joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140274fad
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
call fcn.140093d78
mov ecx, dword [0x14034f570]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x140274fe0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov edx, 0x3c8
call fcn.1400a5e90
test rax, rax
je 0x140275085
mov rsi, rax
mov rcx, rax
call fcn.14023489b
mov ecx, 0x10
call fcn.140070a20
test rax, rax
je 0x1402750ac
mov rdi, rax
mov qword [rax + 8], rsi
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call r15
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r14
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [0x14034f570]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [0x1402750f0]
xor edx, edx
mov r8, rdi
call fcn.140182de4
jmp 0x140274fd1
call fcn.14012be0d
mov rsi, qword [rax]
call fcn.14012be33
mov rcx, qword [rax]
lea rdx, str.xmlGetGlobalState:_out_of_memory_n
mov rax, rsi
call qword [case.0x140211850.0]
xor esi, esi
jmp 0x140274fd1
call fcn.14012be0d
mov rdi, qword [rax]
call fcn.14012be33
mov rcx, qword [rax]
lea rdx, str.xmlGetGlobalState:_out_of_memory_n
mov rax, rdi
call qword [case.0x140211850.0]
mov rcx, rsi
add rcx, 0x358
call fcn.1400fdac5
mov rcx, rsi
call fcn.14004f440
jmp 0x1402750a5

Function at 0x14027539f
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1402753ba
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.140083e2b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140275468
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140275468
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140275493
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1402753b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1402753ae
mov dword [rsi], 7
jmp 0x1402753ae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402753ae
Function at 0x1402777a1
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r11d, dword [rcx + 0x18]
test rdx, rdx
je 0x1402777eb
movzx r10d, byte [rdx]
mov eax, r10d
shl eax, 5
sub eax, r10d
sub eax, r10d
add eax, r11d
test r10d, r10d
je 0x1402777ee
inc rdx
movzx r10d, r10b
mov r11d, eax
shl r11d, 5
mov esi, eax
shr esi, 3
add esi, r11d
add esi, r10d
xor eax, esi
mov r10b, byte [rdx]
inc rdx
test r10b, r10b
jne 0x1402777c6
jmp 0x1402777ee
mov eax, r11d
mov r10d, eax
shl r10d, 5
mov edx, eax
shr edx, 3
add edx, r10d
xor edx, eax
test r8, r8
je 0x140277832
mov al, byte [r8]
test al, al
je 0x140277832
inc r8
movzx eax, al
mov r10d, edx
shl r10d, 5
mov r11d, edx
shr r11d, 3
add r11d, eax
add r11d, r10d
xor edx, r11d
mov al, byte [r8]
inc r8
test al, al
jne 0x14027780e
mov r8d, edx
shl r8d, 5
mov eax, edx
shr eax, 3
add eax, r8d
xor eax, edx
test r9, r9
je 0x140277876
mov dl, byte [r9]
test dl, dl
je 0x140277876
inc r9
movzx edx, dl
mov r8d, eax
shl r8d, 5
mov r10d, eax
shr r10d, 3
add r10d, edx
add r10d, r8d
xor eax, r10d
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x140277852
xor edx, edx
div dword [rcx + 8]
mov eax, edx
pop rsi
ret
Function at 0x14027993a
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp dword [rcx + 0x10108], 0
mov r9d, dword [rcx + 0xd4]
je 0x140279a01
test r9d, r9d
je 0x1402799fe
xor eax, eax
mov ecx, 0xff
mov r10d, dword [rsi + 0x10128]
mov r8d, dword [rsi + 0x10130]
mov edx, r8d
and edx, 0xfffd
mov r11d, r8d
or r11d, 2
xor edx, 3
imul edx, r11d
shr edx, 8
mov r11, qword [rsi + 0x10138]
mov bl, byte [rsi + rax + 0x100]
xor bl, r10b
movzx edi, bl
shr r10d, 8
xor r10d, dword [r11 + rdi*4]
mov dword [rsi + 0x10128], r10d
and r10d, ecx
add r10d, dword [rsi + 0x1012c]
imul r10d, r10d, 0x8088405
inc r10d
mov dword [rsi + 0x1012c], r10d
shr r10d, 0x18
mov edi, r8d
and edi, ecx
xor edi, r10d
shr r8d, 8
xor r8d, dword [r11 + rdi*4]
mov dword [rsi + 0x10130], r8d
xor byte [rsi + rax + 0x100], dl
inc rax
cmp r9, rax
jne 0x140279968
jmp 0x140279a01
xor r9d, r9d
lea r8, [rsi + 0x100]
mov rdx, qword [rsi + 0x58]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x38]
call qword [case.0x140211850.0]
mov edx, dword [rsi + 0x84]
mov r8d, dword [rsi + 0xd4]
xor ecx, ecx
cmp eax, r8d
setne cl
add qword [rsi + 0x10118], r8
neg ecx
add qword [rsi + 0x10120], rdx
xor eax, eax
mov dword [rsi + 0x84], eax
mov dword [rsi + 0xd4], eax
mov eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14027a448
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
push rbx
movabs rax, 0x2345678912345678
mov qword [rdx], rax
mov dword [rdx + 8], 0x34567890
mov bl, byte [rcx]
test bl, bl
je 0x14027a4ca
inc rcx
mov eax, 0x12345678
mov r10d, 0x23456789
mov r9d, 0x34567890
mov r11d, 0xff
mov esi, eax
xor sil, bl
movzx esi, sil
shr eax, 8
xor eax, dword [r8 + rsi*4]
mov dword [rdx], eax
mov esi, eax
and esi, r11d
add esi, r10d
imul r10d, esi, 0x8088405
inc r10d
mov dword [rdx + 4], r10d
mov esi, r10d
shr esi, 0x18
mov edi, r9d
and edi, r11d
xor edi, esi
shr r9d, 8
xor r9d, dword [r8 + rdi*4]
mov dword [rdx + 8], r9d
mov bl, byte [rcx]
inc rcx
test bl, bl
jne 0x14027a47f
pop rbx
pop rdi
pop rsi
ret
Function at 0x14027a7cc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [rsi], xmm0
lea rdi, [rsp + 0x28]
mov rdx, rdi
call fcn.140127a20
movzx eax, byte [rdi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rdi]
cmovns rax, rdi
cmovs rcx, qword [rdi + 8]
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.140109180
cmp byte [rdi + 0x17], 0
jns 0x14027a847
mov rcx, qword [rsp + 0x28]
call fcn.14016eccc
movzx eax, byte [rsp + 0x57]
test al, al
jns 0x14027a857
mov rcx, qword [rsp + 0x48]
jmp 0x14027a85c
mov ecx, eax
and ecx, 0x7f
mov edi, 8
test rcx, rcx
jne 0x14027a88b
test al, al
jns 0x14027a874
mov rcx, qword [rsp + 0x40]
call fcn.14016eccc
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140171860
mov eax, edi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
test al, al
jns 0x14027a894
mov rsi, qword [rsp + 0x40]
add rsi, 2
mov qword [rsp + 0x58], rsi
dec rcx
mov qword [rsp + 0x60], rcx
mov eax, dword [0x14035c530]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14027a8ee
lea rsi, [rsp + 0x28]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.14027b018
xor edi, edi
cmp qword [rsi], 0
sete dil
shl edi, 3
mov al, byte [rsp + 0x57]
jmp 0x14027a866
lea rcx, [0x14035c530]
call fcn.14016f8b4
cmp dword [0x14035c530], 0xffffffff
jne 0x14027a8c6
xorps xmm0, xmm0
movups xmmword [0x14035c518], xmm0
movups xmmword [0x14035c508], xmm0
mov dword [0x14035c528], 0x3f800000
xor edi, edi
lea rbx, [0x140323b80]
lea rsi, [rsp + 0x28]
lea rdx, [rbx + rdi]
mov rcx, rsi
mov r8, rdx
call fcn.14027a95a
add rdi, 0x10
cmp rdi, 0x2f0
jne 0x14027a92c
lea rcx, [0x14035c530]
call fcn.14016ef8c
jmp 0x14027a8c6
Function at 0x140280e5a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140226960
test al, al
je 0x140280e88
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x140280ea9
mov rcx, rdi
call fcn.1402a2352
mov rcx, rdi
call fcn.14016eccc
mov rcx, qword [rsi + 0x70]
mov qword [rsi + 0x70], 0
test rcx, rcx
jne 0x140280fda
mov rdx, qword [rsi + 0x58]
test rdx, rdx
jne 0x140280fe9
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x140280ee1
call fcn.14004f440
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x140280eef
call fcn.140285166
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x140280f10
mov rcx, rdi
call fcn.1402a2352
mov rcx, rdi
call fcn.14016eccc
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jae 0x140280f45
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x140280f77
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x140280fa9
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400eac70
call fcn.1400412c0
mov rdi, qword [rsi + 0x28]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x140281002
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
mov qword [rsi + 0x28], 0
jmp 0x140280f1d
call fcn.1400412c0
mov rdi, qword [rsi + 0x20]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x140281013
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
mov qword [rsi + 0x20], 0
jmp 0x140280f2a
call fcn.1400412c0
mov rdi, qword [rsi + 0x18]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x140281024
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
mov qword [rsi + 0x18], 0
jmp 0x140280f37
mov edx, 1
call fcn.140280560
jmp 0x140280ebe
lea rdi, [rsi + 0x58]
mov rcx, rdi
call fcn.14012d5b4
