joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ad00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14002ae26
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14002ae26
test rax, rax
je 0x14002ae26
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x14002ad83
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14002ae31
lea rbx, [rcx + rdx]
mov esi, dword [rax + 0xb4]
add rsi, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rsi
jae 0x14002ae14
nop word [rax + rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x14002ae14
mov eax, dword [rbx]
add rax, rbp
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14002aded
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14002ae04
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14002b700
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rsi
jb 0x14002ada0
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14002ae31
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002dc20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002c750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6a], 0
mov rdx, rcx
je 0x14002c898
movdqa xmm3, xmmword [0x14003a720]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14003a7e0]
xor eax, eax
mov r9d, 0xb896
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xb8c6
jb 0x14002c780
cmp rax, 0x34
jae 0x14002c894
mov r8d, 0x4771
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x34
jb 0x14002c880
mov byte [rdx + 0x6a], 0
mov rax, rdx
ret
Function at 0x14002d070
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor edi, edi
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
mov ebx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14002d105
test rbx, rbx
je 0x14002d0cb
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14002d0b5
test eax, eax
jns 0x14002d126
test rbx, rbx
je 0x14002d12b
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14002d1ed
test rbx, rbx
jne 0x14002d132
xor eax, eax
jmp 0x14002d1ed
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x14002d1d5
nop
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.140023750
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14002d173
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14002d20a
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14002d1cb
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d1c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d253
call fcn.14002dc40
inc edi
cmp edi, dword [rbx]
jb 0x14002d140
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002dc20
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14002d25f
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d25a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002d25a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dc40
mov rax, rdi
jmp 0x14002d1e8
Function at 0x14002e9a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002e9f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002e9f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002e9f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002e9f2
cmp dword [rcx + 0x84], 0xe
jbe 0x14002e9f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002e9f4
xor al, al
add rsp, 0x28
ret
Function at 0x140005b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140005c98
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1400c95d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x140005cdd
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x140005de2
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x140005de2
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14008ea70
cmp eax, 0xffffffff
je 0x140005dde
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rbp, rdi
jb 0x140005cec
cmp byte [rsi + 0x5f], 0
je 0x140005d30
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x140005da2
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x140005de2
lea r13, [rsp + 0x56]
lea r12, [rsp + 0x48]
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r15, qword [rdx]
lea r9, [rsp + rdi]
add r9, 0x58
mov rax, qword [rcx]
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x140005dcb
mov rax, qword [rsi + 0x50]
mov qword [rax], r15
cmp rdi, 8
je 0x140005dde
mov rcx, qword [rsi + 0x40]
call fcn.14008ea70
cmp eax, 0xffffffff
je 0x140005dde
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x140005d3f
mov edi, edi
test rdi, rdi
jle 0x140005dc4
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.140090324
cmp eax, 0xffffffff
jne 0x140005da4
jmp 0x140005dde
movzx edi, word [rsp + 0x56]
jmp 0x140005de2
cmp eax, 2
je 0x140005dde
cmp eax, 3
je 0x140005d10
jmp 0x140005d1a
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140079940
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140005e50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1400c95d8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14008e694
cmp rax, rbx
jne 0x140005ed7
cmp edi, 1
je 0x140005e84
cmp edi, 2
je 0x140005ed7
mov rcx, qword [rsi + 0x40]
call fcn.14008e340
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140079940
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140005f00
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140005f35
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14008e694
xor ebx, ebx
test rsi, rsi
jle 0x140005f5a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x140005f5a
inc rbx
cmp rsi, rbx
jne 0x140005f3c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140005f70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x1400c95d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x140005fcd
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x140005fdc
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14008e694
mov esi, 0xffffffff
cmp rax, 1
jne 0x14000608c
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x14000608c
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140006087
mov ebp, eax
cmp eax, 3
je 0x140006066
cmp ebp, 1
ja 0x140006087
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14008e694
cmp rax, rsi
jne 0x140006087
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140005ff9
jmp 0x140005fcd
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14008e694
cmp rax, 1
je 0x140005fcd
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140079940
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400060f0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140006125
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14008e694
xor ebx, ebx
test rsi, rsi
jle 0x14000614b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14000614b
inc rbx
cmp rsi, rbx
jne 0x14000612c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140006160
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x1400c95d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x1400061bc
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x1400061cc
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14008e694
mov di, 0xffff
cmp rax, 1
jne 0x14000627b
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x14000627b
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x140006277
mov ebp, eax
cmp eax, 3
je 0x140006256
cmp ebp, 1
ja 0x140006277
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14008e694
cmp rax, rbx
jne 0x140006277
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x1400061e9
jmp 0x1400061bc
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.14008e694
cmp rax, 1
je 0x1400061bc
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140079940
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140006390
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400063c7
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x1400063a1
ret

