joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x140026c71
xor r11d, r11d
lea r10, [0x140067580]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x140026c20
jmp 0x140026c74
mov edx, r9d
mov dword [rcx + 0x18], edx
pop rsi
ret
Function at 0x14002a090
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.14001fd70
call fcn.1400316e0
test al, al
je 0x14002a0de
movsxd r9, esi
lea rdx, str.File::Write
lea rcx, [rsp + 0x50]
mov r8, rbx
call fcn.140031780
mov rax, rdi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], edi
shr rax, 0x20
mov dword [rsp + 0x44], eax
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.140031750
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140041210
mov eax, esi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002e6e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x140081060]
cmp ecx, 0xffffffff
je 0x14002e70d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002e712
call fcn.14002e840
mov eax, dword [0x140083f68]
mov ecx, dword [0x140085118]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002e7db
mov rbx, qword [0x140083f60]
mov rcx, rbx
call fcn.14001fd80
mov rcx, qword [0x140082758]
add rcx, 1
xor edx, edx
lea rax, [0x140082760]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14002e791
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14002e791
add rdx, 2
add rcx, 2
cmp rdx, 0x100
jb 0x14002e760
jmp 0x14002e7b6
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x140082758], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x14002e823
cmp eax, 0x100
jge 0x14002e82a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x140083f68]
call fcn.140041470
mov eax, dword [0x140083f68]
cmp eax, 0xffffffff
jne 0x14002e737
mov ecx, 8
call fcn.140041250
mov rbx, rax
mov rcx, rax
call fcn.14001fd70
mov qword [0x140083f60], rbx
lea rcx, [0x140083f68]
call fcn.140041410
jmp 0x14002e737
int3
int3
Function at 0x14002e840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.140041b50
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x140081338]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
mov ecx, dword [0x140081060]
mov dword [rbp - 0x54], ecx
cmp ecx, 0xffffffff
jne 0x14002e8d8
lea rcx, [rbp - 0x54]
call fcn.140032830
test al, al
je 0x14002e94f
mov ecx, dword [rbp - 0x54]
cmp ecx, 0xffffffff
jne 0x14002e8b8
lea rcx, [rbp - 0x54]
call fcn.140032830
test al, al
je 0x14002e956
cmp dword [rbp - 0x54], 0xffffffff
je 0x14002e956
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rbp - 0x54]
mov eax, 0xffffffff
lock cmpxchg dword [0x140081060], ecx
mov ecx, dword [rbp - 0x54]
je 0x14002e8d8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140081060]
mov dword [rbp - 0x54], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002e948
lea rsi, [rbp - 0x50]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1400445c0
mov ecx, dword [rbp - 0x54]
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400418b0
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400440e0
mov ecx, dword [rbp - 0x54]
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.140041210
mov rax, rdi
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
int3
int3
int3

Function at 0x14002e960
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140081060]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14002e98f
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14002e98f
mov rax, qword [rax + rcx]
jmp 0x14002e991
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14002e9a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140081060]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002e9c2
call fcn.14002e840
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400317c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x140031802
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14003180d
add rdi, rbx
sub rsi, rbx
jne 0x1400317e0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
int3

Function at 0x140032830
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140032849
mov dword [rsi], eax
mov al, 1
jmp 0x14003284b
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140032b70
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140032beb
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140032beb
cmp dword [rsp + 0x38], 4
jne 0x140032beb
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140032ec0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x7fffffff
jbe 0x14003281c
xor eax, eax
ret
jmp 0x140032ec0
push rsi
xor eax, eax
test rcx, rcx
je 0x140032ffd
test edx, edx
jle 0x140032ffd
mov r11d, edx
shr r11d, 2
je 0x140032f7c
lea r10d, [r11 - 1]
mov r9d, r11d
mov esi, edx
mov r8, rcx
test dl, 4
je 0x140032f1a
movzx r9d, word [rcx]
add r9d, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, r9d
shl r9d, 0x10
xor r9d, eax
lea r8, [rcx + 4]
mov esi, r9d
shr esi, 0xb
add esi, r9d
mov r9d, r10d
lea r10, [r10*4 + 4]
cmp r11d, 1
je 0x140032f77
add r9d, 2
nop dword [rax]
movzx eax, word [r8]
add eax, esi
movzx esi, word [r8 + 2]
shl esi, 0xb
xor esi, eax
shl eax, 0x10
xor eax, esi
mov esi, eax
shr esi, 0xb
add esi, eax
movzx eax, word [r8 + 4]
add eax, esi
movzx esi, word [r8 + 6]
shl esi, 0xb
xor esi, eax
shl eax, 0x10
xor eax, esi
mov esi, eax
shr esi, 0xb
add esi, eax
add r9d, 0xfffffffe
add r8, 8
cmp r9d, 2
jg 0x140032f30
add rcx, r10
jmp 0x140032f7e
mov esi, edx
and dl, 3
cmp dl, 1
je 0x140032fac
cmp dl, 2
je 0x140032fbe
cmp dl, 3
jne 0x140032fd1
movzx eax, word [rcx]
add esi, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, esi
mov ecx, esi
shl ecx, 0x10
xor eax, ecx
mov esi, eax
shr esi, 0xb
jmp 0x140032fcf
movsx eax, byte [rcx]
add esi, eax
mov eax, esi
shl eax, 0xa
xor eax, esi
mov esi, eax
shr esi, 1
jmp 0x140032fcf
movzx eax, word [rcx]
add esi, eax
mov eax, esi
shl eax, 0xb
xor eax, esi
mov esi, eax
shr esi, 0x11
add esi, eax
lea eax, [rsi*8]
xor eax, esi
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret

Function at 0x1400347b0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov r8d, 0x104
mov rdx, rdi
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14003481f
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140034730
test al, al
jne 0x14003482d
add rbx, 8
cmp rbx, 0x18
jne 0x1400347ed
xor esi, esi
jmp 0x140034830
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140041210
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140034fa0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm6
mov r14, rdx
mov r12, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdx, qword [0x140083fd0]
test rdx, rdx
jne 0x1400350e6
mov ecx, 0x20
call fcn.140041250
mov rsi, rax
mov eax, 7
movq xmm6, rax
pslldq xmm6, 8
movdqu xmmword [rsi + 0x10], xmm6
xor ebx, ebx
mov word [rsi], bx
mov qword [0x140083fd0], rsi
mov ecx, 0x20
call fcn.140041250
mov rdi, rax
movdqu xmmword [rax + 0x10], xmm6
mov word [rax], bx
mov qword [0x140083fd8], rax
call fcn.140036ef0
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0x48]
movdqu xmmword [r15 + 0x10], xmm6
mov word [r15], bx
lea rbp, str.user_data_dir
mov rcx, rbp
call fcn.1400478b0
mov rcx, r15
mov rdx, rbp
mov r8, rax
call fcn.1400019a0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbp, rax
lea r13, [rsp + 0x28]
movdqu xmmword [r13 + 0x10], xmm6
mov word [r13], bx
mov rcx, rax
call fcn.1400478b0
mov rcx, r13
mov rdx, rbp
mov r8, rax
call fcn.1400019a0
lea rbp, [rsp + 0x68]
mov rcx, rbp
mov rdx, r13
mov r8, r15
call fcn.140035600
mov rcx, rbp
mov rdx, qword [rsp + 0x20]
mov r8, rsi
mov r9, rdi
call fcn.140034b70
mov esi, eax
mov rcx, rbp
call fcn.140001450
mov rcx, r13
call fcn.140001450
mov rcx, r15
call fcn.140001450
test sil, sil
je 0x14003512a
mov rdx, qword [0x140083fd0]
cmp rdx, r12
je 0x140035101
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1400350f9
mov rdx, qword [rdx]
mov rcx, r12
call fcn.1400019a0
mov bl, 1
test r14, r14
je 0x14003512a
mov rdx, qword [0x140083fd8]
cmp rdx, r14
je 0x14003512a
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140035122
mov rdx, qword [rdx]
mov rcx, r14
call fcn.1400019a0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140041210
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400359c0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x140035aa8
mov edx, ebx
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
lea rsi, [rsp + 0x20]
movdqu xmmword [rsi + 0x10], xmm0
mov word [rsi], 0
xor r8d, r8d
mov rcx, rsi
call fcn.140034ac0
cmp qword [rsi + 0x18], 7
jbe 0x140035a2d
mov rsi, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140035a7f
mov edx, eax
cmp qword [rsp + 0x30], rdx
jbe 0x140035a7f
lea rdi, [rsp + 0x20]
xor r8d, r8d
mov rcx, rdi
call fcn.140034a80
movups xmm0, xmmword [rdi + 0x10]
movups xmmword [r14 + 0x10], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [r14], xmm0
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
jmp 0x140035a97
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [r14 + 0x10], xmm0
mov rdi, r14
mov word [rdi], 0
lea rcx, [rsp + 0x20]
call fcn.140001450
jmp 0x140035ac3
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [r14 + 0x10], xmm0
mov word [r14], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041210
mov rax, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140035ae0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x140035aee
mov rcx, qword [rcx]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1400361f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
movdqa xmmword [rsp + 0x70], xmm6
mov rdi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp qword [rcx + 0x18], 7
mov rsi, rcx
jbe 0x140036222
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140036255
test al, 0x10
jne 0x140036391
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.1400363f0
xor edi, edi
jmp 0x1400363c4
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], 0
lea rdx, [0x1400683ae]
mov r8, 0xffffffffffffffff
mov rcx, rdi
call fcn.140036470
cmp rax, 0xffffffffffffffff
je 0x1400362f9
mov ecx, 7
movq xmm6, rcx
pslldq xmm6, 8
lea rbx, [rsp + 0x20]
movdqu xmmword [rbx + 0x10], xmm6
xor ebp, ebp
mov word [rbx], bp
xor r8d, r8d
mov rcx, rbx
mov rdx, rdi
mov r9, rax
call fcn.140036e50
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140001450
movdqu xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
movdqu xmmword [rbx + 0x10], xmm6
mov word [rbx], bp
mov rcx, rbx
call fcn.140001450
mov rcx, rdi
call fcn.1400361f0
test al, al
je 0x1400363ac
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400363ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x14003637d
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
lea r14, [rsp + 0x20]
movdqu xmmword [r14 + 0x10], xmm0
mov word [r14], 0
mov rcx, rsi
call fcn.1400478b0
mov rcx, r14
mov rdx, rsi
mov r8, rax
call fcn.1400019a0
cmp qword [r14 + 0x18], 7
mov rcx, r14
jbe 0x140036363
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
mov rcx, r14
call fcn.140001450
cmp ebp, 0xffffffff
je 0x14003637d
and ebp, 0x10
jne 0x1400363ba
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.1400363f0
jmp 0x1400363b8
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.1400363f0
mov dil, 1
jmp 0x1400363c4
lea rcx, [0x1400683b4]
call fcn.1400363f0
xor edi, edi
lea rcx, [rsp + 0x40]
call fcn.140001450
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140041210
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400363f0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi + 0x10], r9
mov qword [rdi + 8], r8
mov qword [rdi], rdx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.140002c50
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x140083fe0]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.14004b1d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041210
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140037bf0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x140037c47
bt ebx, 8
jae 0x140037c2c
mov eax, ebx
and eax, 0x200
jne 0x140037c47
cmp edi, 2
lea rax, [0x140084a40]
lea rcx, [0x140084c40]
cmove rcx, rax
cmp word [rcx], 0
je 0x140037c66
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140041210
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x140037c47
cmp byte [0x140084a30], 0
setne al
bt ebx, 8
jb 0x140037c47
shr ebx, 9
and ebx, 1
or bl, al
je 0x140037c47
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x140037cc6
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
xor r15d, r15d
mov r13d, 1
mov eax, 0
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x140037d68
movzx edx, word [rdi + rbx*2]
cmp edx, 0x5c
je 0x140037d01
test dx, dx
jne 0x140037d8a
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x140037d2f
cmp ebp, 2
jne 0x140037d25
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x140037d2f
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
movzx edx, dx
cmp edx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x140037d4b
dec r14
movzx edx, word [rax + 2]
add rax, 2
cmp edx, 0x5c
je 0x140037d3b
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x140037d91
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x140037d8a
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.14004ef00
test eax, eax
je 0x140037cef
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x140037d68
cmp dword [rsp + 0x2c], 0
je 0x140037c47
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x140037db0
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.1400478b0
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.140038670
jmp 0x140037c47
Function at 0x14003a580
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
mfence
mov rax, qword [0x1400850a0]
test rax, rax
jne 0x14003a5ca
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mfence
mov rax, qword [0x1400850a0]
test rax, rax
je 0x14003a5b4
cmp eax, 2
jne 0x14003a612
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14003a6a4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x82
mov r9d, 2
mov rcx, rsi
call fcn.14001a3f0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x14003a697
mov eax, 1
lock xadd qword [0x1400850d8], rax
test rax, rax
jle 0x14003a632
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140085058], eax
mov qword [0x140085050], rsi
mov rcx, qword [0x140081318]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14003a6a4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0xae
mov r9d, 2
mov rcx, rsi
call fcn.14001a3f0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
call fcn.140003420
mov rcx, rsi
call fcn.14001a880
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140041210
xor eax, eax
add rsp, 0x138
pop rdi
pop rsi
ret
Function at 0x14003aec0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x14003aee9
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14003afd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003af2b
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp fcn.14003b000
mov ecx, 2
call fcn.14001a340
test al, al
je 0x14003afd5
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x239
mov r9d, 2
mov rcx, rdi
call fcn.14001b8b0
lea rcx, [rsp + 0x48]
lea rdx, str.CreateDirectory
call fcn.140003420
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14003af87
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14000bc90
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14003afbd
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140013130
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.14001b9f0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140041210
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret