joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x24], 0x52
mov byte [rsp + 0x25], 9
mov byte [rsp + 0x26], 0x3c
mov byte [rsp + 0x27], 0x22
mov dword [rsp + 0x20], 0
jmp 0x14000102c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x31446
jae 0x14000108d
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rcx, section..data
movsxd rdx, dword [rsp + 0x20]
mov qword [rsp + 0x30], rdx
xor edx, edx
mov r8, qword [rsp + 0x30]
mov rax, r8
mov r8d, 4
div r8
mov rax, rdx
movsx eax, byte [rsp + rax + 0x24]
mov rdx, qword [rsp + 0x38]
movzx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
lea rdx, section..data
mov byte [rdx + rcx], al
jmp 0x140001022
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x31446
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov r8d, 0x31446
lea rdx, section..data
mov rcx, qword [rsp + 0x28]
call fcn.14000ebd0
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400017fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001846
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001846
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001846
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001846
cmp dword [rcx + 0x84], 0xe
jbe 0x140001846
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001848
xor al, al
add rsp, 0x28
ret

Function at 0x140004d88
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140004df7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004df7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004df7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004df7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004df7
cmp dword [rcx + 0x84], 0xe
jbe 0x140004df7
cmp dword [rcx + 0xf8], 0
je 0x140004df7
mov ecx, ebx
call fcn.140004ea8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140004c84
nop
cmp dword [rbp + 0x20], 0
je 0x140004e45
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140004e50
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140004d88

Function at 0x140004f8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004d88
Function at 0x140003dd8
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400143a0]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140003ee3
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003e5e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x140003ee3
jmp 0x140003e87
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.140003dd8
mov ebx, eax
test eax, eax
jne 0x140003ee3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x100
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x140003e6e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003ed6
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.140003f3c
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003ef3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
invalid
Function at 0x14000d270
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14000d2ac
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x14000d2b6
add rdi, rbx
sub rsi, rbx
jne 0x14000d28a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x14000fdb0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xb0]
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x48], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14008ed5c
mov rsi, rax
mov rax, qword [0x14010e5a0]
and rax, r15
cmp rax, qword [0x14010e588]
jne 0x14000fe15
mov rcx, r15
call fcn.140053b80
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x1400036f0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14000fe87
test r14, r14
je 0x14000fe7c
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400909a0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000fe58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x27a
jle 0x14000feac
cmp ebp, 0x5af
je 0x14000ff27
cmp ebp, 0x27b
jne 0x14000feb6
jmp 0x14000ff27
cmp ebp, 8
je 0x14000ff27
cmp ebp, 0xe
je 0x14000ff27
mov eax, dword [0x14011d84c]
mov ecx, dword [0x14011a6f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000ff2f
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, ebp
call fcn.14004b960
cmp byte [rbx + 0x17], 0
jns 0x14000fef6
mov rcx, qword [rsp + 0x30]
call fcn.14008ed54
test rsi, rsi
je 0x14000fe58
mov rcx, qword [rsi]
mov rax, qword [0x14010e5a0]
and rax, rcx
cmp rax, qword [0x14010e588]
jne 0x14000ff1a
call fcn.1400540d0
mov rcx, rsi
call fcn.14008ed54
jmp 0x14000fe58
mov rcx, rbx
call fcn.1400dd580
lea rcx, [0x14011d84c]
call fcn.14008ee04
cmp dword [0x14011d84c], 0xffffffff
jne 0x14000fed7
lea rcx, [0x14011d84c]
call fcn.14008ed98
jmp 0x14000fed7
Function at 0x140010a20
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x48], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov qword [rdx], rcx
mov qword [rdx + 8], r8
mov byte [rdx + 0x10], r9b
mov qword [rdx + 0x18], 0
lea rcx, [rsp + 0x20]
mov qword [rcx], rbx
mov edx, 8
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x140010b66
lea rcx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rsi + 0x20], rax
mov qword [rcx], rbx
mov edx, 8
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x140010b69
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x28], rax
mov eax, dword [0x140121cc0]
mov ecx, dword [0x14011a6f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140010b00
mov rdx, rdi
shl rdx, 4
lea rcx, [0x1401202c0]
xor r8d, r8d
call fcn.140010b70
mov qword [rsi + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
test rdi, rdi
je 0x140010b6c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400909a0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140121cc0]
call fcn.14008ee04
cmp dword [0x140121cc0], 0xffffffff
jne 0x140010abe
mov al, 0xaa
lea rdx, [rsp + 0x20]
mov byte [rdx + 7], al
mov cx, 0xaaaa
mov word [rdx + 5], cx
mov word [rdx + 0x19], cx
mov dword [rdx + 0x1b], 0xaaaa00aa
mov byte [rdx + 0x1f], al
xor eax, eax
mov dword [rdx], eax
mov byte [rdx + 4], al
xorps xmm0, xmm0
movups xmmword [rdx + 8], xmm0
mov byte [rdx + 0x18], al
mov dword [rdx + 0x20], eax
lea rcx, [0x1401202c0]
call fcn.14001bf40
lea rcx, [0x140121cc0]
call fcn.14008ed98
jmp 0x140010abe
int3
int3
int3