mov rcx, qword [rdi]
call fcn.14016eccc
jmp 0x140280ecb
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x140280f5e
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x140280f90
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x140280fbe
Function at 0x140281c9e
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140226960
test al, al
je 0x140281cc0
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x140288060
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x1402880e8
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1402880e1
mov rdx, rcx
add rdi, rdx
cmp al, 1
jne 0x1402880a2
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140171860
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1402a5f1c
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x1402a5f7c
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140171860
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1402a92a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.Microsoft.ModuleSnapshotWinInitSignatureMilestone
mov edx, 8
mov r8d, 9
call fcn.14014a1d0
mov byte [rsi + 0x38], 1
mov rcx, rsi
call fcn.1402a8e66
test al, al
jne 0x1402a92d7
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
call fcn.1402a9182
lea rcx, str.Microsoft.ModuleSnapshotWinInitSignatureMilestone
test al, al
je 0x1402a92fd
xor edx, edx
mov r8d, 9
call fcn.14014a1d0
mov byte [rsi + 0x38], 0
jmp 0x1402a92d1
mov edx, 2
mov r8d, 9
add rsp, 0x20
pop rsi
jmp fcn.14014a1d0

Function at 0x1402c01be
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x140301d60]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401c912e
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1402d048a
test al, al
je 0x1402c028f
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402c02eb
mov rcx, r14
call fcn.1401c912e
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1402d048a
test al, al
je 0x1402c0367
cmp dword [rbx], 0x4550
jne 0x1402c03a6
mov sil, 1
test rdi, rdi
je 0x1402c0346
mov qword [rdi], r14
jmp 0x1402c0346
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0344
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14015f6d6
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1402c032d
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
jmp 0x1402c0331
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0344
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402c02d3
and r8d, 0x7f
mov rcx, rax
mov rdx, rsi
call fcn.14015f6d6
mov rcx, rdi
call fcn.140169410
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0344
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402c02cd
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0344
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402c02d3
Function at 0x1402c03ec
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x140301d60]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401c912e
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1402d048a
test al, al
je 0x1402c04bd
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402c0519
mov rcx, r14
call fcn.1401c912e
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1402d048a
test al, al
je 0x1402c0595
cmp dword [rbx], 0x4550
jne 0x1402c05d4
mov sil, 1
test rdi, rdi
je 0x1402c0574
mov qword [rdi], r14
jmp 0x1402c0574
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0572
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14015f6d6
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1402c055b
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
jmp 0x1402c055f
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0572
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402c0501
and r8d, 0x7f
mov rcx, rax
mov rdx, rsi
call fcn.14015f6d6
mov rcx, rdi
call fcn.140169410
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0572
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402c04fb
mov ecx, 1
call fcn.1400d98c0
test al, al
je 0x1402c0572
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400d3710
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402c0501
Function at 0x180001530
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 8], 0x1000
lea rdi, [rdx - 0x1000]
mov rbx, 0xffffffffffffeffb
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
test rax, rax
jne 0x1800015ad
sub rbx, 0x1000
lea rdi, [rbp + 5]
add rdi, rbx
movsxd rax, ebx
cmp rbx, rax
je 0x180001573
jmp 0x1800015e3
sub rdi, rbp
sub rdi, 5
movsxd rax, edi
cmp rdi, rax
jne 0x1800015d5
mov qword [rsi], rcx
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsi], r14
lea rdx, str.Failed_to_allocate
lea rcx, [rsp + 0x20]
call fcn.180001480
lea rdx, [0x18000e218]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x180001a70
Capabilities:
Resume thread

Disassembly:
push rdi
push r14
sub rsp, 0x48
mov rdi, qword [rcx + 0x18]
mov r14, rcx
test rdi, rdi
je 0x180001ca0
mov r8, qword [rcx + 8]
mov rdx, qword [rcx]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rsi
cmp rdx, r8
je 0x180001aad
sub r8, rdx
mov rcx, rdi
call fcn.180001d50
mov rdi, qword [r14 + 0x18]
xor ebx, ebx
mov esi, 1
xor eax, eax
lock cmpxchg dword [0x180011e34], esi
je 0x180001ae1
cmp rbx, 0x20
jae 0x180001aca
xor ecx, ecx
jmp 0x180001acc
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180011e34], esi
jne 0x180001ac0
cmp qword [0x180011e88], 0
je 0x180001c8e
mov ecx, dword [0x18001204c]
xor ebx, ebx
test ecx, ecx
je 0x180001c8e
mov rdx, qword [0x180012040]
mov rax, rdx
nop dword [rax]
cmp rdi, qword [rax]
je 0x180001b24
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180001b10
jmp 0x180001c8e
cmp ebx, 0xffffffff
je 0x180001c8e
mov eax, ebx
mov qword [rsp + 0x38], r12
imul r12, rax, 0x38
test byte [r12 + rdx + 0x20], 2
je 0x180001bf0
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800066f4
test eax, eax
jne 0x180001c89
xor edx, edx
mov qword [rsp + 0x30], r13
mov ecx, ebx
call fcn.180006aa4
cmp qword [rsp + 0x20], 0
mov r13d, eax
je 0x180001bdb
mov ecx, dword [rsp + 0x2c]
test ecx, ecx
je 0x180001bc7
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x70], rbp
mov ebp, ecx
nop dword [rax + rax]
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180001bb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x180001b90
mov rbp, qword [rsp + 0x70]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180011e88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13d, r13d
mov r13, qword [rsp + 0x30]
jne 0x180001c89
mov rdx, qword [0x180012040]
mov rcx, qword [r12 + rdx + 0x10]
call fcn.1800074f0
mov edx, dword [0x18001204c]
dec edx
cmp ebx, edx
jae 0x180001c3f
mov eax, edx
imul rcx, rax, 0x38
mov rax, qword [0x180012040]
movups xmm0, xmmword [rcx + rax]
movups xmmword [r12 + rax], xmm0
movups xmm1, xmmword [rcx + rax + 0x10]
movups xmmword [r12 + rax + 0x10], xmm1
movups xmm0, xmmword [rcx + rax + 0x20]
movups xmmword [r12 + rax + 0x20], xmm0
movsd xmm1, qword [rcx + rax + 0x30]
movsd qword [r12 + rax + 0x30], xmm1
mov ecx, dword [0x180012048]
mov eax, ecx
mov dword [0x18001204c], edx
shr eax, 1
cmp eax, 0x20
jb 0x180001c89
cmp eax, edx
jb 0x180001c89
mov r8, qword [0x180012040]
mov eax, ecx
mov rcx, qword [0x180011e88]
xor edx, edx
shr rax, 1
imul r9, rax, 0x38
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180001c89
shr dword [0x180012048], 1
mov qword [0x180012040], rax
mov r12, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
xchg dword [0x180011e34], eax
mov rbx, qword [rsp + 0x68]
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x20], 0
mov rax, qword [r14]
mov qword [r14 + 8], rax
add rsp, 0x48
pop r14
pop rdi
ret
Function at 0x180001d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180010010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, r8
mov dword [rsp + 0x20], 0
mov rbx, rdx
lea r9, [rsp + 0x20]
mov rdx, rsi
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180007dc0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x180002ba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180002bd7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180002bf8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180002bfa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180002c5b
test ecx, ecx
jle 0x180002c33
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180002c5b
cmp qword [rdi + 0x80], 0
je 0x180002c5b
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret