joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f3660
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x190], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x48]
mov qword [rbx], r14
mov rdx, rbx
call fcn.14007da30
mov r12, qword [rbx]
test r12, r12
je 0x1401f3746
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], r14
movaps xmm0, xmmword [0x1402cdfe0]
movaps xmmword [rcx], xmm0
call fcn.14005f440
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x50], xmm0
mov rbx, qword [r12 + 0x50]
mov r15, qword [r12 + 0x58]
cmp rbx, r15
je 0x1401f3702
lea r14, [rsp + 0x50]
mov rcx, rbx
mov rdx, r14
call fcn.1401f4ff0
test al, al
jne 0x1401f36fd
add rbx, 0x70
cmp rbx, r15
jne 0x1401f36e5
mov r15, qword [r12 + 0x58]
cmp rbx, r15
jne 0x1401f374d
mov esi, 1
lea rcx, [rsp + 0x30]
call fcn.14006c480
lea rcx, [rsp + 0x48]
call fcn.14007e480
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140110970
mov eax, esi
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 3
jmp 0x1401f3716
lea rdx, [rbx + 0x10]
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.14006c490
mov r13, qword [r12 + 0x58]
cmp r13, rbx
je 0x1401f38b9
lea rcx, [r12 + 0x50]
lea rbp, [rbx + 0x70]
mov rdx, rbx
cmp rbp, r13
je 0x1401f379b
mov qword [rsp + 0x28], rcx
xor r15d, r15d
jmp 0x1401f3822
add rbp, 0xffffffffffffff90
mov rdx, rbp
lea r14, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
sub rdx, rbx
add rdx, rbx
call fcn.1401f46f0
mov byte [r12 + 0x48], 1
cmp byte [rsp + 0x47], 0
jns 0x1401f37b8
mov r14, qword [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1401f3843
mov rcx, rdi
mov rdx, rsi
call fcn.140244cc0
xor esi, esi
jmp 0x1401f370c
mov rcx, qword [r14]
call fcn.14010f42c
mov rax, qword [rbp + 0x38]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rbp + 0x28]
movups xmmword [r14], xmm0
mov byte [rbp + 0x3f], r15b
mov byte [rbp + 0x28], r15b
movups xmm0, xmmword [rbp + 0x40]
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0x68]
mov dword [rbp - 8], eax
add rbp, 0x70
cmp rbp, r13
je 0x1401f378a
movups xmm0, xmmword [rbp]
movups xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x10]
call fcn.14006c4f0
lea r14, [rbp - 0x48]
cmp byte [rbp - 0x31], 0
jns 0x1401f37df
jmp 0x1401f37d7
mov esi, 2
mov ecx, 2
call fcn.14006a140
test al, al
je 0x1401f370c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x50]
mov esi, 2
mov rcx, rdi
mov r8d, 0x36f
mov r9d, 2
call fcn.14018e580
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.1400cdd30
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140190050
mov rcx, rdi
call fcn.14018e5f0
jmp 0x1401f370c
ud2
Function at 0x1401fa6a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x1401fa6ff
xor r11d, r11d
mov rsi, qword [r8 + r11*8]
mov rdi, qword [rcx + r11*8]
mov rbx, rdi
xor rbx, rsi
lea r14, [rbx - 1]
mov r15, rdi
sub r15, rsi
xor r15, rdi
or r15, rbx
not rbx
and r14, rbx
sar r14, 0x3f
xor r15, rdi
sar r15, 0x3f
or r15, 1
xor rax, r15
and rax, r14
xor rax, r15
inc r11
cmp r10, r11
jne 0x1401fa6bb
cmp rdx, r9
jb 0x1401fa730
jbe 0x1401fa752
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x1401fa709
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
xor eax, 1
and eax, r8d
xor eax, 1
jmp 0x1401fa752
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x1401fa732
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
not ecx
or eax, ecx
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401fa7f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd rax, dword [rdx + 8]
cmp r9d, eax
jge 0x1401fa815
mov r10, qword [rdx]
xor r8d, r8d
mov r11, r9
or r8, qword [r10 + r11*8]
inc r11
cmp rax, r11
jne 0x1401fa807
jmp 0x1401fa818
xor r8d, r8d
cmp eax, r9d
jge 0x1401fa82f
mov r10, qword [rcx]
mov r11, rax
or r8, qword [r10 + r11*8]
inc r11
cmp r9, r11
jne 0x1401fa823
cmp r9d, eax
cmovl eax, r9d
test eax, eax
jle 0x1401fa858
mov r9, qword [rcx]
mov r10, qword [rdx]
mov eax, eax
xor r11d, r11d
mov rsi, qword [r10 + r11*8]
xor rsi, qword [r9 + r11*8]
or r8, rsi
inc r11
cmp rax, r11
jne 0x1401fa845
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x140200410
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x140200468
mov rsi, rcx
mov rcx, qword [rdx]
xor r8d, r8d
xor r9d, r9d
or r9, qword [rcx + r8*8]
inc r8
cmp rax, r8
jne 0x14020042b
test r9, r9
je 0x140200468
test eax, eax
jle 0x140200448
mov rcx, qword [rdx]
test byte [rcx], 1
jne 0x140200494
mov dword [rsp + 0x20], 0xae
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x140200486
mov dword [rsp + 0x20], 0xaa
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.140248470
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [rdx + 0x10], 0
je 0x1402004ba
mov dword [rsp + 0x20], 0xb2
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x140200486
cmp eax, 0x401
jb 0x1402004fb
mov r9d, 0x400
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rax, r9
jne 0x1402004ca
test r8, r8
je 0x1402004fb
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x140200486
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.1401fa1f0
test rax, rax
je 0x1402005ac
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x1402005a3
mov rcx, qword [rdi]
mov edx, eax
cmp qword [rcx + rdx*8 - 8], 0
jne 0x1402005a7
lea edx, [rax - 1]
cmp eax, 1
mov eax, edx
jg 0x14020051e
mov dword [rsi + 0x20], 0
mov dword [rsi + 0x28], 0
mov rax, qword [rdi]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x14020055d
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
jmp 0x14020048b
jne 0x140200540
jmp 0x140200539
mov dword [rsi + 0x20], eax
jmp 0x140200540
mov dword [rsp + 0x20], ILCreateFromPathW
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x140200486
Function at 0x140201870
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
movsxd rdx, dword [rcx + 8]
test rdx, rdx
jle 0x1402019ee
mov rcx, qword [rcx]
shl rdx, 6
xor r8d, r8d
xor eax, eax
xor r9d, r9d
mov rdi, qword [rcx]
mov r11, rdi
shl r11, 0x20
mov r10, r11
not r10
dec r11
and r11, r10
sar r11, 0x3f
mov r10, rdi
shr r10, 0x20
mov rbx, r11
and r10d, ebx
not rbx
and rbx, rdi
or rbx, r10
lea r10, [rdi - 1]
mov rsi, rbx
shl rsi, 0x30
mov r14, rsi
mov r15, rdi
not r14
dec rsi
and rsi, r14
sar rsi, 0x3f
mov rdi, rbx
shr rdi, 0x10
mov r14, rsi
xor rdi, rbx
and rdi, r14
xor rdi, rbx
not r15
mov rbx, rdi
shl rbx, 0x38
mov r14, rbx
and r10, r15
not r14
dec rbx
and rbx, r14
sar rbx, 0x3f
mov r15, rdi
shr r15, 8
mov r14, rbx
xor r15, rdi
and r15, r14
xor r15, rdi
sar r10, 0x3f
mov r14, r15
shl r14, 0x3c
mov r12, r14
mov rdi, r10
not r12
dec r14
and r14, r12
sar r14, 0x3f
mov r13, r15
shr r13, 4
mov r12, r14
xor r13, r15
and r13, r12
xor r13, r15
not rdi
mov r15, r13
shl r15, 0x3e
mov r12, r15
or rdi, r9
not r12
dec r15
and r15, r12
sar r15, 0x3f
mov rbp, r15
mov r12d, r13d
shr r12d, 2
xor r12d, r13d
and r12d, ebp
xor r12d, r13d
shl r12, 0x3f
mov r13, r12
dec r12
and r11d, 0x20
not r13
and esi, 0x10
or esi, r11d
and ebx, 8
and r12, r13
or ebx, esi
and r14d, 4
or r14d, ebx
shr r12, 0x3f
and r15d, 2
or r15d, r14d
or r12d, r15d
add r12d, r8d
or r9d, r10d
not r9d
and r9d, r12d
or eax, r9d
add r8, 0x40
add rcx, 8
mov r9, rdi
cmp rdx, r8
jne 0x140201898
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1402019e1
Function at 0x140204720
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movups xmmword [rdi + 0x5c], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x1402f25a0]
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [0x1402f25b0]
movups xmmword [rdi + 0x10], xmm0
mov dword [rdi + 0x6c], 0x20
mov rcx, rdi
call fcn.140083b70
mov edx, dword [rdi + 0x6c]
mov rcx, rsi
mov r8, rdi
call fcn.140210200
mov edx, 0x70
mov rcx, rdi
call fcn.1400e97c0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140110970
mov rax, rsi
add rsp, 0x98
pop rdi
pop rsi
ret

Function at 0x1402047c0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.1400837f0
mov edx, dword [rdi + 0xd4]
mov rcx, rsi
mov r8, rdi
call fcn.140083d40
mov edx, 0xd8
mov rcx, rdi
call fcn.1400e97c0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140110970
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x140205640
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x14020ae50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x78], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x14020aeae
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14020aeca
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x14020aef4
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14020af15
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x14020af37
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x14020af5d
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x14020af5b
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
sub r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1401496f0
mov r13, r15
not r13
mov r8, r12
xor r8, r15
dec r8
and r8, r13
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.140207250
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x14020af9b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x1402cdfe0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
movsxd rcx, dword [rdi + 0x148]
test rcx, rcx
jle 0x14020b068
xor eax, eax
xor edx, edx
or rdx, qword [rsi + rax*8]
inc rax
cmp rcx, rax
jne 0x14020b00c
test rdx, rdx
sete dl
test ecx, ecx
je 0x14020b0b8
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x14020b040
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x14020b040
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
test rax, rax
jle 0x14020b087
xor ecx, ecx
jmp 0x14020b07c
mov dl, 1
jmp 0x14020b01e
xor r8d, r8d
mov qword [rsp + rcx*8 + 0x30], r8
inc rcx
cmp rax, rcx
je 0x14020b087
test dl, dl
jne 0x14020b06c
mov r8, qword [rsp + rcx*8 + 0x30]
jmp 0x14020b06f
test eax, eax
je 0x14020b0b8
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x14020b09a
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140110970
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140223e80
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x140223eb5
mov rax, qword [r8 + 8]
mov r8, qword [r8]
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
test rax, rax
js 0x140223f70
sete al
test r8, r8
setne cl
or cl, al
je 0x140223f70
lea rsi, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140062f10
cmp byte [rsi + 0x17], 0
jns 0x140223ef6
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.140062f10
cmp byte [rdi + 0x17], 0
jns 0x140223f1b
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x140223f3a
mov rcx, qword [rsp + 0x48]
call fcn.14010f42c
cmp byte [rsp + 0x87], 0
jns 0x140223f4e
mov rcx, qword [rsp + 0x70]
call fcn.14010f42c
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x14022e670
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
lea rbx, [rcx + 0x38]
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14022e6a7
mov qword [rbx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14033dc40]
lea r12, [rdi + 0x30]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x14022e6c9
mov qword [r12], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14033dc40]
mov qword [rsp + 0x20], r12
lea rcx, [0x1402c3208]
lea r9, [0x1402fa4d0]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov r15, qword [r12]
test eax, eax
js 0x14022e75e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14022e70e
mov qword [rbx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14033dc40]
mov rax, qword [r15]
mov rax, qword [rax + 0x90]
mov rcx, r15
mov rdx, rbx
call qword [0x14033dc40]
test eax, eax
js 0x14022e746
mov rcx, rdi
mov rdx, r14
call fcn.14003a070
add rdi, 0x18
mov rcx, rdi
mov rdx, rsi
call fcn.14006c490
mov al, 1
jmp 0x14022e77d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14022e77b
mov qword [rbx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
jmp 0x14022e775
test r15, r15
je 0x14022e77b
mov qword [r12], 0
mov rax, qword [r15]
mov rax, qword [rax + 0x10]
mov rcx, r15
call qword [0x14033dc40]
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140233220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rax
jmp fcn.140233970

Function at 0x140237760
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov r8d, 6
call fcn.14025fcb0
test eax, eax
je 0x140237893
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
cmp rsi, rax
jne 0x1402377d7
lea rbx, [0x140327588]
test al, al
je 0x140237895
lea rdx, [0x14032758c]
mov rcx, rdi
mov r8, rsi
call fcn.140148f50
test eax, eax
je 0x140237895
movzx eax, byte [reloc.OLEAUT32.dll_VariantInit]
cmp rsi, rax
jne 0x14023780c
lea rbx, [0x1402fa938]
test al, al
je 0x140237895
lea rdx, [0x1402fa93c]
mov rcx, rdi
mov r8, rsi
call fcn.140148f50
test eax, eax
je 0x140237895
movzx eax, byte [reloc.OLEAUT32.dll_VariantInit]
cmp rsi, rax
jne 0x140237839
lea rbx, [0x140327668]
test al, al
je 0x140237895
lea rdx, [0x14032766c]
mov rcx, rdi
mov r8, rsi
call fcn.140148f50
test eax, eax
je 0x140237895
movzx eax, byte [0x14032783d]
cmp rsi, rax
jne 0x140237866
lea rbx, [0x140327830]
test al, al
je 0x140237895
lea rdx, [0x140327834]
mov rcx, rdi
mov r8, rsi
call fcn.140148f50
test eax, eax
je 0x140237895
movzx eax, byte [0x140327755]
cmp rsi, rax
jne 0x140237893
lea rbx, [0x140327748]
test al, al
je 0x140237895
lea rdx, [0x14032774c]
mov rcx, rdi
mov r8, rsi
call fcn.140148f50
test eax, eax
je 0x140237895
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140110970
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140239180
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x140368530]
mov ecx, dword [0x14035efd0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140239401
mov rax, qword [0x140368528]
test rax, rax
je 0x14023926b
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x14033dc40]
test eax, eax
je 0x140239215
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x140239272
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1402392a3
mov ecx, 2
call fcn.14006a140
test al, al
je 0x14023926b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4d
mov r9d, 2
call fcn.14018e580
lea rcx, [rsp + 0x40]
lea rdx, [0x1402f6b30]
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.1400cdd30
mov rcx, rbx
call fcn.14018e5f0
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x1402cdfe0]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
mov dl, byte [rsi + 0x81]
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
and dl, 1
mov rcx, rdi
mov r8, rsi
call fcn.140239450
test al, al
jne 0x14023932e
mov ecx, 2
call fcn.14006a140
test al, al
je 0x14023930f
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x221
mov r9d, 2
call fcn.14018d7b0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1400cdd30
mov rcx, rsi
call fcn.14018dbe0
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140110970
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
mov rdx, qword [rsi + 0x28]
cmp byte [rsi + 0x80], 1
jne 0x140239348
mov rcx, rdi
mov r8, rsi
call fcn.140239690
jmp 0x140239353
mov rcx, rdi
mov r8, rsi
call fcn.140239d40
test al, al
jne 0x14023939c
mov ecx, 2
call fcn.14006a140
test al, al
je 0x14023930f
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22a
mov r9d, 2
call fcn.14018d7b0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x140239302
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.140238650
mov sil, 1
test al, al
jne 0x140239311
mov ecx, 2
call fcn.14006a140
test al, al
je 0x14023930f
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22f
mov r9d, 2
call fcn.14018d7b0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x140239302
lea rcx, [0x140368530]
call fcn.14010f47c
cmp dword [0x140368530], 0xffffffff
jne 0x1402391cb
lea rcx, [0x1402dc504]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.140096fa0
mov qword [0x140368528], rax
lea rcx, [0x140368530]
call fcn.14010f530
jmp 0x1402391cb