Function at 0x140012df0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x14011a6f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x120], 0
je 0x140012ead
mov eax, dword [0x14011a6f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x150], 1
je 0x140012ea9
mov ecx, dword [rsi + 0x1928]
test ecx, ecx
jne 0x140012ea9
mov ecx, 1
lock xadd dword [rsi + 0x1928], ecx
cmp ecx, 0x7fffffff
je 0x140012eb7
test rsi, rsi
je 0x140012eba
lea rbx, [rax + 0x150]
call fcn.140081b30
mov edx, 0x568
mov rcx, rax
xor r8d, r8d
call fcn.140010b70
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.140012ec0
mov ecx, dword [0x14011f380]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rbx], rdi
lock dec dword [rsi + 0x1928]
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x140012e9e
call fcn.1400900f8
jmp 0x140012e1a
int3
int3
Function at 0x1400164a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140121d78]
call qword [sym.imp.progwrp.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140016597
cmp byte [0x140121d80], 0
je 0x140016535
lea rcx, [0x140121d78]
mov rax, qword [0x140121d88]
mov rdx, qword [0x140121d90]
mov qword [0x140121d88], rdx
mov rsi, rax
shl rsi, 0x17
xor rsi, rax
mov rax, rdx
shr rax, 0x1a
xor rax, rdx
xor rax, rsi
shr rsi, 0x11
xor rsi, rax
mov qword [0x140121d90], rsi
add rsi, rdx
shr rsi, 0x20
call qword [sym.imp.progwrp.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400909a0
mov eax, esi
add rsp, 0x30
pop rsi
ret
movabs rsi, 0xaaaaaaaaaaaaaaaa
xorps xmm0, xmm0
movups xmmword [0x140121d88], xmm0
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
mov edx, 8
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x1400165a8
lea rcx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [0x140121d88], rax
mov qword [rcx], rsi
mov edx, 8
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x1400165ab
mov rax, qword [rsp + 0x20]
mov qword [0x140121d90], rax
mov byte [0x140121d80], 1
jmp 0x1400164d2
lea rcx, [0x140121d78]
call fcn.1400731b0
jmp 0x1400164c9
int3
int3
Function at 0x140017e30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140090940
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400bf160
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017ee3
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140017ee7
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.140017f40
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400909a0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140017ec4
cmp eax, 2
jne 0x140017f2f
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400bf160
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x140017f36
lea rdx, [rsp + 0x40]
jmp 0x140017eba
mov edi, 0x3f4
jmp 0x140017ec4
mov edi, 0xea
jmp 0x140017ec4
Function at 0x14001c960
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14001ca4e
cmp qword [rsi], 0
jne 0x14001ca4e
cmp dword [rsi + 0x14], 0
jne 0x14001ca4e
cmp qword [rsi + 8], 0
jne 0x14001ca4e
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x14001c9d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14001ca20
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14001c9c8
mov qword [rsi], r14
call fcn.140066340
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x14001ca0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14001ca36
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14001ca02
mov qword [rsi + 8], r14
call fcn.140066340
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140066340
mov rcx, qword [rsi]
call fcn.140085760
mov qword [rsi], 0
jmp 0x14001c9b6
call fcn.140066340
mov rcx, qword [rsi + 8]
call fcn.140085760
mov qword [rsi + 8], 0
jmp 0x14001c9ef
mov rcx, rsi
call fcn.1400db370
mov rax, qword [rsi]
jmp 0x14001c99a
Function at 0x14001e3d0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400bf160
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14001e48d
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14008f334
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.140085a70
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14001e4c0
cmp byte [rsi + 0x17], 0
jns 0x14001e45f
mov rcx, qword [rsi]
call fcn.14008ed54
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x14001e48d
mov rcx, qword [rsp + 0x30]
call fcn.14008ed54
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400909a0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14001e620
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x290
movaps xmmword [rsp + 0x280], xmm6
mov rsi, rcx
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400bf160
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001e6c5
cmp word [rsp + 0x70], 0
je 0x14001e6c5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14008f334
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140085a70
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400909a0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x280]
add rsp, 0x290
pop rbx
pop rdi
pop rsi
ret
xorps xmm6, xmm6
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm6
mov qword [rcx + 0x10], 0
call fcn.14001e3d0
test al, al
jne 0x14001e702
lea rax, [0x1400fe330]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.140085a70
jmp 0x14001e721
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
cmp byte [rsp + 0x57], 0
jns 0x14001e69f
mov rcx, qword [rsp + 0x40]
call fcn.14008ed54
jmp 0x14001e69f
Function at 0x14001e7b0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor eax, eax
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x14001e8d1
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x14001e90d
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr edi, 5
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x14001e915
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
and al, dil
mov byte [r8 + 0x16], al
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x14001e907
xor ecx, ecx
mov eax, 0x80000007
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x14001e919
pop rdi
pop rsi
ret
mov dl, byte [r8 + 0x19]
jmp 0x14001e900
xor r10d, r10d
jmp 0x14001e80f
xor eax, eax
jmp 0x14001e8a4
cmp byte [r8 + 0x1a], 0
je 0x14001e904
xor ecx, ecx
mov eax, 0x40000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x14001e904
cmp ecx, 0x666f736f
jne 0x14001e904
cmp edx, 0x76482074
jne 0x14001e904
mov byte [r8 + 0x19], 1
jmp 0x14001e904
Function at 0x1400271e0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140027229
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140027245
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140027221
mov qword [rsi], rdi
call fcn.140066340
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400272b7
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140066340
mov r14, qword [rsi]
cmp qword [0x14011f300], 0
je 0x140027276
mov rcx, qword [0x14011f300]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140102bb8]
mov qword [rsi], 0
jmp 0x14002720f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400fc046]
mov rcx, rax
call qword [sym.imp.progwrp.dll_GetProcAddress]
test rax, rax
je 0x1400272ba
lea rcx, [sym.chrome_proxy.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400272b1
call qword [0x140102bb8]
mov rcx, rax
xor edx, edx
call fcn.140006420
jmp 0x140027257
xor ecx, ecx
mov dl, 1
jmp 0x1400272aa
int3
xor ecx, ecx
jmp 0x1400272a8

