joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010ecb0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
call fcn.1400e58b0
call qword [0x1401e9010]
mov ecx, 2
call fcn.1400d93c8
lea rcx, str.terminate_handler_unexpectedly_returned_n
mov edx, 0x28
mov r8d, 1
mov r9, rax
call fcn.1400ef354
call fcn.1400e7480
int3

Function at 0x14010f3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14010f4e0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x14010f53e
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x14010f51e
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400ef730
cmp eax, 0xffffffff
je 0x14010f5bb
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14010f55c
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x14010f5c5
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x14010f598
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x14010f51e
mov edi, edi
test rdi, rdi
jle 0x14010f677
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.1400f6a94
cmp eax, 0xffffffff
jne 0x14010f59a
mov edi, 0xffffffff
jmp 0x14010f51e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [0x1401e9010]
cmp eax, 1
jne 0x14010f660
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x14010f5bb
mov rcx, qword [rsi + 0x40]
call fcn.1400ef730
cmp eax, 0xffffffff
je 0x14010f5bb
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14010f5d6
cmp eax, 2
je 0x14010f5bb
cmp eax, 3
je 0x14010f581
jmp 0x14010f589
movzx edi, byte [rsp + 0x57]
jmp 0x14010f51e
Function at 0x14010f6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14010f7f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14010f84e
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x14010f82e
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400ef730
cmp eax, 0xffffffff
je 0x14010f8d3
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14010f86c
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x14010f8dc
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x14010f8ad
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14010f82e
mov edi, edi
test rdi, rdi
jle 0x14010f98e
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.1400f6a94
cmp eax, 0xffffffff
jne 0x14010f8af
mov di, 0xffff
jmp 0x14010f82e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [0x1401e9010]
cmp eax, 1
jne 0x14010f977
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x14010f8d3
mov rcx, qword [rsi + 0x40]
call fcn.1400ef730
cmp eax, 0xffffffff
je 0x14010f8d3
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14010f8ed
cmp eax, 2
je 0x14010f8d3
cmp eax, 3
je 0x14010f893
jmp 0x14010f89d
movzx edi, word [rsp + 0x56]
jmp 0x14010f82e
Function at 0x14010f9f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [0x1401e9010]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1400ef354
cmp rax, rbx
jne 0x14010fa93
cmp edi, 1
je 0x14010fa34
cmp edi, 2
je 0x14010fa93
mov rcx, qword [rsi + 0x40]
call fcn.1400ee0a8
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d5720
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14010fac0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14010faf5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400ef354
xor ebx, ebx
test rsi, rsi
jle 0x14010fb21
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401e9010]
cmp eax, 0xffffffff
je 0x14010fb21
inc rbx
cmp rsi, rbx
jne 0x14010fafc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14010fb30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x14010fb9a
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14010fbc0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1400ef354
mov esi, 0xffffffff
cmp rax, 1
je 0x14010fb9d
jmp 0x14010fba0
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [0x1401e9010]
cmp qword [rsp + 0x40], rsi
je 0x14010fc77
mov ebp, eax
cmp eax, 3
je 0x14010fc56
cmp ebp, 1
ja 0x14010fc77
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1400ef354
cmp rax, rsi
jne 0x14010fc77
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14010fbd8
jmp 0x14010fb9d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1400ef354
cmp rax, 1
je 0x14010fb9d
mov esi, 0xffffffff
jmp 0x14010fba0

Function at 0x14010fce0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14010fd15
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400ef354
xor ebx, ebx
test rsi, rsi
jle 0x14010fd42
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401e9010]
cmp ax, 0xffff
je 0x14010fd42
inc rbx
cmp rsi, rbx
jne 0x14010fd1c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14010fd50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x14010fdba
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x14010fde0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1400ef354
mov si, 0xffff
cmp rax, 1
je 0x14010fdbd
jmp 0x14010fdc0
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [0x1401e9010]
cmp qword [rsp + 0x40], rsi
je 0x14010fe97
mov ebp, eax
cmp eax, 3
je 0x14010fe76
cmp ebp, 1
ja 0x14010fe97
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1400ef354
cmp rax, rsi
jne 0x14010fe97
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14010fdf8
jmp 0x14010fdbd
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1400ef354
cmp rax, 1
je 0x14010fdbd
mov si, 0xffff
jmp 0x14010fdc0

Function at 0x14010fef0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14010ff27
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp rdx, r8
jne 0x14010ff01
ret

Function at 0x14010ff80
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14010ffb8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp rdx, r8
jne 0x14010ff91
ret
Function at 0x140115ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r12, r8
mov r14, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140115f00
movzx edx, word [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov word [rsp + 0x20], dx
mov rdx, r14
mov r8, r12
call qword [0x1401e9010]
mov rax, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rsi, [rbp - 0x20]
mov rcx, r9
mov rdx, rsi
call fcn.1400aa570
lea rdx, [0x1401d5a18]
mov rcx, rsi
call fcn.1400aad80
mov rsi, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140115f40
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401e9010]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1401a01c0]
movaps xmmword [r15], xmm0
mov rax, qword [rsi]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, rsi
mov rdx, r15
call qword [0x1401e9010]
movzx esi, byte [r15 + 0x17]
test sil, sil
mov rcx, qword [r15]
mov rdx, qword [r15 + 8]
mov rax, rsi
cmovs rax, rdx
test rax, rax
je 0x14011600f
test sil, sil
mov rbx, rcx
cmovns rbx, r15
test r12, r12
je 0x140115ff2
movzx eax, word [rbx]
mov rcx, qword [r12 + 0x30]
cmp rcx, qword [r12 + 0x38]
je 0x140115ff7
lea rdx, [rcx + 2]
mov qword [r12 + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x140115fc5
xor r12d, r12d
mov sil, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rbx, 2
test sil, sil
mov rax, r15
cmovs rax, rcx
movzx edi, sil
cmovs rdi, rdx
lea rax, [rax + rdi*2]
cmp rbx, rax
jne 0x140115f9c
jmp 0x14011600f
xor r12d, r12d
jmp 0x140115fd1
mov rcx, qword [r12]
mov rsi, qword [rcx + 0x60]
mov rcx, r12
mov edx, eax
mov rax, rsi
call qword [0x1401e9010]
jmp 0x140115fbc
shr sil, 7
mov qword [r14], r12
test sil, sil
je 0x140115eee
call fcn.1400d4ef4
jmp 0x140115eee

Function at 0x140125b80
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1400d4eb8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140125bf0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400e1460
mov qword [rbx], rax
test rax, rax
je 0x140125bd7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140127e30
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov edi, 2
cmp rdx, 1
jne 0x140127e6a
mov rsi, qword [r14 + 8]
cmp rdi, rsi
ja 0x140127f65
jae 0x140127f5b
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x140127e85
cvtsi2ss xmm0, rax
jmp 0x140127e9a
lea rax, [rdx - 1]
test rdx, rax
jne 0x140127e78
mov rdi, rdx
jmp 0x140127e47
mov rcx, rdx
call fcn.1400a9ce0
mov rdi, rax
jmp 0x140127e47
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.1400ec70c
cvttss2si rcx, xmm0
mov rdx, rcx
subss xmm0, dword [0x140194028]
cvttss2si rax, xmm0
sar rdx, 0x3f
and rax, rdx
or rax, rcx
cmp rsi, 3
jb 0x140127f47
mov rcx, rsi
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rbx, rsi
sub rbx, rdx
movabs rdx, 0x3333333333333333
mov rcx, rbx
shr rcx, 2
and rbx, rdx
and rcx, rdx
add rcx, rbx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x140127f47
cmp rax, 2
jb 0x140127f4f
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x140127f4f
mov rcx, rax
call fcn.1400a9ce0
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rsi
jb 0x140127f65
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, r14
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x14010d990
Function at 0x14013aab0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14013ab2f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14013ab34
test bl, bl
je 0x14013ab0b
cmp byte [rdi + 8], 0
je 0x14013ab90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
call fcn.14006bff0
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x14013aadd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14013ab5c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14013ab61
xor esi, esi
jmp 0x14013ab18
mov rcx, qword [rdi]
jmp 0x14013ab49
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x14013ab98
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14013ab0b
mov esi, dword [rsp + 0x24]
jmp 0x14013ab0b
mov rcx, qword [rdi]
jmp 0x14013ab00
mov rcx, qword [rdi]
jmp 0x14013ab78

