joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400333e0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1400db610]
test rax, rax
jne 0x140033424
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1400db610]
test rax, rax
je 0x140033411
cmp eax, 2
jne 0x140033472
mov ecx, 2
call fcn.140044070
test al, al
je 0x14003350a
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x84
mov r9d, 2
call fcn.140044120
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400334fd
mov eax, 1
lock xadd qword [0x1400db648], rax
test rax, rax
jle 0x140033492
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1400db5c8], eax
mov qword [0x1400db5c0], rsi
mov rcx, qword [0x1400d75e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140044070
test al, al
je 0x14003350a
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xb0
mov r9d, 2
call fcn.140044120
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.14000482c
mov rcx, rsi
call fcn.1400445e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140083c20
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x140041520
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1400db880]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14004168f
jp 0x14004168f
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1400db890]
mov ecx, dword [0x1400db698]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400416ae
mov eax, dword [0x1400db8a0]
mov ecx, dword [0x1400db698]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400416e8
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x1400db898]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x1400ae590]
subpd xmm1, xmmword [0x1400ae5a0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x1400b3b18]
ucomisd xmm1, xmm0
ja 0x14004168f
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1400db888]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x1400ae590]
subpd xmm1, xmmword [0x1400ae5a0]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1400db880], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140083c20
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1400db890]
call fcn.1400839b0
cmp dword [0x1400db890], 0xffffffff
jne 0x1400415a1
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1400db888], rdx
lea rcx, [0x1400db890]
call fcn.140083a48
jmp 0x1400415a1
lea rcx, [0x1400db8a0]
call fcn.1400839b0
cmp dword [0x1400db8a0], 0xffffffff
jne 0x1400415c6
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1400db898], rax
lea rcx, [0x1400db8a0]
call fcn.140083a48
jmp 0x1400415c6
Function at 0x140041e20
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r9d, 0x88
call fcn.1400418b0
lea rcx, [rsp + 0x50]
mov rdx, rdi
xor r8d, r8d
call fcn.1400418e0
test esi, esi
js 0x140041f15
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
call fcn.140033f80
call fcn.140058140
test al, al
je 0x140041ed9
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400581e0
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.1400581b0
jmp 0x140041f1a
mov esi, 0xffffffff
lea rcx, [rsp + 0x50]
call fcn.140041a20
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140083c20
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140043d80
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x250
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov r14b, 1
cmp qword [0x1400db920], 0
jne 0x140044032
mov rdi, qword [0x1400db900]
test rdi, rdi
je 0x140043dce
test byte [0x1400d7650], 1
jne 0x140043ee8
jmp 0x140044032
mov ecx, 0x18
call fcn.1400837ac
mov rdi, rax
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140086a50
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rsi
call fcn.14009bbb8
mov rbx, rax
movabs rax, 0x7ffffffffffffff0
cmp rbx, rax
jae 0x140044053
cmp rbx, 0xb
jae 0x140043e46
lea eax, [rbx + rbx]
mov byte [rdi], al
mov rsi, rdi
add rsi, 2
test rbx, rbx
jne 0x140043e71
jmp 0x140043e84
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
js 0x14004405b
mov rcx, rbp
add rcx, rbp
call fcn.1400837ac
mov rsi, rax
mov qword [rdi + 0x10], rax
or rbp, 1
mov qword [rdi], rbp
mov qword [rdi + 8], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400865f0
mov word [rsi + rbx*2], 0
movzx r8d, byte [rdi]
test r8b, 1
je 0x140043e9a
mov r8, qword [rdi + 8]
jmp 0x140043e9d
shr r8, 1
mov rcx, rdi
mov dx, 0x5c
call fcn.140020acc
cmp rax, 0xffffffffffffffff
je 0x140043ec5
add rax, 1
mov rcx, rdi
mov rdx, rax
mov r8, 0xffffffffffffffff
call fcn.1400207ea
lea rdx, str.debug.log
mov rcx, rdi
call fcn.1400204b6
mov qword [0x1400db900], rdi
test byte [0x1400d7650], 1
je 0x140044032
test byte [rdi], 1
jne 0x140043ef3
add rdi, 2
jmp 0x140043ef7
mov rdi, qword [rdi + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400db920], rax
add rax, 1
cmp rax, 1
ja 0x140044032
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140086a50
mov word [rsp + 0x40], 0
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14004402f
cmp eax, 0x104
ja 0x14004402f
mov rcx, qword [0x1400db900]
lea rdx, [rsp + 0x40]
call fcn.14002068a
mov rcx, qword [0x1400db900]
movzx eax, byte [rcx]
test al, 1
jne 0x140043fa1
lea rdx, [rcx + 2]
shr rax, 1
jmp 0x140043fa9
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x140043fc4
lea rdx, [0x1400b2afa]
call fcn.1400204b6
mov rcx, qword [0x1400db900]
lea rdx, str.debug.log
call fcn.1400204b6
mov rcx, qword [0x1400db900]
test byte [rcx], 1
jne 0x140043fe2
add rcx, 2
jmp 0x140043fe6
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400db920], rax
add rax, 1
cmp rax, 1
ja 0x140044032
mov qword [0x1400db920], 0
xor r14d, r14d
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140083c20
mov eax, r14d
add rsp, 0x250
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call fcn.14001f2b4
call fcn.1400954ec
int3
Function at 0x140048520
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x40]
call fcn.14002a960
test byte [rsp + 0x50], 1
je 0x140048564
mov rcx, qword [rsp + 0x60]
jmp 0x140048569
lea rcx, [rsp + 0x52]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test byte [rsp + 0x50], 1
je 0x140048587
mov rcx, qword [rsp + 0x60]
call fcn.140083808
test ebp, ebp
je 0x1400485c9
mov r14b, 1
test rsi, rsi
je 0x14004866d
mov ecx, ebp
add rcx, rcx
call fcn.14008383c
mov rbx, rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.14002a960
test byte [rsp + 0x50], 1
je 0x1400485d1
mov rcx, qword [rsp + 0x60]
jmp 0x1400485d6
xor r14d, r14d
jmp 0x14004866d
lea rcx, [rsp + 0x52]
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test byte [rsp + 0x50], 1
je 0x1400485f3
mov rcx, qword [rsp + 0x60]
call fcn.140083808
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x14004860e
xor eax, eax
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140048600
jmp 0x140048610
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x20]
call fcn.14002ae50
test byte [rsi], 1
jne 0x140048630
mov word [rsi], 0
jmp 0x140048654
mov rax, qword [rsi + 0x10]
mov byte [rax], 0
mov qword [rsi + 8], 0
test byte [rsi], 1
je 0x140048654
mov rcx, qword [rsi + 0x10]
call fcn.140083808
mov qword [rsi], 0
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.140083844
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140083c20
mov eax, r14d
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400488f8
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rcx, rbx
je 0x140048927
mov rcx, qword [rsi + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x140048a2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140048969
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140083c20
mov rcx, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.140048a4a
mov ecx, 2
call fcn.140044070
test al, al
je 0x140048a2b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x244
mov r9d, 2
call fcn.140045050
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14000482c
movzx edx, byte [rsi]
mov rcx, rdx
shr rcx, 1
test dl, 1
cmovne rbx, qword [rsi + 0x10]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov qword [rdx], rbx
cmovne rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14002ae20
movzx r8d, byte [rsi]
test r8b, 1
je 0x140048a00
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x140048a08
shr r8, 1
lea rdx, [rsp + 0x39]
mov rcx, rdi
call fcn.14000482c
test byte [rsp + 0x38], 1
je 0x140048a21
mov rcx, qword [rsp + 0x48]
call fcn.140083808
lea rcx, [rsp + 0x50]
call fcn.140045140
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140083c20
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140048a4a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rcx, rbx
je 0x140048a79
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140048b28
mov dil, 1
test al, 0x10
jne 0x140048c2e
mov ecx, 2
call fcn.140044070
test al, al
je 0x140048c2c
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x232
mov r9d, 2
call fcn.140044120
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000482c
movzx edx, byte [rsi]
mov rcx, rdx
shr rcx, 1
test dl, 1
cmovne rbx, qword [rsi + 0x10]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov qword [rdx], rbx
cmovne rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14002ae20
movzx r8d, byte [rsi]
test r8b, 1
je 0x140048bec
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x140048bf4
mov ecx, 2
call fcn.140044070
test al, al
je 0x140048c2c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x22e
mov r9d, 2
call fcn.140045050
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000482c
movzx edx, byte [rsi]
mov rcx, rdx
shr rcx, 1
test dl, 1
cmovne rbx, qword [rsi + 0x10]
mov rdi, rax
lea rdx, [rsp + 0x38]
mov qword [rdx], rbx
cmovne rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14002ae20
movzx r8d, byte [rsi]
test r8b, 1
je 0x140048bbf
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x140048bc7
shr r8, 1
lea rdx, [rsp + 0x49]
mov rcx, rdi
call fcn.14000482c
test byte [rsp + 0x48], 1
je 0x140048be0
mov rcx, qword [rsp + 0x58]
call fcn.140083808
lea rcx, [rsp + 0x60]
call fcn.140045140
jmp 0x140048c2c
shr r8, 1
lea rdx, [rsp + 0x49]
mov rcx, rdi
call fcn.14000482c
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.14000482c
test byte [rsp + 0x48], 1
je 0x140048c22
mov rcx, qword [rsp + 0x58]
call fcn.140083808
lea rcx, [rsp + 0x60]
call fcn.1400445e0
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140083c20
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004b1ca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x14004b1e1
test byte [rcx + 0x10], 1
je 0x14004b1f0
mov rcx, qword [rcx + 0x20]
jmp 0x14004b1f4
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x14004b20d
add rcx, 0x12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x14004c43c
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8]
test al, 1
jne 0x14004c46f
shr rax, 1
jmp 0x14004c474
mov rax, qword [r12 + 8]
test rax, rax
je 0x14004c4a3
bt ebx, 8
jae 0x14004c488
mov eax, ebx
and eax, 0x200
jne 0x14004c4a3
cmp edi, 2
lea rax, [0x1400dbbf0]
lea rcx, [0x1400dbdf0]
cmove rcx, rax
cmp word [rcx], 0
je 0x14004c4c2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140083c20
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14004c4a3
cmp byte [0x1400dbbe0], 0
setne al
bt ebx, 8
jb 0x14004c4a3
shr ebx, 9
and ebx, 1
or bl, al
je 0x14004c4a3
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx ebp, byte [r12]
test bpl, 1
jne 0x14004c528
lea rdi, [r12 + 2]
shr rbp, 1
jmp 0x14004c532
mov rbp, qword [r12 + 8]
mov rdi, qword [r12 + 0x10]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rbx, qword [rsi + 8]
mov r13, rbp
sub r13, rbx
jb 0x14004c56f
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.1400975a0
test eax, eax
je 0x14004c57d
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x14004c551
jmp 0x14004c5ef
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x14004c58c
test dx, dx
jne 0x14004c56f
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x14004c5ba
cmp ebp, 2
jne 0x14004c5b0
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x14004c5ba
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x14004c5d2
dec r13
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x14004c5c4
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x14004c576
cmp dword [rsp + 0x2c], 0
je 0x14004c4a3
test byte [r12], 1
jne 0x14004c608
lea rax, [r12 + 2]
jmp 0x14004c60d
mov rax, qword [r12 + 0x10]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.1400207ba
jmp 0x14004c4a3
Function at 0x14004dec7
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x58], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14004df3e
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x14004df3e
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov dword [rdi], 0x18
xor ecx, ecx
call fcn.14004dfa2
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], 1
jmp 0x14004df40
xor edi, edi
movzx edx, bl
shl edx, 0x13
or edx, 3
test byte [rsi], 1
je 0x14004df54
mov rsi, qword [rsi + 0x10]
jmp 0x14004df58
add rsi, 2
mov qword [rsp + 0x38], rdi
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140083c20
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004e368
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x178], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14004e441
and eax, 0xfeff
cmp eax, 6
je 0x14004e441
mov eax, dword [0x1400dc220]
mov ecx, dword [0x1400db698]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004e468
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x1400dc218]
mov sil, 1
test eax, eax
jne 0x14004e44d
mov ecx, 2
call fcn.140044070
test al, al
je 0x14004e43d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21
mov r9d, 2
call fcn.140045050
lea rcx, [rsp + 0x40]
lea rdx, [0x1400b65af]
mov r8d, 0x1b
call fcn.14000482c
mov rcx, rsi
call fcn.140045140
xor esi, esi
jmp 0x14004e44d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140083c20
mov eax, esi
add rsp, 0x180
pop rsi
ret
lea rcx, [0x1400dc220]
call fcn.1400839b0
cmp dword [0x1400dc220], 0xffffffff
jne 0x14004e3cf
lea rcx, [0x1400b2e20]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.14004e720
mov qword [0x1400dc218], rax
lea rcx, [0x1400dc220]
call fcn.140083a48
jmp 0x14004e3cf
Function at 0x14004e780
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, dword [0x1400dc7b0]
mov ecx, dword [0x1400db698]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004e7e0
lea rsi, [0x1400dc7a8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140083c20
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x1400dc7b0]
call fcn.1400839b0
cmp dword [0x1400dc7b0], 0xffffffff
jne 0x14004e7bc
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call fcn.140086a50
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1400837ac
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x1400dc7e8]
mov ecx, dword [0x1400db698]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004e8a1
lea r8, [0x1400dc7b8]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov r9d, edi
call fcn.14004ea50
mov qword [0x1400dc7a8], rsi
lea rcx, [0x1400dc7b0]
call fcn.140083a48
jmp 0x14004e7bc
lea rcx, [0x1400dc7e8]
call fcn.1400839b0
cmp dword [0x1400dc7e8], 0xffffffff
jne 0x14004e872
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x1400dc7d8], xmm2
movups xmmword [0x1400dc7c8], xmm1
movups xmmword [0x1400dc7b8], xmm0
lea rcx, [0x1400dc7e8]
call fcn.140083a48
jmp 0x14004e872

Function at 0x14004e930
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1400dc7e8]
mov ecx, dword [0x1400db698]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004e9b3
movzx eax, word [0x1400dc7b8]
cmp rax, 0xc
ja case.0x14004e982.1
xor esi, esi
lea rcx, [0x14004ea1c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov esi, 2
jmp case.0x14004e982.0
mov esi, 4
jmp case.0x14004e982.0
mov esi, 1
jmp case.0x14004e982.0
mov esi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140083c20
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1400dc7e8]
call fcn.1400839b0
cmp dword [0x1400dc7e8], 0xffffffff
jne 0x14004e965
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [0x1400dc7d8], xmm2
movups xmmword [0x1400dc7c8], xmm1
movups xmmword [0x1400dc7b8], xmm0
lea rcx, [0x1400dc7e8]
call fcn.140083a48
jmp 0x14004e965