Function at 0x1400064e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140006518
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x1400064f1
ret
Function at 0x140078eb2
Capabilities:
Delete directory

Disassembly:
jmp 0x140078d60
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1400c95d8]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140078d87
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140078dbf
and eax, 0x410
cmp eax, 0x410
jne 0x140078dbf
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140079940
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp 0x140078eb2
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140078dcb
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140078e96
mov ecx, 2
call fcn.140031ce0
test al, al
je 0x140078e94
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.140032a30
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140028a70
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140027070
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140078e6d
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140028a70
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x140078e8a
mov rcx, qword [rsp + 0x38]
call fcn.1400795d8
lea rcx, [rsp + 0x50]
call fcn.140032b00
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140079940
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1400c95d8]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140078ed9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x140078fa4
mov ecx, 2
call fcn.140031ce0
test al, al
je 0x140078fa2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x2f
mov r9d, 2
call fcn.140032a30
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140028a70
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140027070
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140078f7b
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140028a70
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x140078f98
mov rcx, qword [rsp + 0x38]
call fcn.1400795d8
lea rcx, [rsp + 0x50]
call fcn.140032b00
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140079940
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret

Function at 0x140085fb4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400860e4
Function at 0x14000279c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14005b060]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x50]
call fcn.140016b30
lea rdx, [rbp - 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x140002846
lea rcx, [rbp - 0x50]
or rax, 0xffffffffffffffff
xor ebx, ebx
inc rax
cmp word [rcx + rax*2], bx
jne 0x140002802
cmp word [rbp + rax*2 - 0x52], 0x5c
jne 0x14000282c
lea rax, [rax*2 - 2]
cmp rax, 0x20a
jae 0x14000296c
mov word [rbp + rax - 0x50], bx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], bx
lea rdx, [rbp - 0x50]
jmp 0x14000287e
lea rdx, str.____Failed_to_get_temp_path
lea rcx, [0x14005c750]
call fcn.140008acc
mov rcx, rax
call fcn.140008cc4
xor ebx, ebx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], bx
lea rdx, [0x140048948]
lea rcx, [rbp - 0x78]
call fcn.1400078d4
nop
cmp qword [rbp - 0x68], rbx
jne 0x1400028b4
mov qword [rdi], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
lea rdx, [0x140048948]
mov rcx, rdi
call fcn.1400078d4
jmp 0x140002936
lea rcx, [rsp + 0x68]
call fcn.1400025a4
mov rbx, rax
movabs rcx, 0x7ffffffffffffffe
mov rdx, qword [rbp - 0x68]
sub rcx, rdx
cmp rcx, 1
jb 0x140002966
lea r9, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae r9, qword [rbp - 0x78]
mov qword [rsp + 0x30], 1
lea rax, [0x14004894c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x48]
call fcn.14000b5bc
nop
mov r8, rbx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140008d50
nop
lea rcx, [rsp + 0x48]
call fcn.140007870
nop
lea rcx, [rsp + 0x68]
call fcn.140007870
nop
lea rcx, [rbp - 0x78]
call fcn.140007870
mov rax, rdi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140013f10
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140001424
nop
call fcn.140014350
int3
Function at 0x14000590c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005931
xor eax, eax
jmp 0x140005a2e
cmp qword [rcx + 0x68], 0
je 0x140005942
call fcn.14000613c
jmp 0x140005a2e
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140005959
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000595b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005990
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140016480
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140005a28
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400059cb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140005a03
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.14001e38c
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140005a3f
cmp rbp, r15
ja 0x1400059d9
mov r8, rbx
test rbx, rbx
je 0x140005a28
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14001e38c
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x140005a2b

Function at 0x14000c62c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14005b060]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x14000c6b9
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x30]
call fcn.140016b30
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000c6b9
cmp dword [rsp + 0x38], esi
je 0x14000c6b5
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14000c69b
mov edi, dword [rsp + 0x50]
cmp rbx, 0xffffffffffffffff
je 0x14000c6c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140013f10
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000c6f0
Capabilities:
Get explorer pid

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14005b060]
xor rax, rsp
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.14000c62c
cmp eax, dword [rsp + 0x20]
jne 0x14000c762
lea rdx, str.___Pausing_to_allow_for_debugging
lea rcx, [0x14005c750]
call fcn.140008acc
mov rcx, rax
call fcn.140008cc4
lea rdx, str.___Press_enter_to_close
lea rcx, [0x14005c750]
call fcn.140008acc
mov rcx, rax
call fcn.140008cc4
call fcn.14000d0b4
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140013f10
add rsp, 0x38
ret