Function at 0x140147560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x38]
mov rbp, qword [rcx + 0x40]
mov r15d, 1
cmp rdi, rbp
je 0x1401475f8
mov r14, r8
mov rsi, rcx
lea rbx, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.14015ad50
test al, al
jne 0x1401475bc
add rdi, 0x70
cmp rdi, rbp
jne 0x1401475a1
mov rdi, rbp
cmp rdi, qword [rsi + 0x40]
je 0x1401475f8
cmp byte [rdi + 0x27], 0
jns 0x1401475ce
mov rcx, qword [rdi + 0x10]
jmp 0x1401475d2
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov r15d, 1
cmovne r15d, ecx
test r15d, r15d
jne 0x1401475f8
mov qword [r14], rdi
xor r15d, r15d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d5720
mov eax, r15d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140147770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x40]
mov r12d, 1
cmp rdi, rsi
je 0x1401477fa
mov r14, r9
mov r15d, r8d
mov rbx, rcx
lea rbp, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbp
call fcn.14015ad50
test al, al
jne 0x1401477d1
add rdi, 0x70
cmp rdi, rsi
jne 0x1401477b6
mov rdi, rsi
cmp rdi, qword [rbx + 0x40]
je 0x1401477fa
mov eax, dword [rdi + 0x68]
cmp eax, r15d
jne 0x1401477eb
cmp byte [rdi + 0x27], 0
jns 0x140147819
mov rcx, qword [rdi + 0x10]
jmp 0x14014781d
xor ecx, ecx
cmp eax, 1
sete cl
lea r12d, [rcx + rcx*2]
inc r12d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d5720
mov eax, r12d
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401477fa
shr eax, 3
and eax, 2
mov r12d, eax
jne 0x1401477fa
mov byte [rbx + 0x30], 1
mov qword [r14], rdi
xor r12d, r12d
jmp 0x1401477fa

Function at 0x14014a340
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401daf58]
test rax, rax
je 0x14014a484
cmp eax, 2
jne 0x14014a3bc
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14014a454
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x86
mov r9d, 2
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x14014a447
mov eax, 1
lock xadd qword [0x1401daf90], rax
test rax, rax
jle 0x14014a3dc
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401daf10], eax
mov qword [0x1401daf08], rsi
mov rcx, qword [0x1401d1418]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14014a454
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xb2
mov r9d, 2
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.1400a5d10
mov rcx, rsi
call fcn.140051360
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400d5720
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401daf58]
test rax, rax
je 0x14014a48b
jmp 0x14014a36e
Function at 0x14015b2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14015b2fa
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14015b33b
mov edi, eax
test bl, bl
jne 0x14015b3f3
mov eax, edi
and eax, 0x400
je 0x14015b3f3
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14015b31c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x81
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400a5d10
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015b3c8
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
cmp byte [rsp + 0x57], 0
jns 0x14015b3e4
mov rcx, qword [rsp + 0x40]
call fcn.1400d4ef4
lea rcx, [rsp + 0x58]
call fcn.140126ec0
jmp 0x14015b31c
and edi, 0x10
shr edi, 4
jmp 0x14015b31e