Function at 0x1400277f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1400efde0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x20b
call fcn.140055660
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140078520
cmp byte [rdi + 0x17], 0
jns 0x140027862
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.140078040
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400909a0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x140027af0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x14010c040]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x140027bfa
mov rsi, rcx
mov eax, dword [0x140121cc0]
mov ecx, dword [0x14011a6f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140027b94
lea rcx, [0x1401202c0]
mov edx, 0x568
xor r8d, r8d
call fcn.140010b70
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.140012ec0
mov ecx, dword [0x14011f380]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x14011a6f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x150], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400909a0
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret
lea rcx, [0x140121cc0]
call fcn.14008ee04
cmp dword [0x140121cc0], 0xffffffff
jne 0x140027b32
mov al, 0xaa
lea rdx, [rsp + 0x28]
mov byte [rdx + 7], al
mov cx, 0xaaaa
mov word [rdx + 5], cx
mov word [rdx + 0x19], cx
mov dword [rdx + 0x1b], 0xaaaa00aa
mov byte [rdx + 0x1f], al
xor eax, eax
mov dword [rdx], eax
mov byte [rdx + 4], al
xorps xmm0, xmm0
movups xmmword [rdx + 8], xmm0
mov byte [rdx + 0x18], al
mov dword [rdx + 0x20], eax
lea rcx, [0x1401202c0]
call fcn.14001bf40
lea rcx, [0x140121cc0]
call fcn.14008ed98
jmp 0x140027b32
int3

Function at 0x140028ea0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140028ec0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x140028f00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140028f20
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x140028f60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140028f83
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret