joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402ab7c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
lea rsi, [0x1403a1eb0]
mov r8d, 0x400
mov rcx, rsi
mov dl, 0xaa
call fcn.14019dab0
xor eax, eax
mov ecx, 0xedb88320
mov r8d, eax
shr r8d, 1
mov edx, eax
and edx, 1
neg edx
and edx, ecx
xor edx, r8d
mov r9d, edx
shr r9d, 1
mov r8d, eax
shl r8d, 0x1e
sar r8d, 0x1f
and r8d, ecx
xor r8d, r9d
mov r9d, r8d
shr r9d, 6
mov r10d, eax
shl r10d, 0x1d
sar r10d, 0x1f
and r10d, 0x76dc419
mov r11d, eax
shl r11d, 0x1c
sar r11d, 0x1f
and r11d, 0xedb8832
xor r11d, r10d
mov r10d, eax
shl r10d, 0x1b
sar r10d, 0x1f
and r10d, 0x1db71064
xor r10d, r11d
mov r11d, eax
shl r11d, 0x1a
sar r11d, 0x1f
and r11d, 0x3b6e20c8
xor r11d, r10d
xor r11d, r9d
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, r11d
shl r8d, 0x1a
sar r8d, 0x1f
and r8d, ecx
xor r8d, edx
mov dword [rsi], r8d
inc rax
add rsi, 4
cmp rax, 0x100
jne 0x1402ab7e3
add rsp, 0x20
pop rsi
ret

Function at 0x1402b1150
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rcx + 0x10]
cmp r14, qword [rcx + 0x18]
jne 0x1402b11c4
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x1402b11f4
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r15, [rax + rcx]
inc r15
shr r15, 1
shl r15, 3
mov rcx, rbx
sub rcx, r15
mov r8, r14
sub r8, rbx
mov rdx, rbx
call fcn.14019d400
sub r14, r15
mov qword [rsi + 0x10], r14
sub qword [rsi + 8], r15
test r14, r14
je 0x1402b12a9
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14019b960
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, r14
sub rax, r15
sar rax, 2
cmp r14, r15
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1402b12d5
lea rcx, [r12*8]
call fcn.14019a06c
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1402b1274
mov rcx, r9
sar rcx, 3
and r9, 0xfffffffffffffff8
mov r8, r9
add r8, rdx
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1402b12a9
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1402b125c
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], r15
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r14
call fcn.1401d6fd0
mov r14, qword [rsi + 0x10]
jmp 0x1402b11c4
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401dac90
call fcn.1401d6b80
int3
Function at 0x1402b12e0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
jne 0x1402b1359
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1402b138a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
shl r12, 2
and r12, 0xfffffffffffffff8
lea r15, [r14 + r12]
sub r14, rbx
sub r15, r14
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14019d400
mov qword [rsi + 8], r15
add qword [rsi + 0x10], r12
mov rbx, r15
add rbx, 0xfffffffffffffff8
je 0x1402b1443
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14019b960
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1402b146f
lea rcx, [r12*8]
call fcn.14019a06c
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1402b140e
mov rcx, r9
sar rcx, 3
and r9, 0xfffffffffffffff8
mov r8, r9
add r8, rdx
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1402b1443
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1402b13f6
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1401d6fd0
mov rbx, qword [rsi + 8]
jmp 0x1402b1359
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401dac90
call fcn.1401d6b80
int3
Function at 0x1402b1480
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rcx + 0x10]
cmp r14, qword [rcx + 0x18]
jne 0x1402b14f4
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x1402b1524
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r15, [rax + rcx]
inc r15
shr r15, 1
shl r15, 3
mov rcx, rbx
sub rcx, r15
mov r8, r14
sub r8, rbx
mov rdx, rbx
call fcn.14019d400
sub r14, r15
mov qword [rsi + 0x10], r14
sub qword [rsi + 8], r15
test r14, r14
je 0x1402b15d9
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14019b960
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, r14
sub rax, r15
sar rax, 2
cmp r14, r15
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1402b1605
lea rcx, [r12*8]
call fcn.14019a06c
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1402b15a4
mov rcx, r9
sar rcx, 3
and r9, 0xfffffffffffffff8
mov r8, r9
add r8, rdx
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1402b15d9
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1402b158c
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], r15
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r14
call fcn.1401d6fd0
mov r14, qword [rsi + 0x10]
jmp 0x1402b14f4
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401dac90
call fcn.1401d6b80
int3
Function at 0x1402b1610
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
jne 0x1402b1689
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1402b16ba
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
shl r12, 2
and r12, 0xfffffffffffffff8
lea r15, [r14 + r12]
sub r14, rbx
sub r15, r14
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14019d400
mov qword [rsi + 8], r15
add qword [rsi + 0x10], r12
mov rbx, r15
add rbx, 0xfffffffffffffff8
je 0x1402b1773
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14019b960
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1402b179f
lea rcx, [r12*8]
call fcn.14019a06c
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1402b173e
mov rcx, r9
sar rcx, 3
and r9, 0xfffffffffffffff8
mov r8, r9
add r8, rdx
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1402b1773
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1402b1726
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1401d6fd0
mov rbx, qword [rsi + 8]
jmp 0x1402b1689
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401dac90
call fcn.1401d6b80
int3
Function at 0x1402ca730
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1402ca77e
cmp byte [rcx], 0x4d
jne 0x1402ca77e
cmp byte [rcx + 1], 0x5a
jne 0x1402ca77e
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x1402ca780
cmp rdx, r9
jbe 0x1402ca780
cmp r9d, 0x40
jb 0x1402ca780
mov r10d, r9d
and r10d, 7
jne 0x1402ca780
cmp byte [rcx + r9], 0x50
jne 0x1402ca77e
cmp byte [rcx + r9 + 1], 0x45
jne 0x1402ca77e
cmp byte [rcx + r9 + 2], 0
je 0x1402ca781
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x1402ca77e
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x1402ca780
cmp rdx, 2
jb 0x1402ca780
cmp word [rcx + r9], r8w
sete al
jmp 0x1402ca780
Function at 0x1402db850
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x1402db8b0
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14019b960
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1402e4a50
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1402e4a8f
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1402e4a5f
mov dword [rsi], 7
jmp 0x1402e4a5f
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.140102e30
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1402e4a6b
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1402e4a6b
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x1402e4b41
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1402e4a61
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402e4a5f

Function at 0x1402eaab0
Capabilities:
Decompress data using quicklz

Disassembly:
mov r8d, dword [rdx]
mov eax, r8d
and eax, 0xf800d000
cmp eax, 0xf0008000
sete al
mov r9d, r8d
not r9d
test r9d, 0x3c00000
setne r9b
and r9b, al
test cl, 1
sete r10b
lea eax, [rcx + 0x100000]
cmp eax, 0x200000
setb al
and al, r10b
and al, r9b
cmp al, 1
jne 0x1402eab4e
mov r9d, ecx
shr r9d, 1
and r9d, 0x7ff
and r8d, 0xfbc0d000
mov r10d, ecx
shl r10d, 6
and r10d, 0x4000000
mov r11d, ecx
shl r11d, 4
and r11d, 0x3f0000
or r11d, r10d
mov r10d, ecx
shr r10d, 5
and r10d, 0x2000
or r10d, r11d
shr ecx, 8
and ecx, 0x800
or ecx, r10d
or ecx, r9d
or ecx, r8d
mov dword [rdx], ecx
ret

Function at 0x1402eabe0
Capabilities:
Decompress data using quicklz

Disassembly:
mov eax, edx
or eax, ecx
test al, 1
je 0x1402eabeb
xor eax, eax
ret
sub edx, ecx
mov eax, edx
and eax, 1
lea ecx, [rdx + rax]
add ecx, 0xfffffffc
mov rdx, r8
jmp fcn.1402eaab0
Function at 0x1402ee6f0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14030e560]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401d6830
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1402f3410
test al, al
je 0x1402ee845
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402ee7bd
mov rcx, r14
call fcn.1401d6830
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1402f3410
test al, al
je 0x1402ee806
cmp dword [rbx], 0x4550
jne 0x1402ee876
mov sil, 1
test rdi, rdi
je 0x1402ee855
mov qword [rdi], r14
jmp 0x1402ee855
mov ecx, 1
call fcn.14014d760
test al, al
je 0x1402ee853
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402ee8ea
mov ecx, 1
call fcn.14014d760
test al, al
je 0x1402ee853
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402ee8e4
mov ecx, 1
call fcn.14014d760
test al, al
jne 0x1402ee8b8
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14019b960
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14014d760
test al, al
je 0x1402ee853
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402ee8ea
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401d6c00
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402ee8ff
and r8d, 0x7f
jmp 0x1402ee906
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401d6c00
mov rcx, rdi
call fcn.14007cf40
jmp 0x1402ee853
Function at 0x1402ee920
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140381038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14030e560]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401d6830
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1402f3410
test al, al
je 0x1402eea75
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402ee9ed
mov rcx, r14
call fcn.1401d6830
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1402f3410
test al, al
je 0x1402eea36
cmp dword [rbx], 0x4550
jne 0x1402eeaa6
mov sil, 1
test rdi, rdi
je 0x1402eea85
mov qword [rdi], r14
jmp 0x1402eea85
mov ecx, 1
call fcn.14014d760
test al, al
je 0x1402eea83
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402eeb1a
mov ecx, 1
call fcn.14014d760
test al, al
je 0x1402eea83
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402eeb14
mov ecx, 1
call fcn.14014d760
test al, al
jne 0x1402eeae8
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14019b960
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14014d760
test al, al
je 0x1402eea83
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402eeb1a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14007ca10
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401d6c00
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402eeb2f
and r8d, 0x7f
jmp 0x1402eeb36
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401d6c00
mov rcx, rdi
call fcn.14007cf40
jmp 0x1402eea83
Function at 0x14000baa0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000baad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000babd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000baa5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000bad5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000bac2
sub eax, 3
jb 0x14000baef
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000bb26
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000bb16
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000bb14
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000bb03
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000ba62
jmp 0x14000baad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1c00
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000bb72
cmp rsi, rcx
jae 0x14000bb7a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000bb59
cmp al, 0x8f
ja 0x14000bb59
cmp byte [rsi - 2], 0xf
je 0x14000bb5f
sub al, 0xe8
cmp al, 1
ja 0x14000bb43
cmp rsi, rcx
jae 0x14000bb7a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000bb49
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000bb7a
lodsb al, byte [rsi]
jmp 0x14000bb59
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9000]
mov eax, dword [rdi]
or eax, eax
je 0x14000bbd7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb1dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000bb87
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000bbd1
mov qword [rbx], rax
add rbx, 8
jmp 0x14000bba7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000bc11
cmp al, 0xef
ja 0x14000bc03
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000bbe3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000bbf2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000bc65
sub rsp, 0xffffffffffffff80
jmp 0x140001fd0
Function at 0x1800010b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800010e1
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x14000c5e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
movzx eax, byte [0x1401e45b2]
test eax, eax
jne 0x14000c5f9
jmp 0x14000c696
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14000c62e
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0xec]
and eax, 1
test eax, eax
je 0x14000c62e
mov edx, 0x10001
lea rcx, [0x1401e44b0]
call fcn.1400cf400
jmp 0x14000c696
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14000c685
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0xec]
and eax, 1
test eax, eax
jne 0x14000c685
mov edx, 0x100
lea rcx, [0x1401e44b0]
call fcn.1400cf400
mov edx, 0x10001
lea rcx, [0x1401e44b0]
call fcn.1400cf400
mov edx, 0x100
lea rcx, [0x1401e44b0]
call fcn.1400cf400
jmp 0x14000c696
mov edx, 0x100
lea rcx, [0x1401e44b0]
call fcn.1400cf400
add rsp, 0x28
ret
Function at 0x14002dcf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140101f28
add rsp, 0x28
ret

Function at 0x14002e330
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1401361c0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14002e3be
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14002e362
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret