rbx
call fcn.140012850
test rax, rax
jne 0x14000fa1c
lea rdx, str._import
mov rcx, rbx
call fcn.140012850
test rax, rax
jne 0x14000fa1c
lea r8, [rsp + 0x30]
lea rcx, [0x14003b810]
mov edx, 0x400
call fcn.140012718
lea r8, [0x140029fc0]
lea rcx, [0x14003c080]
mov edx, 0x432
call fcn.140012718
mov qword [0x14003c8e8], 0
mov edx, 0x432
lea rcx, [0x14003b810]
lea r8, str.Gfxv4_0.exe
test edi, edi
jne 0x14000f9e7
lea r8, str.Gfxv2_0.exe
call fcn.140012690
lea r8, [0x14002a004]
lea rcx, [0x14003b810]
mov edx, 0x432
call fcn.140012690
mov r8, qword [0x14003c8f0]
lea rcx, [0x14003b810]
mov edx, 0x432
call fcn.140012690
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140013750
mov rbx, qword [rsp + 0x850]
add rsp, 0x840
pop rdi
ret
Function at 0x14000fc10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea r8, str.SPLASH
mov edx, 0xca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov edx, eax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
xor r12d, r12d
mov qword [rbp - 0x31], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
mov r9d, edi
mov r8, rbx
mov edx, edi
call fcn.140012608
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rbp - 0x31]
lea edx, [r12 + 1]
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp qword [rbp - 0x31], r12
je 0x14000fdc2
test r14, r14
je 0x14000fdc2
xor edx, edx
lea r8d, [r12 + 0x50]
lea rcx, [rbp - 0x29]
call fcn.140013860
lea rax, vtable.ATL::CImage.0
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], r12
mov word [rbp - 1], r12w
mov qword [rbp + 3], 0xffffffffffffffff
mov qword [rbp + 0xf], r12
mov dword [rbp + 0x17], r12d
mov qword [rbp + 0x1f], r12
call fcn.14000f760
mov rbx, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x30]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x31]
lea rcx, [rbp - 0x29]
call fcn.14000fe60
mov rax, qword [rbp - 0x21]
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], r12
mov qword [rbp + 3], 0xffffffffffffffff
mov word [rbp - 1], r12w
test rax, rax
je 0x14000fda5
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov edx, 0xcc
mov r8d, 0x172
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
call qword [rax + SafeArrayGetElemsize]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
lea rcx, [rbp - 0x29]
call fcn.14000e290
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140013750
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000fdf0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r9, [0x14003c950]
mov qword [rsp + 0x28], rax
lea r8, [0x14000e480]
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000fe3b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140013750
add rsp, 0x48
ret
Function at 0x14158f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14158f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14158f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14158f06f
add dl, dl
jne 0x14158f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14158f0f6
xor eax, eax
add dl, dl
jne 0x14158f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14158f1ad
add dl, dl
jne 0x14158f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14158f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14158f07e
mov eax, 1
add dl, dl
jne 0x14158f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14158f0fb
sub eax, ebx
mov ebx, 1
jne 0x14158f14c
mov ecx, 1
add dl, dl
jne 0x14158f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14158f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14158f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14158f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14158f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14158f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14158f15d
cmp eax, 0x7d00
jae 0x14158f19b
cmp eax, 0x500
jb 0x14158f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14158f07e
cmp eax, 0x7f
ja 0x14158f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14158f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14158f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14158f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
jnp 0x14003f5ce
add eax, 0xedc9b4fc
invalid
ja 0x14003f5d0
js 0x14003f68e
mov byte [rax - 0x57], ah
xchg byte [rdx], ah
mov ch, 0x1c
js 0x14003f62d
test byte [rsi - 0x40], bh
invalid
mov ebp, 0xc6b362c4
sahf
and eax, dword [rdi]
invalid
jmp 0xf99c0b08
invalid
adc al, 0xc6
invalid
push rbp
enter 0x32a4, 0x3c
invalid
invalid
and dword [rax*8 + 0x30e2f660], edx
invalid
xor byte [rsi], al
int1
xchg rdx, rax
and byte [rdx + 0x65], dl
sbb al, 0xdf
movabs dword [0x75dd0e3c08d1a8da], eax
sbb esi, ebx
out 0x87, eax
sbb dword [rbx], ebx
sbb al, 0xa6
push rdx
mov esp, dword [rbx - 0x4a]
neg bh
jge 0x14003f6cd
invalid
invalid
Function at 0x140006a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140006ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140006ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140006aad
mov qword [rsi], rdi
call fcn.140006670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.plugin_container.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov edi, cs
sub eax, 0xe1955fc
and eax, 0x4fcfe4e9
fsubr qword [rsp + riz*8 + 0x46]
invalid
test al, 0x2b
mov al, 0xb0
stosq qword [rdi], rax
mov ah, 0xee
loopne 0x140078c37
xchg esi, eax
int3
std
mov esp, 0x7abf6c9e
std
and al, 0x4f
wait
adc r11b, byte [rdx]
xchg esi, eax
push rax
test byte [rax + 0x7a], dh
imul esp, esi, 0x28
invalid
invalid

Function at 0x140006b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140006bd0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
jmp 0x140006b98
add rdi, rbx
sub rsi, rbx
je 0x140006bd0
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140006b90
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.1400016f0
mov rcx, r12
call fcn.1400017f0
jmp 0x140006b90
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400365a0
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret